Posture setup

Okta posture findings

How ITDR scans Okta for admin role inventory, MFA coverage, password policy, lockout policy, sign-on MFA enforcement, and stale super-admins. Cadence, scopes, and what each finding means.

Updated May 19, 2026 | 7 min

Open /postureOkta API token KB

Overview

  • ITDR runs a foundational Okta posture scan every six hours when an Okta connector is active. No separate posture credentials are needed — the scan reuses the same connector credentials used for ingestion.
  • Findings land in the same /posture overview and /posture/workspace surfaces as Microsoft 365 posture findings, tagged provider="okta". The A-F grade, top-5 remediation priorities, and severity mix charts include both.
  • The scan is read-only. It never modifies the Okta org — only reads policies, role assignments, and per-user factor enrollments.

Foundational checks (seven)

OKTA_ADMIN_INVENTORYinfo / medium

Counts admin role assignments by type (super, org, app, help desk). Flags as medium when super-admin count exceeds 5.

Fix: Review the admin list quarterly. Keep super-admin count at or below 5 and prefer scoped roles (App Admin, Help Desk Admin).

OKTA_ADMIN_MFAcritical

Fires once per admin who has no active MFA factor enrolled. A single-credential compromise of these accounts is full org takeover.

Fix: Enroll Okta Verify Push or FIDO2 for every admin. The /posture/workspace finding shows the specific admin profile.

OKTA_MFA_COVERAGEhigh (or critical if <50%)

Computes the percent of active users with at least one active MFA factor. Fires as high when coverage <90%, critical when <50%.

Fix: Enable an MFA enrollment policy that auto-prompts unenrolled users at next sign-in. The finding lists up to 25 sample unenrolled users for triage.

OKTA_PASSWORD_POLICYhigh / medium

Per active password policy, flags if minimum length <12, no required digit, no required symbol, or history retention <4.

Fix: Raise minimum length to 12+, require one digit and one symbol, retain 4+ historical passwords. Edit in Security > Authenticators > Password.

OKTA_LOCKOUT_POLICYmedium

Flags lockout disabled (maxAttempts=0) or set above 10 (permits slow-burn password spray).

Fix: Configure lockout to trigger at 10 or fewer failed attempts within 30 minutes.

OKTA_SIGNON_MFA_REQUIREDcritical

Verifies at least one active sign-on policy requires MFA. Without one, password-only sign-ins are permitted globally.

Fix: Create an Okta sign-on policy that requires MFA for all users on every sign-in (or every untrusted-network sign-in at minimum).

OKTA_STALE_SUPERADMINShigh

Super-admins whose last_login is 90+ days old. Stale privileged accounts are high-value targets.

Fix: Either reactivate their workflow or remove the Super Admin role assignment.

Operational notes

  • Cadence: every 6 hours. Configurable later via OKTA_POSTURE_SCAN_INTERVAL_SECONDS if customer demand exists.
  • Scope: same Okta connector credentials. Add okta.policies.read and okta.factors.read to your token/OAuth grant/JWT scopes if you set up the connector before posture shipped.
  • Resolution model: at each scan, anything previously open but not in the new payload is auto-resolved (closed). Re-introduced misconfigurations re-open as new findings with fresh first_seen_at.
  • Partial failures: if one check fails (e.g., 404 on a policy endpoint that is not enabled on this org), the others still run and the scan completes as PARTIAL rather than FAILED.

Interpreting Okta findings on /posture

  • Open the /posture overview to see the A-F grade — Okta findings weight equally with Microsoft findings (severity x days-open).
  • Open /posture/workspace and filter by provider=okta to see only Okta findings. Each row links to the resource (user profile or policy id) in raw_data.
  • Findings that have been triaged as "accepted risk" via the workspace UI suppress future re-opens until the acceptance expires.