Enable attack disruption actions in Okta with Microsoft Sentinel (preview)

Microsoft Defender XDR's automatic attack disruption capabilities can help protect your Okta-managed identities by automatically responding to threats. When an identity managed by Okta is compromised, Defender XDR can take remediation actions directly in Okta to contain the attack, limit lateral movement, and reduce overall impact.

This article describes how to set up the Okta integration in Microsoft Defender for Identity to enable attack disruption actions in your Okta environment. Before you begin, review the prerequisites to ensure your Okta and Microsoft environments are properly configured.

Prerequisites

Make sure you meet these requirements:

Okta requirements

You need an Okta account with admin access. You also need a developer or enterprise license.

Microsoft requirements

Complete these steps before you continue:

• Connect your Microsoft Sentinel analytic workspace to the unified security operations portal.
• Deploy and enable the Okta connector for Microsoft Sentinel.

Step 1: Create the Okta integration

To create the integration from an Okta account with admin privileges, follow these steps:

1. Find your Okta domain

2. Create an Okta API key

   • Provide a friendly name for your token
   • Make sure to keep the generated token value to be used later when creating the integration profile in the Defender portal.

Step 2: Create the integration from the Defender portal

To create the integration in the Defender portal, follow these steps:

1. Log in to the Defender portal

2. Navigate Microsoft Sentinel -> Configuration -> Automation.

3. In the Integrations profiles tab, select +Create to create a new integration.

   

4. Fill in the following values, then select Create:

   1. Integration name

   2. Description

   3. Base API URL: Enter your full Okta domain starting with https://

   4. Authentication method: Select API Key

      1. API key name
      2. API key: Enter SSWS <API-Key>, replacing <API-Key> with the value of the API token you generated in Okta. There should be a space between SSWS and your API Key. For more information, see the Okta documentation for API Key usage
      3. API key identifier: Leave empty
      4. Enable the Send SPI key in header switch.

   

Related content

• Automatic attack disruption in Microsoft Defender
• Configure automatic attack disruption
• Enable attack disruption actions on AWS with Microsoft Sentinel
• How Microsoft Defender for Identity protects your Okta accounts
• Connect Okta to Microsoft Defender for Identity