Identity Cloud Pricing

Okta Integration Network

Okta ThreatInsight

Desktop and mobile SSO (cloud & on-prem apps)

Security Question

Email as a factor

3rd party MFA integration

Group and app access policies

RADIUS authentication

PIV card authentication

IdP discovery

Custom org URLs (e.g. company.com/login)

Okta sign-in widget

Local language support

Unlimited integrations to AD & LDAP

SIEM integration

Location context

Device context

Network context

Risk-based Authentication

Security questions

Okta Verify OTP

Okta Verify Push

Email as a factor

SMS

Voice

U2F

Third-party factors

Supported factors include Google Authenticator, Duo, Symantec VIP, RSA token, and Yubikey

Windows Hello

Apple TouchID

New city, state, or country

New geo-location

Impossible travel patterns

New device

Managed device

Login is from a device that is pre-registered and managed through solutions such as VMWare AirWatch, MobileIron, Intune, or JAMF

New IP

Specified IP zones

Network anonymizers

Login originates from proxy or Tor connections

Okta ThreatInsight

Cloud directory

Unlimited directory integrations (AD/LDAP & apps)

Unlimited custom user attributes and fields

Custom mapping and transformation

Cloud-based LDAP authentication

Auto provisioning / deprovisioning for OIN apps

Directory integration with AD or LDAP

Complete AD synchronization for Office 365

App access and provisioning tied to lifecycle states

Create and deactivate accounts in applications

Manage entitlements

Group discovery, matching, push, and updates

Automations

Policy for automatically suspending, deactivating and deleting users based on date based conditions and triggers.

Access request workflows

Access audit reports

Recent unassignments report

APIs for full customization

Customizable directory for users groups and devices

Manage lifecycle states

Attribute mapping and transformation

Built-in standards-based provisioning (SCIM)

On-prem provisioning SDK

HR-driven IT provisioning (e.g. Workday and UltiPro)

Mastering from select OIN apps (e.g. Salesforce and GSuite)

Mastering from on-premises apps via on-premises provisioning agent

Mastering from CSV Directory

Application and directory integrations

OAuth 2.0 and OIDC compliant

Dynamic client registration

Central access and authorization management

User consent

Customizable scopes and claims

Customizable authorization servers

Supports mixed environments: AWS, Azure, GCP, and on-premises

End-to-end lifecycle management of local Linux and Windows machine accounts

Seamless SSO and MFA authentication built into your SSH and RDP workflows

Backed by a Programmable CA that mints just-in-time, single-use client certificates

Client Application for local SSH and RDP integrations, and dynamic device binding

API allows for custom authentication and management workflows

Number of app integrations

Header-based applications

Kerberos/IWA applications

On-premise applications – such as Oracle E-Business Suite, PeopleSoft, and Sharepoint

Custom web apps, pages, and web portals

Number of policies

Application policies

Custom header variables

Authorization policies

Access Gateway servers

Datacenters

Networks and hosts

Inbound SAML support from an external identity provider

Just-in-time provisioning into Universal Directory and group assignments

SAML attribute ingestion into Universal Directory

Active directory or LDAP user authentication

AD / LDAP user synchronization and import

AD or LDAP mastered profiles

AD or LDAP password reset

Unlimited OAuth 2.0 authorization servers

Support for unlimited API resource domains

Unlimited access policies

Support for user-driven flows

Support for non-human driven flows (client credentials grant type)

Okta Verify OTP

Okta Verify Push

Security question (as a second factor)

Email

Voice

SMS

Third-party multi-factor support

Policies based on:

Advanced policies based on:

Access to pre-built app integrations in the OIN

Outbound federation (SAML, OIDC) to OIN applications

Custom SAML assertion attributes to OIN applications

Deprovisioning workflow

AD group-based provisioning and deprovisioning

Attribute-level mastering

Group membership rules

Access request workflow

Provision and deprovision Okta users and groups into AD / LDAP

Provision and deprovision Okta users and groups into OIN, SCIM and on-prem integrations

Number of app integrations

Header-based applications

Kerberos/IWA applications

On-premise applications – such as Oracle E-Business Suite, PeopleSoft, and Sharepoint

Custom web apps, pages, and web portals

Number of policies

Application policies

Custom header variables

Authorization policies

Access Gateway servers

Datacenters

Networks and hosts