Overview
The Okta integration monitors your organization’s identity management: user accounts, MFA enrollment, password policies, application assignments, group memberships, and authentication logs. LowerPlane uses read-only access to collect compliance evidence automatically.Authentication
Okta supports two authentication methods:- API Token (Recommended)
- OAuth 2.0
The simplest setup. Generate an API token from the Okta Admin Console.Required fields:
- Okta Domain — Your organization’s Okta URL (e.g.,
https://company.okta.com) - API Token — SSWS token from Security > API > Tokens
What LowerPlane Collects
User Accounts
All Okta users with profile data: name, email, department, title, status (active, deprovisioned, suspended), and last login timestamp.
MFA Status
Per-user MFA enrollment status. Checks whether each user has at least one active MFA factor (authenticator app, SMS, hardware key, etc.).
Application Access
Per-user application assignments showing which Okta-integrated apps each user can access. Used for access review campaigns.
Group Memberships
Group membership for each user. Maps to roles and access levels for compliance reporting.
MFA & Password Policies
MFA enrollment policies and password complexity policies configured in your Okta org.
System Logs
Authentication and access events from the Okta System Log (last 7 days by default, configurable). Provides audit trail evidence.
Security Tests
LowerPlane runs 4 automated tests against your Okta organization:| Test | Severity | Applies To | Description |
|---|---|---|---|
| MFA Enabled for All Users | Critical | Each user | Verifies every active user has at least one MFA factor enrolled and active |
| Password Policy Compliance | High | Organization | Checks password policies meet minimum complexity, length, and rotation requirements |
| Inactive User Accounts | Medium | Each user | Identifies accounts that have been inactive for more than 90 days |
| Application Access Review | Medium | Each application | Verifies applications have appropriate access controls and undergo regular review |
Cross-IdP MFA Passthrough
When Okta enforces MFA at the organization level, LowerPlane automatically passes MFA-related tests for downstream services (e.g., if a user authenticates to GitHub via Okta SSO with MFA, the GitHub MFA test passes automatically).Connecting
- API Token Setup
- OAuth Setup
Generate an API Token in Okta
- Log in to the Okta Admin Console
- Go to Security > API > Tokens
- Click Create Token
- Name it
LowerPlane(or any descriptive name) - Copy the token value immediately — it is only shown once
Find Your Okta Domain
Click your account name in the top-right corner of the Okta Admin Console. Your domain is shown as
company.okta.com. Do not use the -admin URL.Connect in LowerPlane
Go to Settings > Integrations, find Okta under Identity Providers, and click Connect. Enter your Okta domain and API token.
Settings
After connecting, configure Okta-specific settings from the integration detail page:| Setting | Default | Description |
|---|---|---|
| Auto Sync | Enabled | Automatically sync users, groups, and policies on a schedule |
| Sync Interval | Every 6 hours | How often LowerPlane re-syncs data from Okta |
| System Log Window | 7 days | How many days of system log history to collect on each sync |
Evidence Artifacts
Each sync generates the following compliance evidence artifacts, automatically mapped to your active frameworks:| Artifact | Description | Frameworks |
|---|---|---|
| Okta Users | Complete user inventory with status and last login | SOC 2, ISO 27001, HIPAA, GDPR |
| User App Assignments | Per-user application access for access certification | SOC 2, ISO 27001, HIPAA |
| Applications Inventory | All Okta-integrated applications | SOC 2, ISO 27001 |
| MFA Policies | MFA enrollment policy configurations | SOC 2, ISO 27001, HIPAA, PCI-DSS |
| Password Policies | Password complexity and rotation policies | SOC 2, ISO 27001, HIPAA, PCI-DSS |
| System Logs | Authentication and access events | SOC 2, ISO 27001, HIPAA |
Compliance Mapping
| Framework | Controls | What Okta Evidence Satisfies |
|---|---|---|
| SOC 2 | CC6.1, CC6.2, CC6.3 | Logical access controls, user provisioning, MFA enforcement |
| ISO 27001 | A.9.2, A.9.4 | User access management, system access control |
| HIPAA | 164.312(d) | Person or entity authentication |
| GDPR | Art. 32 | Security of processing (access controls) |
| NIST CSF | PR.AC-1, PR.AC-7 | Identity management and access control |
Data Access
| Data Type | Access |
|---|---|
| User profiles and status | Read |
| MFA enrollment status | Read |
| Group memberships | Read |
| Application assignments | Read |
| Password and MFA policies | Read |
| System logs (auth events) | Read |
| User passwords or secrets | No access |
| Email contents | No access |
| Application data | No access |
Troubleshooting
Sync fails with 'missing Okta domain/instance'
Sync fails with 'missing Okta domain/instance'
Ensure you entered your Okta domain correctly. It should be in the format
company.okta.com (not company-admin.okta.com). If you copied the URL from the Admin Console address bar, remove the -admin part.Sync fails with 'Okta domain must end with .okta.com'
Sync fails with 'Okta domain must end with .okta.com'
LowerPlane validates that the domain ends with
.okta.com, .okta-emea.com, or .oktapreview.com. Check for typos in your domain. Custom domains are not supported — use the standard Okta-issued domain.API token returns 401 Unauthorized
API token returns 401 Unauthorized
MFA test shows failing but MFA is enforced
MFA test shows failing but MFA is enforced
The MFA test checks per-user factor enrollment, not just org-level policy. Some users may not have completed MFA setup even if the policy is enforced. Check the test entity list to see which specific users are failing.
Sync is slow or times out
Sync is slow or times out
Large organizations (5,000+ users) may take longer to sync due to per-user MFA and app assignment lookups. LowerPlane enforces a 5-minute timeout per sync. If syncs consistently timeout, contact support to optimize the sync configuration.