---
updatedAt: 2026-10-02T20:13:25.000Z
---
# Connect your IdP: Okta | Entitle Cloud
## Overview
Okta provides cloud software that helps companies manage and secure user authentication into applications, and for developers to build identity controls into applications, website web services, and devices.
Entitle populates the following resource types in the Okta connections:
* Groups
* Users
* Managers (optional)
Entitle integrates with Okta by a couple of different methods, one of them being an IdP with users and organization directory information as described on this page. You can set up Okta as an Identity Provider (IdP), the source of truth for Entitle users, groups, and organizational structure, using the instructions below.
This page will provide you with instructions on how to connect Entitle and Okta as an IdP.
## General guidelines
In case you have already integrated Okta as an application with Entitle using [this guide](entitle-integration-okta-access-management-guide)**, you can go directly to the **[Set up in Entitle](#connecting-your-idp-in-entitle) section.
> ℹ️
>
> Should you need to allowlist this integration, these are the IP addresses from which Entitle's service reaches the integration:
>
> * Entitle EU (Cloud deployment)
> * 34.243.199.171
> * 54.216.133.226
> * Entitle US (Pathfinder deployment)
> * 52.45.229.219
> * 54.88.235.213
> * 3.224.15.134
> * Entitle CA (Pathfinder deployment)
> * 35.182.218.208
> * 15.156.179.153
## Set up Okta to work with Entitle
If you want to create the token for the Partial functionality option, make sure the token's Admin Role setting is configured as **Group Membership Admin** and **Report Admin** roles.
### Stage 1: Create a new app integration
1. On your Okta admin panel on the left side, click on the **Applications** tab and choose **Applications**.
2. Then click on **Create App Integration**.
3. In the pop-up screen that appears, select the **API Services** option and click **Next**.
4. In the **App integration name** field, choose a name for the app and click **Save**.
5. Under **Client Credentials**, click the **Copy** button next to the **Client ID** and keep it for later.
6. Then on the same page, click the **Edit** button right above the **Copy** button.
### Stage 2: Generate a new key
1. Under the **Client authentication** section, choose the **Public key/Private key** option.
2. Under **Public Keys**, do not change the default option in the **Configuration** section. Then, click the **Add Key** button below it.
3. Click **Generate new key**. You should see your private key displayed on the screen.
4. Under the **Private key** section, click **Copy to clipboard** and click **Done**.
5. Click **Save** and then **Save** again to acknowledge the notice.
### Stage 3: Disabling the Proof of Possession
In the `General Settings` section below, make sure the `Proof of Possession` is **not** checked, and click **Save**.
### Stage 4: Grant permissions
1. Click the **Okta API Scopes** tab.
2. Click **Grant** and then **Grant Access** for the following API scopes:
```
okta.users.read
okta.groups.manage
okta.groups.read
```
3. If you wish to manage admin roles as well, add the following scopes:
```
okta.roles.manage
okta.roles.read
```
4. If you wish to manage application assignments as well, add the following scopes:
```
okta.apps.read
okta.apps.manage
```
### Stage 5: Grant admin roles
1. In the **Application** section, click the **Admin Roles** tab.
2. Click on the **Edit assignments** button on the right-hand side.
3. Add the `Group Membership Administrator` assignment, and click on the **Save Changes** button.
## Connecting your IdP in Entitle
1. Log in to Entitle and go to the **Integrations** page.
2. Under the **Connect To section**, navigate to the Okta option, and click **Connect**.
3. In the pop-up window **Configure Okta**, fill in the required details:
* **Display Name** of your choice.
* **JWK**: the new private key you created earlier.
* **Client ID**: the client ID you copied earlier.
* **Organization URL**: your Okta tenant's URL.
Do not paste your Okta tenant's management URL in this field.
* In case you wish to add managers’ approval as a part of the approval process of **Access Requests** or to select managers as the **User Access Review** reviewers:
* In the **Manager Email Field Name**, add the attribute that refers to the manager's email address.
* Check the **Use as direct manager source** checkbox.
* **Save on:** Choose whether you would like this integration to be saved on your own hosted agent or in Entitle's cloud.
* Click **Save**, or if attribute selection is turned on for your organization, click **Next**.
### Attribute selection
Select which user attributes Entitle syncs from Okta. Synced attributes appear on each user's profile and can be used as conditions in approval workflows. You can skip this step during setup and add attributes later.
Attribute selection is an optional feature that must be turned on for your organization. Contact your BeyondTrust representative for details.
1. On the attribute selection page, select each attribute you want Entitle to sync.
2. To rename an attribute, click its **Display name** cell and enter a new name.
3. Click **Save**, or click **Skip** to continue without syncing attributes.
For attribute limits, required permissions, and how to change your selection later, see [Select attributes to sync from your identity provider](https://docs.beyondtrust.com/entitle/docs/select-attributes-to-sync-from-idp).
## Test your IdP connection
1. After being redirected to the **Org Settings** page, you should be able to see that the Okta is now **Connected**.
2. Within a few minutes, refresh your browser page and go to the **Approval workflows** screen, then click the **New approval workflow** button. You should now be able to see all the groups are fetched.