About

The Okta integration syncs your client's users from Okta into ControlMap and checks whether they have multi-factor authentication (MFA). That gives you evidence for access-control and MFA requirements without exporting user lists by hand.

Each scan brings in:

• User accounts.
• Each user's Okta roles.
• Whether the user has active MFA factors.
• Whether an active Okta MFA policy applies to the user.

It runs these compliance checks:

• Fetching users from okta
• All user accounts in Okta have MFA enabled

Okta is in the Identity Providers category. You connect it with a domain name and an API token. There is no sign-in to Okta from ControlMap.

Before you start

Have these ready from your client's Okta account:

• Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
• The Okta domain name, for example acme.okta.com.
• An API token from the Okta account.

Connect Okta

1. Go to Monitor › Integrations and select Add Integration.
2. Search for Okta and select the Okta card.

3. On the Connection step, enter the Connection Name. It starts filled in as "Okta connection", and you can change it.
4. Enter the Domain Name: your company's Okta domain name, for example acme.okta.com.
5. Enter the API Token from your Okta account. The characters are hidden as you type.
6. Optional: tick Setup emails discovered as employees in ControlMap. Any new email address ControlMap finds is then added as an employee. When this is ticked, you can also tick Invite employees to Compliance Portal, so that any new email address found is invited to ControlMap "My Compliance Portal".
7. Select Next: Checks. This saves the connection and moves to the next step.

8. Complete the remaining steps as described in the Connect an integration article. Okta has four steps in total: Connection, Checks, Watchers and Schedule.

What you'll see after connecting

When you finish the setup, the new connection's page opens. Its data starts to appear in the Monitor tabs after the first scan:

• User Accounts: the users synced from Okta. Use the Integration column and filter to tell Okta apart from your other connections.
• Compliance Checks: the result of each Okta check. A check shows No Data until the first scan finishes.

On the Connection tab of the connection's page, a status line shows whether ControlMap can reach Okta: "Checking connection...", "Successfully connected." or "Not connected. Please verify the connection details below."

Disconnect or change settings

Go to Monitor › Integrations and select the connection's card. Its page has these tabs: Connection, Schedule, Watchers, Logs and Help. To change the connection details, use Update Connection on the Connection tab. The Schedule and Watchers tabs work as described in the Connect an integration article.

To sync straight away, select Run Once. While a scan runs, Force stop appears.

To delete the connection, select the bin icon on its card and choose Yes. This also deletes its assets and their compliance status.