Platform / Universal Directory
One record for each person, and rules that use it.
People, groups, custom attributes and group rules, all in one place, and available to every app and policy.
- Name
- Ana Rivera
- Login
ana@example.com- department
- Finance
- Status
- Active
Group ruleuser.department=="Finance"
Matches go to the Finance group, and its apps follow.
People with a full lifecycle
Staged, active, suspended, deprovisioned: every change is an event in the System Log.
- Custom attributes in the Profile Editor: text, number, boolean, date and enum
- Self-service recovery, which also clears a lockout
- Admin impersonation with a reason, fresh MFA and a log entry
Groups that maintain themselves
Write a rule once and membership follows the data. Every person is also in an implicit Everyone group.
- Group rules on one attribute condition, using a subset of the Okta Expression Language
- Time-limited membership
- Group-based assignment for apps and policies
Every way to reach it
Use the admin console, CSV, SCIM, or the Okta-compatible API at /api/v1 with Okta’s own SDK.
- Search and filter with Okta’s operators on the API
- Reports for sign-in activity, MFA, app access denials and inactive people
- Five admin roles from read-only to super admin
Standards it speaks
- SCIM 2.0
- Okta Users and Groups API
Not here yet
- AD and LDAP agents: not planned today
- User types, linked objects such as manager, and nested groups
- Custom admin roles, and roles scoped to a set of people or apps
We’d rather you read this now than find it in a pilot. See the full comparison.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.