Skip to content
Help Center
withpersona.comDashboard

Using Persona Workflows to manage Okta users & profiles

View MarkdownContact supportContact support10 min read
On this page

Overview

Okta is a leading identity and access management (IAM) platform used to secure workforce access to applications. Persona’s Okta marketplace integration connects to your Okta tenant so you can look up rich user profile data and take direct account actions from within Persona Workflows.

This integration helps Compliance, IT, and People Ops teams move faster by syncing key attributes (including custom profile fields) and automating account lifecycle actions like resetting MFA factors or suspending/unsuspending users without switching tools.

Benefits

Unified Employee Context: Surface Okta profile attributes (including custom fields like legal name or date of birth) in Persona to reduce manual lookups and mismatches.

Reduced Manual Work: Replace repetitive admin tasks with reusable workflows that run consistently and at scale.

Fewer Verification Hurdles: Automatically use the correct identity information (e.g., legal name vs. preferred name) from Okta to increase verification success and reduce manual fixes..

Integration Features

Persona’s Okta integration supports real-time data retrieval and direct account actions to power secure, two-way workflows between Persona and Okta.

  • Retrieve User Profile: Look up an Okta user and return standard and custom attributes to enrich Persona Workflows and Cases.
  • Update User: Updates a user’s profile or credentials.
  • Expire Password and Generate a Temporary Password: Expires a user’s current password and returns an Okta-generated temporary password for their next sign-in.
  • Reset All MFA Factors: Remove all enrolled authenticators for a user so they must re-enroll at next sign-in—useful after high-risk events.
  • Suspend User: Temporarily disable access for an Okta user while an investigation is ongoing.
  • Unsuspend User: Restore access for a previously suspended user once they are cleared.

Setting up the Okta integration

Prerequisites

To set up the Okta integration, ensure you have:

  • Admin access to your Okta account.
  • Necessary API permissions to access Okta credentials.

You can connect Okta to Persona using an Okta API Service or an Okta API key. See the FAQs for more information on which authentication method to choose.

Option A: Connect via API Service

Follow these steps to set up the Private Key JWT Authentication method.

  1. In Okta Admin, create an API Services app by navigating to Applications and Resources > Applications. Click Create App Integration and select the API Services option.

    • After naming the application and saving, copy the generated Client ID to your clipboard.

  2. In the Persona Dashboard, navigate to Integrations > Marketplace > Okta.

    • Click + Add Credential. Select Okta API Service.
    • Fill in your Okta tenant information and paste in the Client ID from your created API Service.
    • Save. The credential row in the table should now display a JWKS URL column with a copyable value.

  3. Return to the created API Service from Step 1 in Okta Admin. On the General tab:

    • Edit the Client Credentials section and set Client authentication to Public key / Private key.
    • Edit the Public Keys section and select the Use a URL to fetch keys dynamically configuration option.
    • Also in the Public Keys section, paste in the JWKS URL from the Persona dashboard in the Url field.
    • Edit the General Settings section and uncheck the Require Demonstrating Proof of Possession (DPoP) header in token requests checkbox.

  4. Navigate to the Okta API Scopes tab and grant the scopes listed below.

    • IMPORTANT: Persona’s Okta integration can perform high-risk operations, including pulling sensitive information from Okta and affecting end users’ ability to access their accounts. To follow least-privilege principles, enable only the scopes your API service actually requires. Use the table below to identify which scopes correspond to the endpoints you’re using.

      Okta API ScopeAffected Okta API Endpoints
      okta.users.read: Read User’s InfoList all users; Retrieve a user; List all groups for a user
      okta.users.manage: Manage User’s InfoUpdate a user; Activate a user; Deactivate a user; Reactivate a user; Expire a password and generate a temporary password; Reset all factors for a user; Suspend a user; Unlock a user account; Unsuspend a user; Generate a temporary access code for a user
      okta.authenticators.read: Read AuthenticatorsList all authenticators; Retrieve an authenticator

    • Once you determine which scopes are required, ensure Granted is checked for each scope.

  5. Next, assign an admin role and resource set to your service app to define what actions it can perform and which Okta resources it can access. At a minimum, your admin role should have the permission to Retrieve a user and your resource set should include All users (or all users you’re planning to access via Persona). Additional permissions and resources will vary by your use case.

    If you have an existing role and resource set available, you can assign them in the Admin roles tab of your service app and continue to the next step.


    To create a new role and resource set:

    • Navigate to Security > Administrators.

    • Click on the Roles tab and click Create new role.

    • Set Role name to Persona Okta Integration Role or a similar title.

    • Grant permissions based on the endpoints you’re using. Only grant the permissions that your integration use case actually requires. See the table below or Okta’s permissions catalog as a guide.

      Role permissions by Okta API endpoint

      Okta API EndpointRequired Role Permissions
      List all usersUser > View users and their details or Edit users’ profile attributes
      Retrieve a userUser > View users and their details or Edit users’ profile attributes
      Update a userUser > Edit users’ profile attributes
      Activate a userUser > Edit users’ lifecycle states > Activate user
      Deactivate a userUser > Edit users’ lifecycle states > Deactivate users
      Reactivate a userUser > Edit users’ lifecycle states > Activate users
      Expire a password and generate a temporary passwordUser > Set users’ temporary password
      Reset all factors for a userUser > Reset users’ authenticator
      Suspend a userUser > Edit users’ lifecycle states > Suspend users
      Unlock a user accountUser > Edit users’ lifecycle states > Unlock users
      Unsuspend a userUser > Edit users’ lifecycle states > Unsuspend users
      List groups for a userUser > View users and their details; Group > View groups and their details
      List all authenticatorsNone
      Retrieve an authenticatorNone
      Generate a temporary access code for a userUser > Edit users’ authenticator operations > Manage user’s temporary access code

    • Click on the Resources tab and click Create new resource set.

    • Set Name to Persona Okta Integration Resource Set or a similar title.

    • Click + Add resource. Search for Users and select All users.

    • Navigate back to your application at Applications > Applications. Click on the Admin roles tab and click Edit assignments. Select your new Persona Okta Integration Role role and Persona Okta Integration Resource Set resource set. Save your changes.

  6. After connecting, click Test in the Persona dashboard to verify the credential is working.

Option B: Connect via API key

  1. Create an API token in Okta Admin.
    • Navigate to Security > API > Tokens > Create Token.
    • Copy the provided API token.
    • Note: The terms API keys and API tokens are used interchangeably in this context.
  2. Add the API token as a credential in Persona.
    • Navigate to Persona Dashboard > Integrations > Marketplace > Okta > Add Credential > Okta API Key Credential.
    • Enter your Okta subdomain, provide a nickname for the credential, and paste the token.
  3. After connecting, click Test to verify the credential is working.

Persona does not support OAuth 2.0 for our Okta integration. Okta OAuth 2.0 credentials have a maximum, non-extendable lifetime of 90 days, making them inappropriate for long-lived integrations. This authorization scheme is not intended for machine-to-machine communication, and results in integration errors.

Using the Okta integration in a workflow

  1. Create a new workflow, or open an existing workflow you’d like to update.
  2. Add a new Action step > Integrations.
  3. Select the Okta integration and choose your Okta credential.
  4. Configure the inputs (e.g., user identifier, action to perform) and map outputs to Persona fields as needed.
  5. Save and publish the workflow.

Okta Operations Overview

In addition to syncing field values, Persona can retrieve user profiles, issue temporary passwords, reset MFA factors, and suspend or unsuspend users using Okta’s API. These actions support seamless two-way workflows, letting teams manage investigations without switching platforms. See below for a comprehensive list of available Workflow Action steps and possible configurations for the Okta integration:

Retrieve a user

Fetches an Okta user’s profile to populate Workflow variables in Persona.

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to retrieve.
  • Provide values for optional fields:
    • Fields to include: limits the result to the listed properties, for example status,profile:(login,email). Separate multiple properties with commas, and profile attributes use the format profile:(firstName,lastName). Custom profile attributes can be selected the same way. The user’s id is always included. The selection is sent to Okta, so unselected fields never leave Okta, and Persona applies the same selection to the response, so unselected fields are not returned or stored in the Workflow integration log. When left blank, the result includes every field.

Update a user

Updates an Okta user’s profile or credentials.This can be used to reset the user’s password.

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to reset.
    • Request body including attributes to update. Refer to Okta’s documentation for information about the request body schema.

Activate a user

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to activate.

Deactivate a user

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to deactivate.

Reactivate a user

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to reactivate.

Reset all factors for a user

Removes all enrolled MFA authenticators for the specified user, requiring them to re-enroll on next sign-in. This is commonly used when a high-risk event occurs or when devices are suspected to be compromised.

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to reset.

Suspend a user

Temporarily disables a user’s access while an investigation is underway. Once suspended, the user cannot access apps protected by Okta until they are unsuspended.

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to suspend.

Unlock a user account

Unlocks a user who is locked out or unlocks an active user that’s blocked from unknown devices. Unlocked users have an ACTIVE status and can sign in with their current password.

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to unlock.

Unsuspend a user

Restores access for a user who was previously suspended. Provide the user identifier to return the user to an active state and re-enable access according to your Okta policies. This action is typically used after an investigation concludes or when false positives are resolved, ensuring minimal disruption to legitimate users.

Configuration Steps:

  • Provide values for required fields:
    • ID of the user to unsuspend.

List groups for a user

Lists all groups of which the user is a member.

Configuration Steps:

  • Provide values for required fields:
    • ID of the user.

FAQs

When should I use an API service vs. an API key?

An API service is a service account intended for service-to-service communications. API service credentials are exchanged via Private Key JWT authentication, providing greater security over API keys. Capabilities are configured on the service itself, and are not tied to a specific Okta user.

An API key is a unique, secret code used by applications to access an API. An API key is like a master key you generate in Okta and give to Persona. The capabilities of an API key are tied to those of the issuing Okta user, and will stop working if the issuing user is deactivated.

Persona recommends using API services for our Okta integration and only recommends using API keys for testing purposes. Okta API services provide durable credentials whose capabilities are not tied to a specific user account, resulting in a more robust, secure, and manageable integration. On the other hand, API keys have a weaker security profile: whoever holds the key can make requests to Okta on your behalf, usually with broad permissions.

What happens when I reset all factors?

All MFA enrollments for the user are cleared. The user will be prompted to re-enroll factors on next sign-in in accordance with your Okta policies.

Plans Explained

Okta Integration by plan

Startup ProgramEssential PlanGrowth PlanEnterprise Plan
Okta IntegrationNot AvailableNot AvailableLimitedAvailable

Learn more about pricing and plans.

Last updated on .

Was this page helpful?If something is missing, let us know and we will take a look.
Thanks for the feedback. It helps us improve these docs.

Related articles

Configure Persona for the Okta Account Management Policy
Marketplace and 3rd-Party Integrations · Authentication