IdRa vs Okta, row by row.
Okta is a very broad product, and IdRa doesn’t match all of it. This table shows where each stands, audited from IdRa’s own code, so you can decide before you run a pilot.
Why people look at IdRa
- It’s free, with no per-user pricing or add-ons
- You’ll be able to run it yourself once the repository is public
- Each organization has its own database
- Your Okta API scripts can keep working where IdRa covers the same requests and responses
Why you might stay with Okta
- You need AD or LDAP agents, FastPass, or native device agents
- Your auditors need SOC 2, ISO 27001 or FedRAMP reports from your vendor
- You rely on a large pre-integrated app catalog, Workflows or custom admin roles
- You need a service-level agreement and multi-region availability
The feature matrix
Audited on October 30, 2026. IdRa’s status comes from reading its code, and Okta’s from Okta’s public documentation, which also decides what each feature is called. This covers the features most likely to change a decision, not every setting. Okta’s plans and packaging vary, so check what yours includes.
Included Implemented
Partial Works, with the limits noted
On the roadmap Not built yet, and in the build plan
Not planned A deliberate skip, or undecided, today
| Capability | Okta | IdRa | IdRa today |
|---|---|---|---|
| Sign-on | |||
| OIDC: code + PKCE, refresh, client credentials, device | Yes | Included | Conformance suite self-run: 26 of 35 modules passed, 0 failed. Not a formal certification. |
| SAML 2.0 SP- and IdP-initiated sign-on | Yes | Included | Tested with SimpleSAMLphp. |
| SAML Single Logout, encrypted assertions, signed requests | Yes | On the roadmap | Not implemented yet. |
| Native mobile and desktop OIDC apps | Yes | On the roadmap | Web, single-page and service apps today. |
| private_key_jwt, PAR, JAR, token exchange | Yes | On the roadmap | Not implemented yet. |
| Pre-integrated app catalog | Thousands of apps | Partial | 14 templates, plus any standards-based app by hand. |
| WS-Federation, RADIUS, LDAP interface | Yes | Not planned | Skipped deliberately. |
| Authenticators | |||
| Passkeys (WebAuthn) | Yes | Included | No AAGUID allow-lists or attestation yet. |
| TOTP, SMS, voice, security question | Yes | Included | SMS and voice go through Twilio. |
| YubiKey OTP, Duo | Yes | Included | Tested against fakes. |
| Push with number challenge | Okta Verify | Partial | IdRa Verify is an installable web app, not a native app. |
| Device-bound sign-in (FastPass) | Yes | Not planned | Needs a native agent. Nothing planned today. |
| Self-service recovery | Yes | Included | Never says whether an account exists. Timing differences remain. |
| Policies and threat | |||
| App sign-in rules by group, zone, risk and device | Yes | Partial | No user-type or expression conditions, or method chains. |
| Global session policy | Yes | Partial | Applies each time a session reaches an app. No user targets or per-rule idle timeout. |
| IP and dynamic network zones | Yes | Included | Country and ASN zones need Cloudflare in front, so not on idra.team today. |
| ThreatInsight-style blocking | Yes | Partial | Public feeds and a local detector, no cross-customer data. |
| Behavior detection and risk scoring | Yes | Partial | A fixed set of signals and weights. |
| Entity risk policy and Universal Logout | Yes | Included | JWT access tokens stay valid until they expire. |
| Shared Signals transmitter | Yes | Included | CAEP and RISC, push and poll. |
| Shared Signals receiver | Yes | Partial | Push only. Signals change risk. |
| Policy simulation | Yes | On the roadmap | Not implemented yet. |
| Directory and lifecycle | |||
| Users, groups and custom attributes | Yes | Partial | Attribute types are basic. No uniqueness or attribute permissions. |
| Group rules | Yes | Partial | One attribute condition per rule, one target group. |
| User types, linked objects, nested groups | Yes | On the roadmap | One global schema today. |
| AD and LDAP agents | Yes | Not planned | Skipped deliberately. Needs a separate agent. |
| Inbound SCIM | Yes | Partial | Users, PATCH and deprovisioning. Filter is eq only. |
| Outbound SCIM | Yes | Partial | Create, update, deactivate, reactivate. No delete. |
| App imports | Yes | On the roadmap | Not implemented yet. |
| HR-driven provisioning | Yes | Not planned | Generic SCIM push only. Undecided. |
| No-code workflows | Yes | Not planned | Event hooks are the automation surface. |
| Scheduled lifecycle automations | Yes | On the roadmap | Not implemented yet. |
| API access | |||
| Authorization servers, scopes and claims | Yes | Partial | One issuer per tenant. Claims are static values. |
| Token preview | Yes | Included | Access tokens. |
| Inline hooks | Yes | On the roadmap | Event hooks only. |
| Management API | Full (815 SDK operations) | Partial | 118 of 815, with Okta’s error, paging and rate-limit shapes. |
| OAuth-scoped API tokens | Yes | On the roadmap | SSWS tokens only. |
| Terraform provider | Yes | On the roadmap | Not yet run against IdRa. |
| Administration | |||
| Standard admin roles | 12 roles | Partial | Five roles. |
| Custom roles and resource sets | Yes | On the roadmap | All roles are org-wide. |
| System Log | Yes | Partial | Search, filters, CSV export, API and retention. |
| Log streaming | Yes | On the roadmap | Use an event hook on all events, or poll. |
| Multibrand, localization | Yes | On the roadmap | One brand per tenant, English only. |
| Devices | |||
| Device assurance | Yes | Partial | OS version, disk encryption and managed state. No screen-lock check. |
| Jamf, Intune, Kandji, Fleet | Varies | Partial | Tested against fixtures, not live tenants. |
| Desktop MFA, Platform SSO, password sync | Yes | Not planned | Needs native agents. Nothing planned today. |
| Beyond sign-on | |||
| Privileged access: SSH certificates and a vault | Yes | Partial | SSH only. No session recording or RDP. |
| Access requests | Yes | Partial | Groups only, one approval step. |
| Certifications, entitlements, separation of duties | Yes | On the roadmap | Not implemented yet. |
| Posture management | Yes | Partial | 9 connectors and 26 checks. Run against fixtures. |
| Partner access portal | Yes | Partial | Invitations, bring-your-own IdP, expiry. One linked group, and removal keeps the account. |
| Header-based app gateway | Yes | Partial | Forward-auth at host level, inside the cookie domain. Upstreams receive the session cookie. |
| AI agent identity | Yes | On the roadmap | Not implemented yet. |
| How it’s delivered | |||
| Run it on your own infrastructure | No | On the roadmap | One Bun process and Postgres, once the repository is public. |
| Database per tenant | Isolated orgs | Included | Each organization gets its own Postgres database. |
| Published price | Per-user plans | Included | Free. |
| SOC 2, ISO 27001, FedRAMP | Yes | Not planned | None today, and no external security review. Undecided. |
| Multi-region | Yes | Not planned | Undecided. |
| More than one replica | Yes | On the roadmap | One replica today. |
Roadmap rows carry no dates. Vendor integrations (Twilio, Duo, RSA, Yubico, Jamf, Intune, Kandji, Fleet and the SaaS connectors) have run against fixtures or fakes, so “included” means implemented, not proven against the vendor’s live service.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.