Skip to main content

​
Overview

Tierity connects to Okta with a read-only API token, syncs every 6 hours, and raises findings such as admins without MFA, leavers who are still active and dormant accounts. See Identity providers for everything that’s synced and checked.

​
Prerequisites

  • An Okta super administrator who can create a Read-Only Administrator token
  • Manage access (or higher) in Tierity

​
Credentials required

​
Setup

1

Create a read-only admin

Okta API tokens act with the permissions of the admin who creates them. In the Okta Admin Console, create (or pick) an admin with the Read-Only Administrator role, so the token can read users, factors, devices, app assignments, admin roles and the System Log, but can’t change anything.
2

Create the token

Signed in as that admin, go to Security → API → Tokens, click Create token, name it Tierity, and copy the value. Okta shows it only once.
3

Connect in Tierity

Go to Config → Integrations → Okta, enter your Okta domain and the token, and click Test connection. The first sync starts straight away.
Okta tokens expire after 30 days without use. Tierity uses the token every 6 hours, which keeps it active.

​
What Okta adds

  • MFA strength for each user, including Okta Verify FastPass and security keys as phishing-resistant factors
  • Devices from Okta’s device registry
  • Assigned applications for each user
  • Admin roles, including custom admin roles
  • Failed sign-ins and security events from the System Log

​
Disconnecting

Go to Config → Integrations → Okta and click Disconnect, then revoke the token in Okta under Security → API → Tokens.