Okta with YeshID

Last updated: July 2, 2026

Okta can play two very different roles in YeshID, and the one you pick changes what YeshID can do for you:

  • Okta as a directory — Okta is an identity source. YeshID treats it like Google Workspace or Microsoft: it imports your people and groups from Okta and can manage their Okta accounts (create, activate, deactivate, suspend, group membership) as part of onboarding and offboarding.

  • Okta as an application — Okta is one of the tools in your app inventory, sitting alongside Slack, Notion, AWS, and everything else in Access > Applications. This is about tracking and requesting access to Okta itself, not about using Okta as your identity backbone.

Most teams that want YeshID to manage Okta want the directory path. Adding Okta as an application is for inventory and access-tracking, and comes with real limitations (see below).

This guide explains the difference, what each can and can't do, and how to set them up.

Directory vs. application: which do I want?

A quick way to think about it:

Question

Use Okta as a…

"Okta is where our people and groups live — YeshID should read from it and drive lifecycle actions."

Directory

"We want to add another identity source alongside Google/Microsoft."

Directory

"We just want Okta to show up in our app inventory so people can request access to it."

Application

"We want to track who owns Okta and who has access, without automated provisioning."

Application

The two are not mutually exclusive, but they solve different problems. The table below is the heart of this guide.

Capabilities and limitations at a glance

Capability

Okta as a directory

Okta as an application

Role in YeshID

Identity source (like Google / Microsoft)

Managed tool in your app inventory

Import people (identities)

✅ Yes — email, name, recovery email, status, MFA flag, and mapped custom fields (title, department, location, employee number, manager)

❌ Not through the application path

Import groups & membership

✅ Yes

❌ No

Import the apps Okta manages

✅ Yes — Okta's assigned applications and who has access flow into YeshID

❌ No

Create / activate / deactivate / suspend Okta users

✅ Yes — used automatically during onboarding and offboarding

❌ No native provisioning connector

Add / remove users from Okta groups

✅ Yes

❌ No

Assign / unassign users to Okta-managed apps

✅ Yes (provisioned with Okta)

❌ No

Access requests & ownership tracking

✅ (as your directory)

✅ Owners (Technical Owners), access requests, account records

Automated user lifecycle

✅ Full read-write

⚠ Manual / tracked only

MFA

⚠ Read-only (YeshID reads the MFA-enabled flag; it does not manage MFA)

—

Plan requirement

Paid plan + Support enablement (see below)

Available on any plan (adding an app is standard)

The short version: if you want YeshID to do things in Okta — provision accounts, run the deactivate-Okta step during offboarding, keep groups in sync — connect Okta as a directory. Adding Okta as an application gives you inventory, ownership, and access-request tracking, but does not give you automated Okta account management.

Okta as a directory

This is the full integration. Once connected, Okta behaves like any other YeshID directory.

Plan requirement: Adding Okta as a directory requires a paid subscription and must be enabled by YeshID Support. If you see Upgrade next to Okta in the Add Directory dialog, contact support@yeshid.com to turn on the Okta directory integration.

What it gives you

When Okta is connected as a directory, YeshID:

  • Imports your people — email (login), first and last name, recovery email, account status (active, suspended, deprovisioned, staged), and the MFA-enabled flag. You can map additional Okta fields into YeshID, including title, department, city, state, ZIP, country, employee number, and manager.

  • Imports your groups and their membership.

  • Imports the applications Okta manages and who is assigned to them, so those apps and their access show up in YeshID.

  • Manages Okta accounts as part of workflows — create users, activate, deactivate, suspend, and unsuspend. The Deactivate Okta step runs automatically during offboarding.

  • Manages group membership — adds and removes users from Okta groups.

  • Assigns and unassigns users to Okta-managed applications — access to those apps is provisioned with Okta.

Limitations

  • MFA is read-only. YeshID reads whether MFA is enabled for a user, but does not enroll, reset, or manage MFA factors.

  • Supported directory types are Google Workspace, Microsoft, and Okta. Okta is added as an additional directory alongside your primary one.

  • Requires Support enablement (see the plan note above).

Setup steps

You'll need your Okta domain and an Okta API token before you start.

  1. Navigate to your Directories page.

  2. Click Add Directory.

  3. If you see Upgrade next to Okta, the integration isn't enabled for your org yet — contact support@yeshid.com.

  4. Enter your Okta details:

    • Okta domain — the address from your Okta admin console, for example https://your-org.okta.com.

    • API Token — create one in Okta under Security > API > Tokens (https://your-org.okta.com/admin/access/api/tokens).

  5. Click Add directory.

  6. Once added, Okta appears as a second directory. YeshID begins importing users, groups, and the applications Okta manages.

To update credentials later (for example, after rotating your Okta API token), open the Okta directory and choose Reconnect.

For the general multi-directory flow and screenshots, see Adding an Additional Directory.

Okta as an application

Adding Okta as an application puts it in your Access > Applications inventory, next to your other tools. This is useful for visibility and governance — assigning Technical Owners, recording who has access, and letting people submit access requests for Okta — but it is not how you get YeshID to manage Okta accounts.

What it gives you

  • Inventory — Okta appears as a managed application in YeshID.

  • Ownership — assign Technical Owners who are notified on onboarding, offboarding, and access requests involving Okta.

  • Account records & access requests — track who has Okta access and route requests through YeshID.

Limitations

  • No dedicated automated provisioning connector. Unlike apps with a built-in SCIM or API integration, there is no native "connect Okta as an application" provisioner. Adding Okta this way does not let YeshID create, deactivate, or sync Okta accounts through the application.

  • For automated Okta user management, use the directory path instead. The directory integration is what runs the create/deactivate/suspend actions and keeps groups in sync.

Setup steps

  1. Log into YeshID and go to Access > Applications.

  2. Click Add application.

  3. Type Okta and select it from the list (or type the name and press enter to add it as a custom entry).

  4. Pick your Technical Owners — the people notified when there's an onboarding, offboarding, or access request for Okta.

  5. Click Add.

  6. Review Okta in your applications list. You can now track ownership and access requests.

For the full application-adding flow, including bulk import, see How-To Add Applications to YeshID.

How the two work together

If Okta is connected as your directory, the applications Okta manages are already imported into YeshID, and YeshID can grant or revoke access to those apps through Okta. In that case you usually don't need to add Okta separately as an application — the value is already flowing in through the directory connection.

Add Okta as an application only when you specifically want an Okta tile for ownership and access-request tracking, and you understand it won't provision Okta accounts on its own.

FAQ

I want YeshID to create and deactivate Okta accounts. Directory or application?

Directory. The directory integration is the only path that manages Okta user lifecycle — creating, activating, deactivating, and suspending users, and running the Deactivate Okta step during offboarding.

Can I add Okta as an application if it's already my directory?

You can, but you usually don't need to. When Okta is your directory, the apps it manages and their access already appear in YeshID. Add Okta as an application only for a dedicated ownership/access-request tile.

Why doesn't "Okta as an application" provision accounts?

There's no native Okta application provisioner. Automated Okta account management is handled through the directory integration, not the application inventory. Adding Okta as an application is for tracking, not provisioning.

Does YeshID manage MFA in Okta?

No. YeshID reads whether a user has MFA enabled, but it does not enroll, reset, or manage MFA factors.

Okta is greyed out or shows "Upgrade" in Add Directory. What now?

The Okta directory integration needs to be enabled for your organization. Contact support@yeshid.com and confirm your plan supports it.