Okta

The Okta integration turns your Okta groups into Rogue workspaces. You pick the groups to import, Rogue creates a workspace named after each one, and a sync every 15 minutes places each group member in that workspace as a person. Their browsers, coding agents and endpoints follow them there, so each team gets its workspace's rulesets and guardrail modes without anyone enrolling people by hand.

Rogue only reads from Okta and never writes to your Okta org. Manage the integration from the console under Integrations, then Okta IdP. If Okta IdP doesn't appear under Integrations, it isn't enabled for your organization yet; contact support to turn it on. Organization members never see it.

Supported scopes

The Rogue Security app in the Okta Integration Network supports these read-only scopes:

Before you start

• In Rogue: an owner or admin of the organization. See who can do what.
• In Okta: an administrator who can add API service integrations.
• Your Okta domain: the org's own Okta hostname, such as acme.okta.com. Domains ending in .okta.com, .oktapreview.com, .okta-emea.com and .okta-gov.com work. Custom URL domains (such as login.acme.com) don't, so use the org's Okta name even if your users sign in through a custom domain. A pasted https:// and trailing / are removed; ports and paths are rejected.

Connect Okta

When you select Connect, Rogue gets a token from Okta, copies your groups into Rogue, then copies their people and memberships. Nothing is saved until all three succeed. If one fails, the form shows the error message and what to fix.

Rogue stores the client secret encrypted and never shows it again, in the console or the API.

Import groups

After connecting, every group is selected. Each one becomes a workspace with the same name. Untick the groups you don't want, and select a group to see who's in it, with each person's Okta status and their other groups.

• Built-in groups, such as Everyone, are hidden and never imported.
• Groups synced from Active Directory show a From Active Directory badge and import like any other group.
• Workspace exists: when a workspace already has exactly the group's name (same case and accents), Rogue uses that workspace instead of creating a second one. The Default workspace and archived workspaces are never reused.
• People in no imported group stay where they are today.

Groups created in Okta after setup aren't imported automatically. To import them, select Edit groups on the Okta page: Rogue reads every group from Okta again and reopens this step.

People in more than one group

A person goes to exactly one workspace. When someone is in more than one imported group, or in one group and also enrolled by hand, the Resolve conflicts step lists them. Rogue picks a default for each and you change any you disagree with. If nobody overlaps, the step shows No conflicts and is skipped.

• Group order: under Default for people in more than one group, the group higher in the list wins. Only groups that share people are listed. Drag a group, or type its new position. Each row says how many of its people go to a higher group.
• Per-person choice: under People, pick the workspace for anyone the default gets wrong. A pick shows Your choice; select it to go back to the default. Choices last across syncs. If the person leaves the group you picked, the default applies until they rejoin it, and then your choice applies again.
• Manual enrollment wins by default. If you enrolled someone by hand before connecting Okta and Okta also places them, the hand-made enrollment stays (shown as Default: Added by hand wins). Pick one of their Okta groups to let Okta place them instead; the sync then replaces the hand-made enrollment.

Through the management API, a per-person choice can also be any non-archived workspace (workspace:<id>), for example to pull a compromised account into a stricter workspace at once.

Overlaps that appear after setup, such as someone joining a second group, are placed by default and never wait for you. The Okta page then shows N new conflicts since the last save with Review conflicts.

Review and first sync

The Review step shows how many workspaces Rogue will create, how many people it places or moves, and how many go Back to Default. Open a section to see exactly who goes where. Nothing changes until you select Create workspaces & sync (or Save & sync when no workspace is new). Rogue then creates the workspaces, places people, and lists what happened.

Back to Default

A person Okta placed goes Back to Default when they leave every imported group, when their group is no longer imported, or when Okta suspends or deactivates them. Rogue removes their Okta placement, so their devices resolve as they would without it: a device enrolled directly keeps its workspace, otherwise the workspace of the API key it uses, otherwise the Default workspace.

Okta users who are staged, provisioned, in recovery, locked out or have an expired password still count as group members.

Removing a group from the import keeps its workspace, since policies may be attached to it. A group renamed in Okta keeps its workspace's name.

Syncing

Rogue syncs every 15 minutes. Each sync reads your imported groups and their members from Okta and applies the difference: new members are placed, people who changed groups are moved, and leavers go Back to Default. Select Sync now on the Okta page to sync at once. People are matched by their Okta email profile attribute.

If any read from Okta fails, the sync stops before changing anything, and the Okta page shows Sync failed with the error message. The next sync tries again.

Held syncs

A sync that looks unusual waits for you instead of applying. It changes nothing in Rogue and shows a banner with what it would do and Apply anyway. A sync is held when:

• an imported group was deleted in Okta,
• an imported group that had people is now empty in Okta, or
• it would send many people back to Default at once (more than 25, or more than 10% of the people Okta placed, whichever is larger).

Check Okta first. If the change was intended, select Apply anyway: Rogue runs the sync again with only that reason waived. If the setup changed since the hold, Apply anyway is refused so you never approve a situation you didn't see. Syncs keep running while one is held, and once Okta is back to normal the next sync applies and the banner clears.

Everyone else

The Groups tab ends with Everyone, mapped to the Default workspace. Select it to list the Okta people no workspace other than Default holds: members of groups you didn't import, people Okta suspended or deactivated, and people Rogue couldn't place. Rogue reads Everyone's members when you connect and whenever you select Edit groups, so people in no Okta group are listed too. The management API returns the same list from GET /api/v1/connectors/okta/groups/everyone/members.

Not placed

The People tab lists everyone in Rogue's copy of your Okta directory, plus people enrolled by hand, and why anyone isn't placed:

• In no imported group, stays in Default. The person is in Okta but in none of the groups you imported, so Okta doesn't place them. Add them to an imported group in Okta, or import one of their groups.
• More than one Okta user has this email. Rogue places people by email, so it doesn't guess between two Okta users. Any existing enrollment for that email is left alone.
• No usable email in Okta. The user's email can't be used as a person, for example because it's longer than 191 characters.

Read-only workspaces

Okta owns workspaces and who's in them while it's connected. The Workspaces page turns read-only, with a banner naming your Okta domain and Edit in Okta IdP:

• New workspace, edit and archive are hidden.
• People can't be enrolled or removed by hand, including Enroll all on a host.
• Each workspace shows where it came from, such as "Synced from the Okta group Engineering", and opens a read-only list of its people with what placed each one.
• Default shows "Synced from the Okta group Everyone" and lists the Okta people no other workspace holds, the same people as Everyone else. Members, who can't read the Okta directory copy, see only the people enrolled in Default directly.

API key enrollments and devices enrolled directly stay editable on their own pages. The management API's workspace and person-enrollment writes return 409 with details.code set to managed_by_okta.

To move someone Okta placed, change their groups in Okta or pick their workspace under Resolve conflicts.

Update credentials

Select Update credentials on the Okta page to change the client ID or client secret. Rogue tests the new credentials against the same Okta domain, then replaces the stored ones. Your imported groups and choices stay.

To rotate the client secret, generate a new secret on the Rogue Security app in Okta, update credentials in Rogue with it, then deactivate the old secret in Okta. To move to a different Okta org, disconnect first: saved groups belong to the old org.

Disconnect

Select Disconnect on the Okta page. Rogue deletes its copy of your Okta directory and the sync setup, and everyone Okta placed goes back to Default. Workspaces and people added by hand stay, and the Workspaces page becomes editable again.

Who can do what

The Okta page lists everyone in your Okta groups, so only owners and admins see it. Members don't.

Owners and admins hold all of these. Admin API keys follow the same rules: the read-only preset can read, and the administrator preset can also save, sync and disconnect. Connecting and updating credentials have no API operation and need a browser signed in to the console, so a client secret never passes through an automation or an AI agent.

The audit log records connecting, updating credentials, disconnecting, every save, every held sync, and every sync that changes placements, with who was placed, moved or sent back to Default.

Who decides placement

While Okta is connected, anyone who can change group membership in Okta (group owners, help desk admins, group rules) decides which workspace a person lands in, and so which policies apply to them. Review who holds those rights in Okta before you connect. The audit log records every placement, and held syncs catch mass changes.

Error messages

Related

• Organizations and workspaces for how a person's workspace decides the policies their devices get.
• Okta operations in the Admin API reference to read the sync state, change the imported groups and choices, and sync from automation.