Integrations

Connecting Okta

Okta is one of the highest-leverage first integrations. It is deep, which means it generates risks automatically, and it lights up identity controls across every major framework.

What you get

Once Okta is connected, Radius360 receives:

User and group inventory. Users, their status, and group memberships.
MFA and sign-on policies. Whether an active policy enforces MFA, and how your sign-on policies are set up.
Password policy. Minimum length and related settings.
Privileged access. Who holds admin roles in Okta itself.
Application inventory. SAML and OIDC apps connected through Okta.
Failed sign-ins. Failed login counts from the Okta system log, to spot spikes.

Framework controls that are automatically addressed:

SOC 2 CC6.1 (Logical Access), CC6.2 (Credential Management), CC6.6 (External Access Protection)
ISO 27001:2022 A.5.16 (Identity management), A.5.17 (Authentication information), A.8.5 (Secure authentication)
NIST CSF 2.0 PR.AA-01 (Identities), PR.AA-04 (User authentication), PR.AA-05 (Authentication strength)
HIPAA 164.308(a)(4) (Information Access Management)

Prerequisites

You need:

An Okta administrator account that can create an API token
The Okta tenant URL (e.g., https://your-company.okta.com)
About 5 minutes

Radius360 only reads

The integration reads user, group, policy, application, and log data. It never creates users, resets passwords, or modifies policies. An Okta API token carries the permissions of the admin who created it, so create it from an account with the least privilege your Okta setup allows.

Connecting Okta

1
In the Okta Admin Console, go to Security, API, Tokens and create a token. Copy it now; Okta shows it only once.
2
In Radius360, open Integrations from the sidebar. Find Okta Deep Identity in the identity category and click Connect.
3
Enter your Okta domain and paste the API token, pick a sync schedule, and click Save & Connect. Radius360 tests the connection before saving.
4
Click Sync on the card to run the first sync now. It takes a few minutes depending on the size of your Okta directory.
5
When the status changes to Connected, open the Evidence Vault and filter to Source equals Okta. You will see the evidence artifacts that have been collected.

After the first sync

Once Okta is connected and synced, three things happen automatically:

Evidence in the vault. User inventory, MFA configuration, privileged access list, and application access matrix are stored and tagged.
Risks in the register. No active MFA enforcement, a weak password policy, more admins than your user count warrants, missing sign-on policies, and spikes in failed logins become scored risks. Each has a source reference pointing back to the Okta data that generated it.
Control mappings updated. Every activated framework that includes access control requirements has those controls updated based on the Okta evidence.

Subsequent syncs run on the schedule you picked (daily by default; every 6 hours is the most frequent). Changes in Okta show up in Radius360 on the next sync.

Troubleshooting

Connection test fails. Check the domain (include https://) and that the token is still active. Okta tokens are revoked when the admin who created them is deactivated, and expire after a period without use.

First sync is slow. For tenants with 1,000+ users this can take up to 10 minutes. Give it time before reconnecting.

Evidence is missing for a specific user. Check that the user is active in Okta and has signed in at least once. Deactivated users are included but with a deactivated flag.

Still stuck? Ask the GRC Assistant "why did the Okta sync fail?" or email support@radius360.co.

PreviousAPI & webhooks Next Connecting AWS