--- title: IEM Okta Setup slug: iem-okta-setup docTags: createdAt: 2026-06-02T20:19:50.845Z --- The Okta IdP integration allows you to sync user identities from your Okta organization directly into Flare as Identity Identifiers. Once synced, Flare can automatically validate exposed credentials against those identities whenever a new leaked credential is detected, and perform mitigation actions on compromised accounts. :::hint{type="info"} ### Important to Note The Okta integration is available on request. Please reach out to your CSM to get access. **Identity synchronization** After the integration is configured, the initial sync can take up to 24 hours to complete. Once the initial sync has run, identities are automatically synchronized every night. **Tenant considerations** 1. Your Tenant has a cap on the number of Identity Identifiers. If you are syncing a large user base, consult with your CSM before enabling a full sync. 2. Currently, one IdP integration per Tenant is supported. If you already have an Entra ID integration in a Tenant, [create a new Tenant for Okta integration](docId\:gVu3V0Xvtlo_eJ0KYlEBB). ::: :::hint{type="warning"} ### Identity Identifier Deletion Identity Identifiers are automatically removed under the following circumstances: - **User deleted from Okta:** If a user is removed from your Okta organization, the corresponding Identity Identifier in Flare is deleted after two weeks. - **Integration downtime**: If your Okta integration goes down, all Identity Identifiers synced from Okta are deleted after two weeks. It is recommended to restore a broken integration as soon as possible to avoid unintended deletion of Identity Identifiers. Tenant admins receive in-app notifications of a broken IdP integration through the [Notifications Center](docId\:CCN4aXsjkunh7HUiL7hzG). ::: *** # Prerequisites for Okta Before setting up the Okta integration in Flare, complete a few configuration steps in Okta. You can [view our interactive product tours](https://flaredemo.storylane.io/hub/wcikksxovdlg) for a guided walkthrough, or follow the steps below. ## Step 1: Create Groups, Resource sets, and Admin role A Resource set is a collection of Okta resources, such as user groups, that limits the permissions of a custom admin role to specific resources. By binding the Flare service app to a Resource set, you can limit the integration to a specific subset of users rather than granting access to your entire Okta directory. For more information on Resource sets, see Okta's documentation on [Working with Resource sets](https://help.okta.com/en-us/content/topics/security/custom-admin-role/work-with-resource-set.htm). :::hint{type="info"} This step is optional. Custom groups, roles, and Resource sets are only required if you want to limit the integration to a specific subset of users. If you want to enable the integration for your entire Okta organization, you can use one of [Okta's built-in Admin roles](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm) instead. If you are not using custom groups, roles, or Resource sets, continue to [Step 2: Create the Okta Service App](docId\:gVu3V0Xvtlo_eJ0KYlEBB) ::: ### Create a Group of Users ::::WorkflowBlock :::WorkflowBlockItem First, let's create a group of users to assign to the Resource set. From the Okta **Admin Console**, go to **Directory** and then **Groups**. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/i_umoKH-v6dCU5fzd6Fdb_image.png) ::: :::WorkflowBlockItem Click **Add Group** to create a new group. Provide a name and description for the group. ::: :::WorkflowBlockItem Click on the newly created group name to add users to it. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/MCD5Gn5c_c5T8ELNo90--_image.png" size="80" isUploading="false" width="1272" height="824" darkWidth="1272" darkHeight="824" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem From the **People** tab, click **Assign** **people** to add users. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/M3ueOdWHGyblbyNNrEJJk_image.png" size="80" isUploading="false" width="1256" height="790" darkWidth="1256" darkHeight="790" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Click **Done** to save the group. ::: :::: ### Create a Resource Set and Admin Role Next, let's create a Resource set and Admin role. :::::WorkflowBlock :::WorkflowBlockItem From the Okta Admin Console, go to **Security** and then **Administrators**. Select the **Resources** tab to create a new Resource set. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/DQnenmoM9GH7pPjQaIRjU_image.png" size="80" width="2330" height="742" darkWidth="2330" darkHeight="742" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Click **Create a new resource set**, and enter a name and description. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/FDraEbU_JKwZ4cWtLYtIo_image.png" size="40" width="1112" height="1140" darkWidth="1112" darkHeight="1140" position="flex-start" showCaption="false"} ::: ::::WorkflowBlockItem Click **Add resource** and select **Users** as the resource type. