Skip to main content
Connect your Okta org to give Porcia visibility into the applications your team signs in to through Okta, who is assigned to them, and how they are used. You connect Okta from Settings → Integrations → SSO. Okta is not part of the signup onboarding flow.

​
Before you start

  • Your organization uses Okta Workforce Identity on an okta.com, okta-emea.com, or oktapreview.com domain.
  • You are an Okta administrator who can create an API token.
  • Allow about 5 minutes for setup, plus time for the first sync.
Auth0 (Okta Customer Identity) and custom Okta URL domains are not currently supported.

​
Connect Okta

1

Create an API token in Okta

In the Okta Admin Console, go to Security → API → Tokens, choose Create Token, name it (for example, “Porcia”), and copy the value. Okta only shows it once.
2

Open the Okta connection in Porcia

Go to Settings → Integrations → SSO and choose Connect Okta.
3

Enter your domain and token

Enter your Okta domain, such as yourcompany.okta.com (without https://), and paste the API token.
4

Connect

Choose Connect. Porcia checks the credentials and starts the first sync.

​
Access the token needs

An Okta API token acts with the permissions of the administrator who created it. Create it from an account that can read the following: A read-only administrator role is enough for discovery. Administrative actions, such as removing a user’s app assignment when you revoke access, need an administrator role that allows those changes.

​
What Porcia does not do during discovery

  • It does not add, remove, or change users.
  • It does not change application assignments or application settings.
  • It does not need passwords or user credentials.
Any supported administrative action requires the relevant permission and an explicit confirmation in the product.

​
What Porcia can show

Applications

Applications configured in your Okta org.

Assignments

Which people and groups are assigned to each application.

Sign-in activity

Recent sign-ins, so unused access stands out.

Directory context

Users, including deactivated ones, groups, memberships, and admin roles.
After the first sync, Porcia refreshes Okta data automatically twice a day. Use Sync Now on the connection to refresh sooner.

​
Troubleshooting

“Invalid domain”
  • Use your Okta domain without https://, for example company.okta.com.
  • Custom Okta URL domains are not supported. Use your okta.com, okta-emea.com, or oktapreview.com domain.
“Invalid API token”
  • Check that the whole token was copied, with no extra spaces.
  • Check that the token hasn’t been revoked in Security → API → Tokens.
“Insufficient privileges” or missing data
  • The token has the permissions of the administrator who created it. Create it from an account with the read access listed above.
No applications appear yet
  • The first sync can take a while for large orgs. Only active applications are discovered.
Sync stopped working
  • Check the connection status in Settings → Integrations → SSO, and reconnect with a new token if the old one was revoked or its creator was deactivated.
Contact [email protected] with the error message if the issue continues. Never send the API token to support.

​
Disconnect Okta

  1. Go to Settings → Integrations → SSO.
  2. Open the Okta connection and choose Disconnect.
  3. To fully revoke access, revoke the token in the Okta Admin Console under Security → API → Tokens.
Disconnecting stops new synchronization. Historical application data follows your workspace’s data-management process.

​
Next steps

Organization Integrations

Review the provider connection model

Install Browser Extension

Add usage context for tools outside Okta

Review OAuth Grants

Review third-party access discovered from your providers

Review Findings

See security posture issues across your stack