Connecting Okta

What you get

Once Okta is connected, Radius360 receives:

• User and group inventory. Every user, their MFA status, group memberships, and last login.
• MFA coverage. Which users have MFA, which do not, and which applications require it.
• Privileged access. Who has admin roles in Okta itself, and when those roles were last reviewed.
• Application inventory. Every SaaS app connected through Okta, who has access, and via what policy.
• Login events. Authentication logs with source IP, device, and risk signals (for impossible travel, new device, etc.).

Framework controls that are automatically addressed:

• SOC 2 CC6.1 (Logical Access), CC6.2 (Credential Management), CC6.6 (External Access Protection)
• ISO 27001:2022 A.5.16 (Identity management), A.5.17 (Authentication information), A.8.5 (Secure authentication)
• NIST CSF 2.0 PR.AA-01 (Identities), PR.AA-04 (User authentication), PR.AA-05 (Authentication strength)
• HIPAA 164.308(a)(4) (Information Access Management)

Prerequisites

You need:

• An Okta administrator account with permission to approve OAuth applications
• The Okta tenant URL (e.g., your-company.okta.com)
• About 5 minutes

Connecting Okta

1. 1
   Open Integrations from the Radius360 sidebar. Find Okta in the identity category and click Connect.
2. 2
   Enter your Okta tenant URL and click Continue. You will be redirected to Okta to authorize the application.
3. 3
   In Okta, approve the read-only scopes Radius360 requests. You must be signed in as a user with admin rights to approve the OAuth application.
4. 4
   After approval you are redirected back to Radius360. The integration status changes to Syncing. The first sync takes 2 to 5 minutes depending on the size of your Okta directory.
5. 5
   When the status changes to Connected, open the Evidence Vault and filter to Source equals Okta. You will see the evidence artifacts that have been collected.

After the first sync

Once Okta is connected and synced, three things happen automatically:

• Evidence in the vault. User inventory, MFA configuration, privileged access list, and application access matrix are stored and tagged.
• Risks in the register. Users without MFA, stale admin accounts (90+ days no login), legacy auth usage, and impossible travel detections become scored risks. Each has a source reference pointing back to the Okta data that generated it.
• Control mappings updated. Every activated framework that includes access control requirements has those controls updated based on the Okta evidence.

Subsequent syncs run hourly. Changes in Okta show up in Radius360 within the hour. Severe events (admin created outside normal hours, impossible travel on a C-suite account) trigger near-realtime updates.

Troubleshooting

OAuth approval fails. You are not signed in as an Okta admin. Ask your Okta administrator to approve, or sign in with admin credentials.

First sync hangs at 0 percent. Radius360 is waiting for the first batch. For tenants with 1,000+ users this can take up to 10 minutes. Give it time before reconnecting.

Evidence is missing for a specific user. Check that the user is active in Okta and has signed in at least once. Deactivated users are included but with a deactivated flag.

Impossible travel alerts are noisy. The sensitivity is tunable from Settings, Integrations, Okta. Default is conservative; for organizations with travelling executives, reduce to high-confidence only.

Still stuck? Ask the GRC Assistant "why did the Okta sync fail?" or email support@radius360.co.