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/LIb7iGzLSmUA-AhG08SYI_image.png" size="40" isUploading="false" width="696" height="524" darkWidth="696" darkHeight="524" position="flex-start" showCaption="false"} :::hint{type="warning"} **Important:** When completing this step, select **Users **rather than **Groups.** ::: :::: :::WorkflowBlockItem Use the **Select Users** option and select a group. Click **Create** to finish creating the Resource set. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/XZbGlGqxD6so7QdJDWvEH_image.png" size="40" isUploading="false" width="628" height="498" darkWidth="628" darkHeight="498" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Next, go to the **Roles** tab. You can use either one of the [standard admin roles](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm), or create a custom role. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/z7zQEtsrLjuTqtdY17OsT_image.png" size="74" width="1860" height="1300" darkWidth="1860" darkHeight="1300" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem To create a custom role, click **Create new role**. - To sync Identity Identifiers without any mitigation actions, select the V**iew users and their details** permission. - To enable mitigation actions, select additional roles of **Suspend users** and **Clear user's session**. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/s2PD0zT3nht5OlIc6WY5T_image.png" size="70" width="1446" height="1328" isUploading="false" darkWidth="1446" darkHeight="1328" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Click **Save** **Role** to save the Admin role. ::: ::::: *** ## Step 2: Create the Okta Service App :::::WorkflowBlock :::WorkflowBlockItem In the Okta Admin Console, navigate to **Applications** > **Applications**. ::: :::WorkflowBlockItem Click **Create** **App** **Integration** to start the setup. ![](https://storylane-prod-uploads.s3-accelerate.amazonaws.com/company/company_20a0d51f-f082-4b76-9171-f9a550931d66/project/project_e829727f-42cc-459a-b592-b6b300616615/page/page_ceb175bd-c194-4c21-909a-95d09c827046/crop/1vQpTcQkiHpIUHxAYJX_3/N4Ki6aByDFp0MDVQNgyv-.png) ::: :::WorkflowBlockItem Select **API** **Services** as the integration type, then click **Next**. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/pHeV-0x1PZSyUaXyuzD3B_image.png" size="70" isUploading="false" width="1244" height="734" darkWidth="1244" darkHeight="734" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Enter a name for your integration and click **Save**. ::: :::WorkflowBlockItem In the Client Credentials section, click **Edit** and set the **Client authentication **option to **Public key / Private key**. ::: :::WorkflowBlockItem Under **Public** **Keys**, select **Use a URL** to fetch keys dynamically and enter the following URL:`https://api.flare.io/.well-known/jwks.json` ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/Mdcc7UdxmTutO6xRfXCtW_image.png" size="70" isUploading="false" width="990" height="960" darkWidth="990" darkHeight="960" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Select Okta API Scopes to grant permissions. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/dw1M_IK4PQI3IHvZHTf7h_image.png" size="80" isUploading="false" width="1346" height="1122" darkWidth="1346" darkHeight="1122" position="flex-start" showCaption="false"} ::: ::::WorkflowBlockItem Grant one or both of the following [OAuth 2.0 Scopes](https://developer.okta.com/docs/api/oauth2) based on your needs: - **`okta.users.read`** - Required for syncing user identities into Flare and creating Identity Identifiers. - **`okta.users.manage`** - Required for automated and manual mitigation actions, such as revoking sessions and disabling users. :::hint{type="info"} It is recommended to start with `okta.users.read` scope. Add `okta.users.manage` only when you are ready to enable mitigation. ::: :::: :::WorkflowBlockItem Navigate to the **Admin** **roles** tab to assign administrative permissions. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/F8tv3Sf_UQCxyvHGObMsW_image.png" size="70" isUploading="false" width="1392" height="814" darkWidth="1392" darkHeight="814" position="flex-start" showCaption="false"} Follow these guidelines when using a standard admin role: - **Read-only admin role: **Use this to sync only the Identity Identifiers without any remediation actions. - **Group admin role:** Use this role to allow mitigation actions in addition to the Identity sync. For more information, view [Okta's Standard roles and permissions documentation](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm). ::: :::WorkflowBlockItem Click **Edit** **assignments**. Select the Admin role and Resource set you configured earlier, then click **Save** **Changes**. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/W3A8Qva68ikkUt1a_htBV_image.png" size="70" isUploading="false" width="1326" height="630" darkWidth="1326" darkHeight="630" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem **Click Save Changes**. The Service app is now ready to use. ::: ::::: *** # Configure Okta Integration in Flare :::::WorkflowBlock :::WorkflowBlockItem Navigate to the **Settings **menu in the top-right corner, and then click **Integrations**. ::: :::WorkflowBlockItem Find the **Add Okta Integration** box and click **Configure**. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/O-oqgtVB1an2r5fqE4Yen_image.png" size="90" width="1646" height="510" isUploading="false" darkWidth="1646" darkHeight="510" position="flex-start" showCaption="false"} ::: ::::WorkflowBlockItem Enter the following information: 1. **Integration Name**: A descriptive name for the integration 2. **Okta Domain**: URL of your Okta domain 3. **Okta Service App Client ID**: Client ID of the Service App configured in *[Prerequisites for Okta](docId\:gVu3V0Xvtlo_eJ0KYlEBB).* 4. **Maximum Daily Password Attempts**: Maximum number of validation attempts per identity per day. It is recommended to set this to half of your lockout policy threshold in Okta. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/qAQ957r-ohsvROrgPkqEj_image.png" size="90" isUploading="false" width="1664" height="1402" darkWidth="1664" darkHeight="1402" showCaption="false"} :::hint{type="warning"} **Daily limit of password validation attempts** To prevent account lockouts, Flare enforces **Maximum Validation Attempts per Identity** per day. The default value for this in Flare is 2, and we do not recommend going higher than half your Okta lockout policy threshold (if the value is set to 10 in Okta, do not go higher than 5). ::: :::: ::::WorkflowBlockItem To automatically sync Identity Profiles, toggle the **Automatically create Identity Identifiers for my synced identities** option, and select automated or manual mitigation actions. - **Automated Validation:** This requires the `okta.users.read` scope, and Okta Admin role with "View users and their details" permissions. - **Automatically Revoke sessions and disable accounts: **This requires the `okta.users.manage` scope, and Okta Admin role with "Suspend users" and "Clear user sessions" permissions. - **Manual Mitigation**: This requires the `okta.users.manage` scope, and Okta Admin role with "Suspend users" and "Clear user sessions" permissions. *See [Prerequisites for Okta](docId\:gVu3V0Xvtlo_eJ0KYlEBB) for more information * ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/yTuZxW0xB3tIApx9PYRot_image.png" size="90" isUploading="false" width="1510" height="1252" darkWidth="1510" darkHeight="1252" showCaption="false"} :::hint{type="info"} If you can't access this setting, reach out to your CSM to enable it. ::: :::: :::WorkflowBlockItem Use the **Test Integration** button to test the integrations. ::: :::WorkflowBlockItem Click **Add Integration **to complete the integration procedure. ::: ::::: *** ## Tenant Requirement :::hint{type="warning"} Flare currently supports only one IdP integration per Tenant. If you already have an Entra ID integration in a Tenant, create a new Flare Tenant dedicated to the Okta integration. ::: ### Recommended Rollout Approach 1. Create a new Flare Tenant. 2. Configure the Okta integration scoped to a small pilot group. 3. Validate identity sync, credential validation, and mitigation behavior. 4. Expand scope incrementally to your full user population. Starting with a small technically capable group limits the blast radius if anything unexpected occurs during testing, such as an account lockout. *** # Troubleshooting :::ExpandableHeading **Identities are not populating after setup** - Verify the service app has `okta.users.read` and that the client ID and Okta domain are entered correctly in Flare. - Verify the required [Admin roles and permissions](docId\:gVu3V0Xvtlo_eJ0KYlEBB) have been granted. - If you scoped to a Resource set, confirm the service app role is correctly bound to it. It can take up to 24 hours for identities to be created. ::: :::ExpandableHeading **Identifier limit reached** Contact your Flare CSM to increase the cap before syncing your full user population. ::: :::ExpandableHeading **Credential validation is triggering account lockouts** Reduce the daily attempt limit in the password validation settings. Review your Okta lockout threshold and ensure your per-identity daily limit stays comfortably below it. ::: :::ExpandableHeading{isOpen="true"} **Unable to configure automated Identity Identifier creation** This setting is not enabled by default. Please reach out to your CSM to get access. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/0EBiAzIzdCDTnLaG1mMdN_image.png" size="70" isUploading="false" width="1450" height="328" darkWidth="1450" darkHeight="328" position="flex-start" showCaption="false"} :::