Okta Onboarding

Open the Okta Onboarding Form in SailPoint Entro

1. In the SailPoint Entro dashboard, go to Management > Accounts & Integrations > Add New Account (top right) > Okta.

2. Scroll to the bottom of the form and copy the Public Key - you will need it in Step 4.

3. Keep this tab open throughout the process.

   

Sign in to Okta and Access the Admin Console

1. Sign in to your Okta account.

2. Note your Okta domain (for example https://<domainName\>.okta.com) - you will need it later.

3. Go to the Okta Admin Console.

   

Create a New API Service App

1. Go to Applications > Applications > Create App Integration.

   

2. Select API Services, then select Next.

   

3. Enter a name for the app (for example Entro Security Integration) and select Save.

Configure Client Credentials

1. Select the new application you created to get to the General tab.

   

2. Select Edit under Client Credentials.

   

3. Set Client Authentication to Public key / Private key, and select Edit under Public keys.

4. Select Add key when it appears (after Edit).

   

   

5. Switch back to the SailPoint Entro onboarding form and copy the Public Key.

   

6. Paste the key into Okta and select Done, then Save.

7. Copy the Client ID shown on the app's General tab - you will need it in the final step.

   

Adjust App Settings

1. Still on the General tab of the app, select Edit under General Settings.

2. Uncheck "Require Demonstrating Proof of Possession (DPoP) header in token requests".

3. Select Save.

   

Grant Required API Scopes

1. Go to the Okta API Scopes tab.

   

2. Find and grant the following scopes:

   Scope	Purpose
   okta.apps.read	Read application metadata
   okta.appGrants.read	Read API grant permissions per app
   okta.roles.read	List role assignments
   okta.users.read	Access user and profile data
   okta.logs.read	Retrieve Okta audit logs
   okta.apiTokens.read	Access API token metadata

   

Assign Admin Role

1. Go to the Admin Roles tab and select Edit Assignment.

   

2. Select Super Administrator and select Save Changes.

Super Administrator is required for full NHI visibility, including API grant permissions per Okta app. If your organization cannot grant Super Administrator, refer to Okta Custom SailPoint Entro Role for a least-privilege alternative - note that this will result in partial visibility.

Configure Integration in SailPoint Entro

1. Return to the SailPoint Entro onboarding form and fill in the following fields:

   Field	Value
   Environment	A unique identifier for this connection (for example Okta-myorg)
   Display Name	A human-readable name (for example My Account)
   Okta Domain	Your Okta domain (for example https://mydomain.okta.com)
   Client Id	The Client ID copied in Step 4
   Worker Group (Connector)	Select the appropriate SailPoint Entro connector

2. Select Create Account.

   

Verification

Once connected, the integration status displays Verified. Go to NHI Inventory and filter by Okta to review discovered applications, credentials, and user data.