Connect Okta (identity audit)

A dedicated Read-Only Administrator service account and API token — factor coverage, admin sprawl, and policy strength across your Okta org.

1. 1Connect Cybermatic to Okta. You will create a dedicated Okta account with Read-Only Administrator access, generate an API token while signed in as that account, and enter the token and native Okta org URL into Cybermatic. Okta's Read-Only Administrator role can view users, groups, applications, reports, system logs, Okta settings, and sign-on policies without changing them. Read-only administrators are also permitted to create and manage their own API tokens.
2. 2Step 1 — Sign in with an existing Okta administrator. 1. Open your Okta Admin Console. 2. Sign in using an account that can: • Create users. • Assign administrator roles. 3. Confirm you are working in the correct Okta organization. Your browser address might contain something like: https://yourcompany-admin.okta.com/admin/dashboard Do not use that entire address later as the Cybermatic org URL.
3. 3Step 2 — Create the Cybermatic service account. 1. In the left navigation, select: Directory → People 2. Select Add person. In some Okta versions, the button may say Add user. 3. Enter the service-account information. For example: First name: Cybermatic Last name: Scanner Username: cybermatic-scanner@yourcompany.com Primary email: cybermatic-scanner@yourcompany.com 4. Use a real mailbox or distribution mailbox that you control. Okta may send activation, password-reset, or security notifications to it. 5. For the password or activation option, choose one of these approaches: • Send the user an activation email. • Set a temporary password as the administrator. 6. You may require the password to be changed during the first sign-in, when that option is available. 7. Select Save or Add person. Do not create this as a shared personal administrator account. It should be used only for the Cybermatic integration.
4. 4Step 3 — Assign the Read-Only Administrator role. While still signed in with your existing administrator account: 1. Go to: Security → Administrators 2. Select Add administrator. 3. Search for: cybermatic-scanner@yourcompany.com 4. Select the user. 5. Under administrator roles, select: Read-Only Administrator 6. Select Save changes or Add administrator. 7. Open the user's record and verify that Read-Only Administrator appears under the user's administrative roles. The token will inherit the permissions of the account that creates it. If the account's permissions change, the token's effective permissions change as well. If the account is deactivated, its tokens stop working.
5. 5Step 4 — Activate and initialize the service account. The service account must be active and able to enter the Admin Console before it can create its token. 1. Sign out of your existing administrator account. 2. Open a private or incognito browser window. 3. Go to your normal Okta sign-in page. 4. Sign in as: cybermatic-scanner@yourcompany.com or whatever email you created on step 2. 5. Complete the activation process. 6. Set the permanent password. 7. Enroll the account in the MFA method required by your Okta administrator policy. 8. Complete the MFA challenge. 9. Open the Admin Console. Because token creation can be configured as a protected administrator action, Okta may require the service account to authenticate again with MFA while creating the token. Confirm the account is ready — verify that: • The account can open the Admin Console. • The account is shown as a Read-Only Administrator. • The account cannot modify ordinary Okta settings. • The account can access Security → API.
6. 6Step 5 — Find the correct Okta org URL. This is an important distinction: do not copy the -admin browser hostname. 1. While in the Admin Console, select the username or account menu in the upper-right corner. 2. Find the Okta domain shown in that menu. 3. Copy that domain. It will normally look like one of these: yourcompany.okta.com yourcompany.oktapreview.com yourcompany.okta-emea.com Add https:// when entering it into Cybermatic: https://yourcompany.okta.com Okta's administrator URL normally adds -admin, such as yourcompany-admin.okta.com, but the native org URL does not. Okta specifically documents the account-menu domain as the correct way to find the org URL. Do not enter: https://yourcompany-admin.okta.com https://yourcompany.okta.com/admin/dashboard Use: https://yourcompany.okta.com We recommend using the native Okta domain displayed in the account menu rather than guessing from a branded sign-in domain.
7. 7Step 6 — Create the API token. Remain signed in as the new Cybermatic Scanner service account. 1. In the Admin Console, go to: Security → API 2. Open the Tokens tab. 3. Select Create token. 4. Enter — Token name: Cybermatic Scanner 5. If Okta displays "API calls made with this token must originate from", choose an appropriate network restriction. For the initial connection, select Any IP unless Cybermatic has provided fixed outbound IP addresses that you have already added as an Okta IP network zone. Restricting the token to the wrong network zone will prevent Cybermatic from using it. Okta supports IP-based restrictions on SSWS API tokens. 6. Select Create token. 7. Okta may request password and MFA verification. 8. When the token appears, select Copy to clipboard. 9. Immediately place it in a secure password manager temporarily. The token value is displayed only during creation. Okta stores it as a hash afterward, so it cannot be displayed again. Treat it like a password. Do not copy the token ID from the Tokens list. Cybermatic needs the long token value displayed immediately after creation.
8. 8Step 7 — Connect Okta in Cybermatic. 1. Sign in to Cybermatic. 2. Open: Connections 3. Under Connect a cloud or SaaS account, select: Okta 4. Enter the native org URL: Okta org URL: https://yourcompany.okta.com 5. Paste the token value: API token: the complete token copied during creation 6. Check the URL carefully: • It starts with https://. • It does not contain -admin. • It does not contain /admin. • It does not contain /api/v1. • It does not contain spaces. 7. Select Connect. Cybermatic saves the connection and starts the initial scan.
9. 9What Cybermatic checks. • Every active user's enrolled MFA factors — with a Critical finding for any Okta administrator signing in on password alone (Okta admins can reset everyone else's access, making them the highest-value phishing target in the company). • Super Administrator count (2–3 recommended, including a break-glass account). • Password policy strength (12+ character minimums per current NIST/CIS guidance). • Whether an active MFA enrollment policy exists at all. • Active accounts with no sign-in for 90+ days — usually departed employees whose access outlived them. All calls are read-only; a Read-Only Administrator token cannot change anything in your org even if it leaked.
10. 10Troubleshooting. "Okta auth failed: the API token was rejected (401)" — the token was mistyped, revoked, or expired from 30 days of disuse; create a new one and use Connections → Update credentials. "Okta API 403" on some checks — the token's owner lacks read access to that area; confirm the Read-Only Administrator role is assigned. The scanner skips what it can't read rather than failing the whole scan. "Okta org URL should look like…" — remove any trailing path (no /admin, no /app/…); just https://yourcompany.okta.com. Note: Okta API tokens expire after 30 days of no use, but stay alive indefinitely while Cybermatic's scheduled scans keep using them. Rotating the token — create the new token first, update it in Cybermatic (Connections → Update credentials), confirm the next scan succeeds, then revoke the old token in Okta.

Tip: Create the token from a dedicated read-only service account, not a person — tokens die when their creator is deactivated, and offboarding an admin shouldn't silently break your security scanning.