Okta Custom SailPoint Entro Role

If your organization cannot grant Super Administrator to SailPoint Entro's API Service App, you can create a custom least-privilege role instead. Note that this will result in partial visibility - specifically, API grant permissions per Okta app will not be available.

Warning

When using a custom role, you must also assign the Report Administrator built-in role to enable audit log collection.

Create the Custom Role

1. In the Okta Admin Console, go to Security > Administrators > Roles.

2. Select Create New Role.

   

3. Enter the following details:

   • Role Name: Entro Security Role

   • Role Description: Integration app for securing users, apps, permissions, and log collection

4. Select the following permissions:

   Category	Permission
   User	View users' profile attributes
   User	View users and their details
   User	View API tokens
   Group	View groups and their details
   Identity and Access Management	View roles, resources, and admin assignments
   Application	View application and their details
   Application	View client credentials

5. Select Save Role.

   

Create a Resource Set

1. Go to the Resources tab and select Create new resource set.

   

2. Enter the following details:

   • Name: Entro Resource Set

   • Description: Apps, Users, Groups

3. Select + Add resource and add the following:

   Resource	Purpose
   Applications > All applications	Observe all apps and their client secrets
   Identity and Access Management > All IAM resources	Read permissions and resource set info per user and app
   Users > All users	Enumerate all users for ownership attribution and employee/IdP data
   Groups > All groups (optional - future)	Will be required once SailPoint Entro covers group membership

4. Select Create.

   

Assign the Role to SailPoint Entro's App

1. In the Okta Admin Console, go to Applications > Applications and open SailPoint Entro's API Service App.

   

2. Go to the Admin Roles tab and select Edit Assignment.

   

3. Select Entro Security Role and assign the Entro Resource Set.

   

4. Select Save Changes.

Assign Report Administrator

1. Still on the Admin Roles tab, select Edit Assignment again.

2. Add the Report Administrator built-in role.

   

3. Select Save Changes.