Okta
Connect Okta to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Okta to collect identity & sso evidence automatically.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In Okta:
- Sign in to the Okta Admin Console as a Read-Only Administrator (ideally a dedicated service account with only that role); the token inherits that admin's privileges.
- Go to Security › API and select the Tokens tab.
- Click Create token and enter a name in What do you want your token to be named?.
- Under API calls made with this token must originate from, choose Any IP or restrict it to a network zone that includes Safeguard's egress addresses.
- Click Create token and copy the value with the copy-to-clipboard icon. This is the only time you can view it.
Where to find the other values:
- Okta org URL: Your Okta org address, https://<your-org>.okta.com (or your custom domain); it is the Admin Console address without -admin (not quoted on the fetched pages).
Okta shows the secret only once, so copy it before you leave the page.
Okta API tokens expire after 30 days without use (fixed); each API call resets the timer. If the creating admin's privileges change, the token's privileges change too. Okta recommends OAuth 2.0 service apps over SSWS tokens for stronger security.
Source: help.okta.com, developer.okta.com, checked 2026-10-07.
-
On Compliance › Connectors, open Okta, click Connect, choose API token and fill in:
Field What to enter Okta org URL Required. API token Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Okta and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3, CC6.6, CC7.2 | 14 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.5, A.8.15, A.8.16 | 14 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(a)(1), 164.312(b), 164.312(d) | 14 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.2, 8.6.3, 10.5.1, 11.5.1 | 14 |
| NIST CSF 2.0 | Automated tests | DE.CM-03, PR.AA-01, PR.AA-03, PR.AA-05, PR.PS-04 | 14 |
These tests are switched on per workspace by the Safeguard team.
Okta SSO connect to the same provider as Okta, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks