> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Sync users, MFA, admins, devices and sign-in events from Okta to find identity risks.

## Overview

Tierity connects to Okta with a read-only API token, syncs every 6 hours, and raises findings such as admins without MFA, leavers who are still active and dormant accounts. See [Identity providers](https://docs.tierity.com/integrations/identity.md) for everything that's synced and checked.

## Prerequisites

* An Okta super administrator who can create a Read-Only Administrator token
* Manage access (or higher) in Tierity

## Credentials required

| Field | Description |
| - | - |
| **Okta domain** | Your Okta org's domain, for example `your-org.okta.com` |
| **API token** | A token created by a Read-Only Administrator |
| **Employment status attribute** | Optional. The profile attribute your HR sync writes employment status to. Leave blank to detect it automatically. |

## Setup

**1. Create a read-only admin**

Okta API tokens act with the permissions of the admin who creates them. In the Okta Admin Console, create (or pick) an admin with the **Read-Only Administrator** role, so the token can read users, factors, devices, app assignments, admin roles and the System Log, but can't change anything.

**2. Create the token**

Signed in as that admin, go to **Security → API → Tokens**, click **Create token**, name it `Tierity`, and copy the value. Okta shows it only once.

**3. Connect in Tierity**

Go to **Config → Integrations → Okta**, enter your Okta domain and the token, and click **Test connection**. The first sync starts straight away.

> [!TIP]
>
> Okta tokens expire after 30 days without use. Tierity uses the token every 6 hours, which keeps it active.

## What Okta adds

* MFA strength for each user, including Okta Verify FastPass and security keys as phishing-resistant factors
* Devices from Okta's device registry
* Assigned applications for each user
* Admin roles, including custom admin roles
* Failed sign-ins and security events from the System Log

## Disconnecting

Go to **Config → Integrations → Okta** and click **Disconnect**, then revoke the token in Okta under **Security → API → Tokens**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.