Connect Okta to Microsoft Defender for Identity (Preview)

This page explains how to connect Microsoft Defender for Identity to your Okta account. Connecting Microsoft Defender for Identity to your Okta account provides visibility into Okta activity and enables shared data collection across Microsoft security products. The connector allows Defender for Identity to collect Okta system logs once and share them with other supported Microsoft security products, such as Microsoft Sentinel. Collecting Okta system logs once and sharing them across supported Microsoft security products reduces API usage, avoids duplicate data collection, and simplifies connector management. Before you begin, make sure your Okta and Defender for Identity environments meet the following prerequisites, including required licenses, roles, and access configurations.

Note

If your Okta environment is already integrated with Protect Okta with Microsoft Defender for Cloud Apps, connecting it to Microsoft Defender for Identity can cause duplicate Okta data, such as user activity, to appear in the Defender portal.

Prerequisites

Before connecting your Okta account to Microsoft Defender for Identity, make sure the following prerequisites are met:

Okta licenses

Your Okta environment must have one of the following licenses:

Developer
Enterprise

Okta roles

The Super Admin role is required only to create the API token. After you create the token, remove the Super Admin role and assign the Read-Only Administrator and Defender for Identity custom roles for ongoing API access.

Microsoft Entra and Defender XDR role-based access options

To configure the Okta connector in Microsoft Defender for Identity, your account must have either of the following access configurations assigned:

Microsoft Entra roles:
- Security Operator
- Security Admin
Defender unified RBAC permission:
- Core security settings (manage)

Connect Okta to Microsoft Defender for Identity

The following procedure explains how to connect Microsoft Defender for Identity to your dedicated Okta account using the connector APIs. Connecting Microsoft Defender for Identity to your dedicated Okta account gives you visibility into and control over Okta use.

Create a dedicated Okta account

Perform the following steps to create a dedicated Okta account for the connector.

Create a dedicated Okta account for Microsoft Defender for Identity use only.
Assign your Okta account as a Super Admin role.
Verify your Okta account.
Store the account credentials for later use.
Sign in to your dedicated Okta account created in step 1 to create an API token.

Create an API token

Perform the following steps to create an API token in Okta.

In the Okta console, select Admin.
Select Security > API.
Select Tokens
Select Create Token.
In the Create token pop-up:
1. Enter a name for your Defender for Identity token.
2. Select Any IP.
3. Select Create token.
In the Token created successfully pop-up, copy the Token value and store it securely. The copied Okta API token is used to connect Okta to Defender for Identity.

Add Custom user attributes

Add the required custom user attributes in Okta by completing the following steps.

Select Directory > Profile Editor.
Select User (default).
Select Add Attributes.
1. Set Data type to String.
2. Enter the Display name.
3. Enter the Variable name.
4. Set User permission to Read Only.
Enter the following attributes:

Display Name Variable Name

ObjectSid ObjectSid

ObjectGuid ObjectGuid

DistinguishedName DistinguishedName
Select Save.
Verify that the three custom attributes you added are displayed correctly.

Display Name	Variable Name
ObjectSid	ObjectSid
ObjectGuid	ObjectGuid
DistinguishedName	DistinguishedName

Create a custom Okta role

Create a custom Okta role named Microsoft Defender for Identity to provide the permissions required for ongoing API access.

Note

To support ongoing API access, you must assign both the Read-Only Administrator role and the custom Microsoft Defender for Identity role. The Read-Only Administrator role and the custom Microsoft Defender for Identity role are mandatory to successfully configure the Okta connector. Configuration fails if either role is missing.

After you assign the Read-Only Administrator role and the custom Microsoft Defender for Identity role, you can remove the Super Admin role. Removing the Super Admin role after assigning both required roles ensures that only relevant permissions are assigned to your Okta account at all times.

Navigate to Security > Administrator.
Select the Roles tab.
Select Create new role.
Set the role name to Microsoft Defender for Identity.
Select the permissions you want to assign to this role. Include the following permissions:
- Edit user's lifecycle states
- Edit user's authenticator operations
- View roles, resources, and admin assignments
Select Save role.

Screenshot showing a list of Okta permissions that need to be assigned when adding a custom role.

Create a resource set

Create a resource set for the custom Defender for Identity role using the following steps.

Select the Resources tab.
Select Create new resource set.
Name the resource set Microsoft Defender for Identity.
Add the following resources:
- All users
- All Identity and Access Management resources
Select Save selection.

Assign the custom role and resource set

To complete the configuration in Okta, assign the custom role and resource set to the dedicated account.

Assign the following roles to the dedicated Okta account:
- Read-Only Administrator.
- The custom Microsoft Defender for Identity role
Assign the Microsoft Defender for Identity resource set to the dedicated Okta account.
After confirming that both the Read-Only Administrator role and the custom Microsoft Defender for Identity role are assigned, remove the Super Admin role from the account.