Today, Okta announced out-of-the-box support for third-party identity providers (IdPs) in Okta for AI Agents and Agent SSO. Employee and agent identities can live in any Cross App Access (XAA)-enabled IdP, such as Ping, Descope, and Oracle, allowing companies to build on their existing identity stack rather than replace it. Okta helps secure and audit what those agents can access within Okta-protected apps and resources, and employees sign in once instead of approving a consent prompt for each agent connection.
This capability is built on XAA, an open standard first led by Okta, which enables applications and agents to connect securely while the enterprise defines the rules governing agent behavior. As a result, customers are not locked into any single vendor's approach to agent security and can connect their third-party IdP to Okta directly without a custom connector.
"Every company already has an identity stack for humans, and most have more than one. Agent security shouldn't require them to rip it out or wait for one vendor to catch up," said Tunde Oni-Daniel, Deputy Chief Technology Officer, OneMain Financial. "The identity layer for agents has to be neutral and plug into whatever customers already run, today and after their next acquisition. Okta has always been that independent layer, and it’s exciting to see them bring that approach to agents."
"AI isn't going to consolidate on one platform, and neither are the identity providers companies inherit through acquisitions and partnerships," said Harish Peri, SVP and GM of AI, Okta. "Agent security has to work across organizations’ entire environment, today. With third-party IdP support, companies can bring a new team onto shared agents this quarter, not after a multi-year identity consolidation."
What this looks like in an organization
Consider an enterprise that acquires a company whose employees and AI agents are managed in another IdP. The parent company wants those agents working with its Okta-protected apps right away, but merging identity providers could take years. Instead, IT sets up trust between the third-party IdP and Okta, syncs the acquired users into Okta, and registers the acquired company's agents in Okta for AI Agents. When an employee calls an agent, the agent presents its third-party IdP-issued token. Okta verifies it and issues a scoped, short-lived token for only the resource the agent needs. The employee isn't asked to sign in again, and Okta logs both the employee and the agent acting on their behalf.
What this improves for IT and Security teams
IT onboards new teams in days. Connect an XAA-enabled identity provider, such as Ping, Descope, and Oracle, to Okta once with no identity migration.
Security scopes access for each identity provider. Admins choose which Okta-protected resources each agent can reach, and for which employees, so acquired teams and partners get only the access they need.
IT sets it up once, without needing to replace their current IdP. Admins establish trust between the source identity provider and Okta, sync users into Okta, and register the source IdP's agents as clients in Okta for AI Agents.
Reduces consent fatigue. Employees keep their existing sign-in because Okta validates the signed token from each employee's home identity provider before an agent acts – no second login and no second credential to issue or rotate.
Security sees every agent in one place. Agents used by employees across every connected identity provider appear in one directory and one audit trail, with end-to-end governance and a kill switch that stops agents from getting new access to Okta-protected resources.
Availability
Third-party IdP support is generally available today for Okta for AI Agents and Agent SSO customers.
Learn more
For more information, visit the Okta Secures AI page and Okta for AI Agents page
To see which identity providers support XAA, visit Cross App Access on OAuth.net, an independent site that lists third-party XAA implementations.
Any mention in this article of solutions, features, functionalities, certifications, authorizations, or attestations that are not currently generally available or have not yet been obtained may not be delivered or obtained on time or at all. We assume no obligation to deliver on such items and you should not rely on them to make your purchase decisions.
