Okta MCP integration for AI agents.
Connect AI agents to Okta through 14 structured actions, including get group, add user to group, delete group, and lifecycle user. Review authentication, inp…
- ACTION CONTRACTS
- 14
- AUTHENTICATION
- OAuth 2.0 + Custom credentials
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Okta integration exposes
The Okta Agent App exposes 14 provider-backed actions for security work. Its current contract lets an authorized agent get one okta group by id, assign an okta user to an okta-managed group, and delete an okta-managed group by id. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses OAuth 2.0 and Custom credentials. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Okta account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Okta capabilities.
Showing 12 of 14 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_groupREADGet one Okta group by ID.
INPUTS: groupId
add_user_to_groupWRITEAssign an Okta user to an Okta-managed group.
INPUTS: groupId / userId
delete_groupHIGH IMPACTDelete an Okta-managed group by ID.
INPUTS: groupId
lifecycle_userREVIEWActivate, reactivate, deactivate, suspend, unsuspend, unlock, or expire an Okta user's password.
INPUTS: userId / operation / sendEmail / tempPassword / revokeSessions
create_groupWRITECreate an Okta-managed group.
INPUTS: profile
create_userWRITECreate an Okta user with profile, credentials, group assignments, and activation options.
INPUTS: profile / credentials / groupIds / activate / provider
delete_userHIGH IMPACTDeactivate an active Okta user, or permanently delete a user that is already deactivated.
INPUTS: userId / sendEmail
get_userREADGet one Okta user by ID, login, or login shortname.
INPUTS: userId
list_group_usersREADList the users that are members of an Okta group.
INPUTS: groupId / limit / after
list_groupsREADList Okta groups with search, filtering, sorting, expansion, and cursor pagination.
INPUTS: limit / after / search / filter / q
list_usersREADList Okta users with search, filtering, sorting, field projection, and cursor pagination.
INPUTS: limit / after / search / filter / q
remove_user_from_groupHIGH IMPACTUnassign an Okta user from an Okta-managed group.
INPUTS: groupId / userId
INPUT CONTRACTS
Know what the action needs before it runs.
get_group
groupIdOPTIONAL- The Okta group ID.
add_user_to_group
groupIdOPTIONAL- The Okta group ID.
userIdOPTIONAL- The Okta user ID, login, or login shortname accepted by the Users API.
delete_group
groupIdOPTIONAL- The Okta group ID.
lifecycle_user
userIdREQUIRED- The Okta user ID, login, or login shortname accepted by the Users API.
operationREQUIRED- The lifecycle operation to perform.
sendEmailOPTIONAL- Whether supported activation or deactivation operations should send email.
tempPasswordOPTIONAL- For expire_password, whether Okta should expire the password and return a temporary password.
revokeSessionsOPTIONAL- When returning a temporary password, whether Okta should revoke the user's existing sessions.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Group
Get one Okta group by ID. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_groupControl Add User To Group
Assign an Okta user to an Okta-managed group. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
add_user_to_groupVerify with Get User
Get one Okta user by ID, login, or login shortname. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_userSAFETY BOUNDARY
Operate Okta with explicit limits
- Authorize Okta with OAuth 2.0 and Custom credentials and grant only the provider access required by the selected actions.
- 8 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Treat `delete_group`, `delete_user`, and `remove_user_from_group` as high-impact operations and require an explicit approval boundary.
- The sampled contract declares provider scopes including `okta.groups.manage`, `okta.users.manage`, `okta.groups.read`, and `okta.users.read`; verify the complete action contract before execution.
- After a call, inspect the structured result and execution record before reporting that the Okta task completed successfully.
CONNECTION MODEL
OAuth 2.0 + Custom credentials
Okta uses OAuth 2.0 and Custom credentials. Connection requirements and availability are determined by the provider and the Working Machines deployment.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 5
- WRITE SIGNALS
- 5
- HIGH IMPACT
- 3
- REVIEW SIGNALS
- 1
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Okta.