Granting Oktually Access to your Okta

Prerequisites

1. A dedicated Okta account to act as the service account for Oktually
2. You need to use an account with Super Administrator permissions for these steps, to be able to grant the Oktually service account admin roles

Create a Custom Role & Resource Group

1. From the Okta admin dashboard, Security → Administrators
2. Click on the Roles tab
3. Create new role
4. Give the role a name & description, for example Oktually Expanded Read-Only & Role to allow oktually.com read-only access to administrators & API key details
5. Add these two permissions to the role
   • Navigate through User → Manage Users → Manage API Tokens and select View API tokens. This is permission to see which API tokens exist & when they were used etc. not the tokens themselves
   • Navigate through Identity and Access Management and add View roles, resources, and admin assignments
6. Check the selected permissions against this example
   
   
   
   
7. Select Save Role to save the role and return to the Administrators page
8. Select Resources → Create new resource set
9. Give the resource set a name & description, for example Oktually Expanded Read-Only & Resource set to allow oktually.com read-only access to administrators & API key details
10. Add the following two resources
    • From Users add All users
    • From Identity and Access Management add All Identity and Access Management resources
11. Check the selected permissions against this example
    
    
    
    
12. Save the resource set

Add Admin Permissions to the Service Account

1. Open the profile for the Oktually service account, go to Admin Roles and select Add individual admin privileges
2. Add the following two assignments to the service account
   • Role: Read-Only Administrator
   • Role: Oktually Expanded Read-Only (or your role name), resource set: Oktually Expanded Read-Only (or your resource set name)
     
     
     
     
3. You’ll see a warning, Resource set includes resources that are not affected by the permissions in the role. — this is expected.
4. Remember to Save Changes

Create a Network Zone for Oktually (Optional, but Recommended)

1. From the Okta admin dashboard, Security → Networks
2. Add Zone → IP Zone
3. Name the zone, for example Oktually
4. In Gateway IPs enter Oktually’s gateway IP, currently 51.15.55.103/32
5. Save the zone

Create Oktually’s API Key

1. Sign in as the Oktually service account first, otherwise you’ll create an API key for your own admin account
2. From the Okta admin dashboard, Security → API
3. Select the Tokens tab
4. Create token
5. Enter a name for the API token, for example Oktually Data Collection
6. If you created a network zone for Oktually:
   • In API calls made with this token must originate from, select In any of the following zones:
   • Select the zone you made for Oktually
7. Create token
   
   
   
   
8. Copy the Token Value and immediately submit it to Oktually via your chosen method for sharing secrets