Connect Okta
Let people sign in with Okta and, optionally, provision your directory from it.
Okta and any other OpenID provider use the same guided setup as Entra ID. Sign-in and provisioning fail independently, so set them up one at a time.
Before you start
- Admin access to your Okta org, and its sign-in domain.
- The portal open at Admin console › Organisation › Sign-in & provisioning.
-
Register a provider
Select Register a provider and choose Okta. Copy the Redirect URI the portal shows; it is unique to your organisation.
-
Create the sign-in application in Okta
Create an OpenID Connect web application, set its sign-in redirect URI to the address you copied, and note its client ID and client secret.
-
Enter the values
Back in the portal, enter your Okta sign-in domain (the portal builds the issuer from it and shows it), the client ID, the client secret and your people’s email domain. Okta identifies people by the
emailclaim, so nothing else needs configuring. -
Check sign-in
Each check passes or names what to fix. Repair sign-in re-applies the settings with the stored secret.
-
Provisioning
Issue a provisioning credential and paste it, with the provisioning address, into Okta’s provisioning settings. OAuth client credentials is the default; Bearer token gives one long-lived secret. The secret is shown once, and a new credential stops the old one immediately.
-
First push
Assign one person in Okta and wait for them to arrive in Users.
In a portal-owned directory provisioning is optional, and the last two steps offer to skip it.
See Organisation for rotating the secret, replacing the credential and reading the provisioning report.