> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-okta.md).

# Onboard Okta

For SaaS Security to detect posture risks in your Okta instance, you must onboard your Okta instance to SaaS Security. Through the onboarding process, SaaS Security connects to an Okta API by using an API token that you generate from Okta's administrator console. After connecting to the Okta API, SaaS Security scans your Okta instance for misconfigured settings. If there are misconfigured settings, SaaS Security suggests a remediation action based on best practices.

During onboarding, SaaS Security gives you an option to connect with read-only permissions or with read and write permissions:

* Read-only permissions enable SaaS Security to perform read-only scans.
* Read and write permissions enable additional actions, such as automated remediation.

After SaaS Security establishes a connection to your Okta instance, it notifies you if it was unable to access certain API scopes. SaaS Security might not be able to access certain scopes if the user who created the API token lacked the required permissions.

To onboard your Okta instance, complete the following actions:

* Create an API token for connecting to your Okta instance
* Connect SaaS Security to your Okta instance

***

### Step 1: Create an API Token for Connecting to Your Okta Instance

To access your Okta instance, SaaS Security requires the following information, which you specify during the onboarding process.

| Item               | Description                                                                                                                                                                                                                                                                                                                                                                                                             |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| API Token          | A generated character string that identifies an Okta administrator to the Okta API. SaaS Security requires this API token to authenticate to the API. The token inherits the permissions of the administrator who creates it. Required permissions: For read and write access, the API token must be created by a Super Administrator. For read-only access, the API token can be created by a read-only administrator. |
| Admin Instance URL | The URL for your administrator console.                                                                                                                                                                                                                                                                                                                                                                                 |

As you complete the following steps, make note of the values of the items described in the preceding table. You will enter these values during onboarding to enable SaaS Security to access your Okta instance.

1. Identify the Okta administrator account that you will use to create your API token. The API token inherits the permissions of the administrator who creates it. For read and write access, create the token as a Super Administrator. For read-only access, create the token as a read-only administrator.
2. Using the administrator account that you identified, log in to your Okta administrator console.
3. Identify your administrator instance URL, which appears in the browser's address bar. Your administrator instance URL is your subdomain plus -admin.okta.com (format: https\://\<subdomain>-admin.okta.com).

**Note**: Before you continue to the next step, make note of your administrator instance URL. You will provide this information to SaaS Security during the onboarding process.

4. In the left navigation pane, select Security > API.
5. On the API page, select the Tokens tab.
6. Click Create token. A dialog opens prompting you to name your token.
7. Specify a name for your token and click Create token. Okta generates and displays your token.
8. Copy the generated token and paste it into a text file.

**Note**: Do not continue to the next step unless you have copied the API token. You will provide this token to SaaS Security during the onboarding process.

***

### Step 2: Connect SaaS Security to Your Okta Instance

By adding an Okta app in Cortex, you enable SaaS Security to connect to your Okta instance.

1. Log in to Cortex.
2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to.
3. Click the Okta tile.
4. Under **Capabilities**, enter a name for your application.
5. Select Security Posture under Default Capabilities and click Next.
6. Under **Connections**, enter your API token and your administrator instance URL.
7. Specify whether you want SaaS Security to connect with Read Permissions only or with Read and Write permissions. The onboarding page lists the API scopes that SaaS Security will access to complete its various scans and to perform remediation.
8. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
9. Click **Next** to complete the onboarding validation process.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-okta.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.