Okta SSO
Connect Okta SSO to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Okta SSO to collect identity & sso evidence automatically.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In Okta SSO:
- Sign in to the Okta Admin Console as a Read-Only Administrator (ideally a dedicated service account with only that role); the token inherits that admin's privileges.
- Go to Security › API and select the Tokens tab.
- Click Create token and enter a name in What do you want your token to be named?.
- Under API calls made with this token must originate from, choose Any IP or restrict it to a network zone that includes Safeguard's egress addresses.
- Click Create token and copy the value with the copy-to-clipboard icon. This is the only time you can view it.
Where to find the other values:
- Base URL (optional): Your Okta org address, https://<your-org>.okta.com (or your custom domain); it is the Admin Console address without -admin (not quoted on the fetched pages).
Okta SSO shows the secret only once, so copy it before you leave the page.
Okta API tokens expire after 30 days without use (fixed); each API call resets the timer. If the creating admin's privileges change, the token's privileges change too. Okta recommends OAuth 2.0 service apps over SSWS tokens for stronger security.
Source: help.okta.com, developer.okta.com, checked 2026-10-07.
-
On Compliance › Connectors, open Okta SSO, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Okta SSO and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3, CC6.6, CC7.2 | 14 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.5, A.8.15, A.8.16 | 14 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(a)(1), 164.312(b), 164.312(d) | 14 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.2, 8.6.3, 10.5.1, 11.5.1 | 14 |
| NIST CSF 2.0 | Automated tests | DE.CM-03, PR.AA-01, PR.AA-03, PR.AA-05, PR.PS-04 | 14 |
These tests are switched on per workspace by the Safeguard team.
Okta connect to the same provider as Okta SSO, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks