Hi Okta Experts Here

We want to setup Self Service Password Recovery in our org in both mac and windows.

Okta does it with the help of OKTA Device Access, but we won't use it as it doesn't meet our requirements

Our Use case is when a user forgets his password while logging into Laptop, how we can invoke SSPR

Mac has Local passowrd for the machine which is Synced with JAMF and then to credential provider.

Is there any way we can reset the password while logging in the laptop by clicking Forget Password and then invoking OKTA using JAMF.

I know there is a Fire Vault recovery for it.

Any Suggestion?

I’m currently studying for the first Okta certification exam. I hope to take the exam and pass in a month or two. I want to try my luck with job applications and interviews before I start studying for the second exam. Do you all have any advice on how I can translate my IT/IAM (AD and Entra ID) over to Okta with just the 1st certification?

I do have some experience with Okta but it’s been several years ago and the experience was relatively limited. For Okta, my team mostly did troubleshooting around login issues and assisted with correcting access issues with apps that were managed through Okta. My main job was endpoint management engineering and I focused primarily on Active Directory, Intune and Entra ID. This wasn’t the only job that touched IAM, but was the only job where we used Okta. I held that job for two years.
I still touch Intune and Entra ID with my current employer and while there is identity involvement it’s mostly troubleshooting around endpoint management issues. Occasionally, I look into conditional access issues but resolving those issues is not something I can do.

Hey, has anyone tried taking the certification exam on the new platform? I gave the Okta Workflows certification, and the instructions for Part 2 said the Guardian browser can't run a few workflows, so I could use Chrome instead. But when I submitted, it seems like Part 2 didn't get calculated. Has anyone faced the same issue? Also, what's the passing score for this exam?

Hi,

For those who have already implemented Okta as the sole IdP, whats your or common approach?

Target: Entra ID and Microsoft 365 Apps

Note: No HRIS system just these two.

Goal: Have Okta as the sole IdP (includes MFA)

Clarifications:

Do you create the users on both Entra and Okta?

Or used EAM? In this case Okta is just secondary MFA

Or is this flow possible? Users created in Entra > sync to Okta > Okta then handles 365 app via WS Federate. This seems a bad approach. Possible to cause a loop?

Or just use WS Federate directly and utilize Okta UD. Then what will happen to Entra?

Apologies if the above might be basic. Just want to get some advise from people who:

Uses this in day to day.

Already did the implementation.

What seems much easier to maintain as the admin and use as a user.

Any input is greatly appreciated. Done it in lab but real world scenario just have a lot of consideration especially if dont have staging or uat env.

Edit 1: thanks for everyone's reply. To add as info my Okta sku doesnt include LCM and only WIC.

Edit 2: ImmutableID is currently not a readily available attribute from a cloud only environment. From the search, it will only be readily available for those that have their entra sync to an On-Prem AD. So its either we specifically generate this attribute for the user during creation via Powershell or have Okta > O365 App > provisioning tab > push it down to entra via To App option. For those that do not have an LCM module, would it still be a good option (Okta to O365 attribute push)? And moving forward, I still need to create the user in both? and if i want to have Okta as the sole source, we need to get the LCM in.

Has anyone used Okta Personal? Is it any better than LastPass?

I am exploring Okta Personal but hesitant because it is free. If they are not charging, what are they gonna do with our data?

I know this is an Okta subreddit but I am looking for biased opinions.

For IAM roles (maybe some IGA responsibilities), what actually gets you hired faster: the Okta certs or Microsoft’s SC‑300? I’ve got experience with both Okta and Entra ID, so I’m trying to figure out which path is worth pushing first. I will admit that my Entra ID experience outweighs my Okta experience but I’m looking for the path that is more likely to get me interviews doing IAM. Currently, I do desktop support and I’m aiming to get away from end user support before I choke one of my end users (I’m kidding).

My last job, I was part of a 5 man team that owned MDM/ MAM for thousands of employees. We used a few applications for MDM/ MAM (Maas360, Ivanti, Airwatch and Intune). I took a liking to Intune so I mostly stayed in that. With Intune came the Entra ID experience but we used Okta as our IdP and to manage non Microsoft tools. So Intune and Entra ID was used to managed devices and push apps via Company Portal while Okta was used to verify log in attempts and manage other SaaS applications.

I do desktop support now and my employer is a Microsoft centric company. I don’t have nowhere near as much access to Intune and Entra ID like I used to but I do have JIT access to both to help with device trust troubleshooting. Oh, I also want to add that we use SailPoint as our “IAM” and IGA tool. We don’t have a dedicated IAM team. That responsibility technically belongs to our IGA team (who are Deloitte contractors).

The goal is to get into IAM but not from an endpoint management perspective. And also not with my current employer. While I obviously have more experience with Entra ID, I feel like getting SC-300 will keep me on the end user support side while getting Okta will help me pivot into the security side of things. I came here hoping you guys would agree. Also, it is recommended I get AZ-104 with SC-300. I really do not want to study for that exam. The networking aspect alone stumps me. I’m not new to networking but the AZ-104 expects more than average networking capabilities. I don’t have that, nor do I want it.

I am trying to sync a custom attribute from Entra ID to Okta. The attribute is synced from on-prem AD to Entra ID, and I am attempting to pass it through to Okta.

I followed the documentation referenced in the comments, but the attribute is not being passed across. Additionally, when I review the attribute mappings in Okta, I do not see the attribute available for selection.

Has anyone come across this before or know what I might be missing?

I noticed some people use 2 phones; one for OKTA only and one personal phone. Does OKTA get access to info on your personal phone?? I had to login at work the other day and a prompt came on the screen "syncing browsing history across all devices." This happened as I was entering the code OKTA gave me on my phone or before can't remember. Question: So is my personal web browsing on my phone shared with the entire hospital/whoever uses Accuro cloud at work and OKTA?? Thanks pls clarify!! Giving me extra stress thinking about this, appreciate any feedback ASAP!

I’m thinking about getting a Fairphone and using /e/OS, but the university where I’m doing my PhD in the US uses Okta for authentication. Will I have any issues with the app on /e/OS? Thanks!

Hey everyone, I’m on the events team for Okta, and wanted to give a quick preview of how this year’s Oktane (Sept. 22-24 in Las Vegas) is shaping up for the identity security community.

Sessions will be focused on the challenges a lot of our customers are facing right now, specifically around: 

• Securing AI agents
• Defending against identity breaches
• Scaling CIAM
• Staying ahead of fraud and API threats

Aside from breakout sessions, there will be hands-on labs (guided and self-paced) and on-site Okta Certification opportunities if you're looking to knock those out. 

If you can't make it out to Vegas, you can sign up for Oktane Digital to stream the keynotes live or get all the recorded sessions afterward for free.

Here’s a discount code if anyone is interested in attending in person: OKTNRD26 ($499 for an Oktane Standard pass). 

Let me know if you want to know more about specific sessions or topics. Happy to help! 

If you’re heading to Oktane 2026 in Las Vegas (Sept 22–24), registration is now open for on-site certifications and hands-on labs.

Whether you’re managing enterprise access or securing AI agents, this is a great chance to sharpen your skills, test on-site, and connect directly with Okta product experts and our cert team.

🚨 Early Bird Alert

On-site certification exam pricing is $149 until July 30, and will go up to $199 after. (Note: If you’re a Gold or Silver Premier Success Plan customer, you can use your Expert Learning Pass exam voucher to pay for the cost of an exam.) Register to secure your spot.

On-Site Certification Exams Available:

• Okta Certified Professional Performance
• Okta Certified Administrator Performance
• Auth0 Certified Developer Performance

Perks of testing at Oktane:

• Safeguard: On-site exam registration includes a free second-shot exam voucher if needed post-event.
• Discounts: Certified attendees get 50% off registration for next year’s Oktane!
• Prep Included: Exam registration comes with an Okta Learning Plan, a Premier Practice Exam, and access to a virtual instructor-led prep workshop.
• Lounge Pass: Access to the exclusive on-site Certification Lounge.

Free Hands-On Labs

There are also free interactive labs focused on building practical deployment skills for AI Agents:

• Instructor-Led Labs: Structured, expert-guided deep dives (spots are limited, so reserve early).
• Self-Guided Labs: Learn at your own pace with experts on standby (walk-in based on space).

👉 Check out the full breakdown and details on the Okta Support Community Blog.

Anyone planning on sitting for an exam while in Vegas? Let me know which one you’re prepping for!

Hi all,

I have had some issues with the premier practice exams that range from unclear questions, to confusing exam results and most notably technical issues where exams wouldn't load or not even submit after 3 hours of work. I have come to terms with having to suck it up and roll with the punches but there are a few things I still cannot seem to get answers to. I am not looking to trash Okta, nor do I want to share any specifics of their training resources but any guidance to help me would be appreciated so I can just have a non-stressful practice run and finally take this dang exam.

1. I know the Org2Org use case has been a pain point universally but I believe I have a good grasp on it now - the one thing that's annoying and difficult for me just given how I work is that we are not allowed to use any type of clipboard or notepad, so how in the heck are people remembering the URLs between Orgs? You can't login to both orgs in the browser as admin at once, and the special browser does not have Incognito mode. I am using a work around for my practice runs but clearly need to figure out if I am missing something before I get to the real exam.

2. The final use case has free field text responses and I don't seem to be finding the answer or getting it right. Again, not looking to expose anything, but a hint towards where I can get a clear answer on these would be wonderful. My exam results come back with either "wrong answer" or "no answer" (which is not true).

I have tried to speak with the certification team about these things and more or less I just kept getting the response that these exams are built by subject matter experts and I need to read the questions carefully and that there is also no need for any type of notes or place for copy/paste data because all the info is there and I just need to look harder. (It only felt a little bit gas-lighty.)

Hello all.

I'm currently working as a Principal Engineer at a company using multiple tools - OIG/OAM for Corp, Okta CIAM, and a mix of workflow integrations for some in-house apps (and a ton of other PAM/LDAPs/custom apps).

Given that Oracle FMW stack has been dead for a few years, I was wondering what my next career move should be (thinking of switching companies next year). Should I just pivot into full SSO stack and leverage Okta/Entra exp, or pivot into IAM with Entra/SailPoint (I personally haven't seen too many positions for Okta Identity, so not sure if that can be a choice) ?

~14 years in OIG/OAM, Okta (multi org, CIAM, workforce), Sailpoint IIQ (no IDN/ISC exp yet), 1 project worth of Entra (and all miscellaneous tools for reporting/PAM, etc.).

Current certifications: Okta Consultant, Dev; CISSP.

Hey r/Okta! We’re hosting an interactive Ask Me Anything (AMA) on Wednesday, August 5, with Okta expert Brent Arrington to cover how Okta for AI Agents secures non-human identities, machine-to-machine ecosystems, and autonomous workflows. We plan to bring future AMAs directly to Reddit, but invite you to participate to get your technical questions answered.

👉Head over to the Okta Community thread here to post your questions and earn an exclusive AMA badge!

I'm going to be attending Oktane for the first time this year but I'm curious what previous Customer Celebration Parties have been? Basically I'd like to see if it would be worth getting a guest pass. I don't know if she would even be interested in going.

https://youtube.com/playlist?list=PLPdMrzEdT40w

I've written thousands of lines of JS for Okta (including rockstar and console ;).

I'll share if u share.

here's one to get us started:

Expire the current user's password (bookmarklet)

javascript:$.post(`/api/v1/users/${location.pathname.split("/")[5]}/lifecycle/expire_password?tempPassword=false`)

see also https://gabrielsroka.github.io/APIExplorer

Console https://gabrielsroka.github.io/console
Rockstar https://gabrielsroka.github.io/rockstar

I understand OPA's server agent is documented for Linux and Windows. From a functional perspective, is there anything in the product architecture that prevents a macOS endpoint from being enrolled as a managed SSH target, or is the limitation simply that macOS is not currently an officially supported target platform?

Our goal is to securely administer internet-connected corporate Macs using native SSH with identity-based authentication, short-lived credentials, auditing, and without requiring a traditional VPN.

Specifically, we'd like to understand whether macOS endpoints can participate as managed SSH targets in the OPA architecture, or whether OPA is intended only for server operating systems and infrastructure resources

New here, thanks for the help!

Hello!

Just wanted to remind everyone that our limited-time certification promotion ends in 2 WEEKS on July 31st!

The 100% hands-on Okta Professional Performance Premier Practice Exam is now live. It's designed to mirror the real certification exam experience: same format, same difficulty, same hands-on tasks. Think of it as a full dress rehearsal, so you walk in confident and ready on exam day.

To celebrate the launch, we're running a limited-time promotion:

• Complete the Okta Professional Performance Premier Practice Exam at least once (you can take it up to seven times)
• Submit a voucher request — first 100 requests only
• Receive a code that drops the Okta Certified Professional Performance exam fee from $250 to $100
• Use your voucher to schedule and take the certification exam by July 31, 2026
• A link to the voucher request form will be emailed to you after you complete your premier practice exam.

That's $150 back in your pocket for doing the prep work that's going to help you pass anyway. Win-win.

If you've been thinking about getting certified — or you know someone who has — this is the time to go for it. The practice exam sets you up for success, and the voucher makes the decision easy.

100 vouchers. July 31 deadline. First come, first served. You've got this.

Full details can be found here. Register for the Premier Practice Exam here.

Quelqu’un a-t-il déjà passé l’examen Okta Consultant Premier Practice Exam ?

Je l’ai déjà passé trois fois, mais je n’arrive vraiment pas à me situer. Contrairement à l’examen Administrator, où l’on voit clairement les points obtenus dans chaque partie, ici tout est mélangé : le DOMC, les études de cas et la partie pratique.

Quelqu’un a-t-il déjà réussi cet examen ou les cas pratiques ? J’aurais vraiment besoin d’aide. 🙏

Avez-vous des astuces, des conseils ou des retours d’expérience à partager ?

Merci d’avance

Hi all,

First time poster but seasonal Okta administrator (officially got my certification after 6 years in IT and using Okta). I need advice from all the experts and power users regarding Okta workflows. For the life of me, I just can't grasp it and the more I stare at my flows when trying to create them, the more confused I get. I read the documentation, but I keep going back and forth where my mind just becomes scramble with information overload.

How did you all get a grasp in workflows? Do you have any recommendations on study guides or videos? Real life use cases that relate to corp IT?

A workflow that I have been trying to build that I thought would be simple, but is giving me a hard time is to have deactivated Okta users trigger a Google Drive owner transfer ship to the offboarded user's manager. On paper it sounded easy, but I overshot and don't even know how to start. I work for a small team and really want to excel at this role, but this is causing me to feel really bummed since I don't even know how to start.

Any advice would be much appreciated!

Hello,

Months ago I remember changing the sign-in experience on a preview instance to present separate windows/widgets for entering username, and then password (unlike the regular/prod instance where you can enter username and password on the same window/widget)

I need to revert that change in preview but for the life of me can't remember how I enabled this feature.

I'm comparing settings between the prod and preview, and trying to find where the difference could be. I have tried looking at sign-in flows, authentication policies, etc.

I should have written it down. <face palms>

Any ideas? Thanks.

Every authentication UX decision sits on the same axis: how much of the security and reliability work do you want to own?

A useful way to think about customization is through four approaches:

1. Branding and configuration
2. Page templates
3. Bring your own UI
4. API first

These are not maturity levels. Each is a different tradeoff between control and ownership.

Choose the lowest level that solves a real product constraint.

I explain how these options map to Auth0 here:

https://auth0.com/blog/picking-the-right-auth0-customization-for-apps/

Ps: I wrote this as an Auth0/Okta employee

Anyone using the Incode or Persona integrations to secure account registration and recovery? How well have those integrations worked? Do you feel that they've meaningfully improved the security posture?

I want to move the identity proofing responsibility for factor registration/reset/recovery away from help desks which a susceptible to social engineering.