Okta Integration Guide

Evidr is a compliance automation platform that helps technology companies maintain continuous evidence of their security posture across frameworks like SOC 2, ISO 27001, HIPAA, GDPR, and PCI DSS. The Okta Evidr integration allows customers to continuously assess their Okta organization against the security controls auditors test, using Okta as the read-only source of identity and access posture.

The integration is an Okta API Service Integration distributed through the Okta Integration Network (OIN). It uses the OAuth 2.0 client credentials grant with read-only scopes and never modifies the customer's Okta configuration.

• An Evidr workspace. Sign up at evidr.com or accept an invitation from the customer of record.
• Okta administrator permissions in the customer's Okta org, sufficient to install an API Service Integration from the OIN catalog and grant API scopes.
• The customer's Okta org URL, in the form customer.okta.com or customer.oktapreview.com.

• Continuous posture assessment. The integration runs scheduled scans of the customer's Okta organization against the Evidr compliance check catalog and surfaces findings in the Evidr console.
• Read-only operation. Only read scopes are requested. Evidrnever modifies users, groups, policies, factors, or roles in the customer's Okta org.
• Framework-aligned findings. Each finding cites the underlying control source, including CIS Okta L1, NIST IA-2(11), and PCI DSS 4.0 requirements 8.4 and 8.5.
• Remediation guidance.Every finding includes a concrete remediation step the customer's Okta administrator can follow.

The flow has two surfaces: the customer's Okta Admin Console (where the integration is installed and scopes are granted) and the Evidr console (where the connection is saved and findings are viewed).

A. Install Evidr Compliance in the customer's Okta org

1. Sign in to the customer's Okta Admin Console as an administrator.
2. Go to Applications → Browse App Catalog, search for Evidr Compliance, and click Add Integration.
3. When prompted, grant the four read-only API scopes listed in the Required API scopes section below.
4. After installation, open the integration's General tab. Okta has minted a Client ID and Client Secret. Keep this tab open: you need both values for the next section.

B. Save the connection in the Evidr console

1. Sign in to the Evidr console at https://staging.evidr.com.
2. In the left sidebar, click Integrations. The page opens on the Continuous Monitoring tab.
3. Click the Integration directory tab to see the tile grid.
4. Find the Okta tile and click Connect. The Connect Okta modal opens on Step 1, Enter your Okta org.
5. In Step 2 : Paste your Okta org domain, enter the tenant subdomain (for example acme.okta.com). Do not include the protocol or a trailing slash.
6. In Step 3 : Paste the API Service credentials, paste the Client ID and Client Secret from the Okta General tab in section A.
7. Click Verify connection. Evidr mints a service token, reads the org metadata, and probes every granted scope. If any scope was not granted in section A, the verifier names it so you can fix the grant in Okta before continuing. On success, the modal confirms the org name and that all four scopes are granted.
8. Click Continue to advance to Step 2 : Confirm & Connect. Optionally set a connection label, then click Connect.

The first scan runs automatically on connect.There is no manual run-scan button. Subsequent scans run on a weekly schedule. The Continuous Monitoring tab updates with the connection's passed and failed counts within one to three minutes of the first scan finishing.

The integration requests four read-only scopes. Every scope is exercised by a recurring check on every scan cycle. Nothing else is read from the customer's Okta org.

• okta.users.read: list active users, their lastLogin timestamps, and activation state. Used by every check that reasons about users.
• okta.factors.read: enumerate each user's enrolled MFA factors and their status. Used by the MFA-enrollment and admin-strong-factor checks.
• okta.roles.read: discover which users hold administrative role assignments, via /iam/assignees/users primarily and per-user /roles as a fallback. Used by the admin-strong-factor check.
• okta.logs.read: read recent System Log events to confirm audit-log evidence is collectable. Used by the System Log readability check.

No write or administrative scopes are requested at any point. The integration never modifies users, groups, roles, policies, factors, applications, or any other Okta resource.

v1 ships four recurring checks aligned to the most-asked compliance controls. The first scan runs immediately on connect; results appear on the Continuous Monitoring tab and on each connection's drawer.

• MFA Enrolled on Every Active User: confirms every ACTIVE user has at least one ACTIVE MFA factor. Sources: okta.users.read and okta.factors.read. Controls: SOC 2 CC6.1, ISO 27001 A.5.17, PCI DSS 4.0 8.4.2, NIST IA-2(1).
• Admin Accounts Use a Strong MFA Factor: confirms every user holding an admin role has at least one phishing-resistant or push/TOTP factor (SMS, voice, and email do not satisfy). Sources: okta.users.read, okta.roles.read, okta.factors.read. Controls: CIS Okta L1, PCI DSS 4.0 8.4.2 and 8.5, NIST IA-2(11).
• Dormant Active Accounts (90+ days): flags ACTIVE accounts with a lastLogin older than 90 days. Newly provisioned accounts get a 30-day grace window. Sources: okta.users.read. Controls: NIST AC-2, ISO 27001 A.5.16, SOC 2 CC6.2.
• Okta System Log Readable: confirms /api/v1/logs returns recent events, so audit-log evidence is collectable. Sources: okta.logs.read. Controls: HIPAA §164.312(b), SOC 2 CC7.2, ISO 27001 A.8.15, NIST AU-2.

After clicking Connectin the Confirm & Connect step, the first scan runs automatically. Within one to three minutes the Continuous Monitoring tab updates with the connection's row, showing passed and failed counts.

Click the connection to open its drawer. The four checks listed above each render as a row with status, severity, the controls they map to, and a remediation hint when failing. The drawer also shows which Okta API paths each check exercised, so you can correlate granted scopes to actual usage.

To confirm a specific scope is required, revoke it in the customer's Okta Admin Console (in the integration's API Scopes tab) and click Verify connection in the Edit Connection dialog in Evidr. The verifier reports the missing scope by name and refuses to advance until it is restored.

To remove the integration:

1. In the Evidr console, open Integrations → Okta and click Disconnect. This stops further scans and revokes the stored client credentials.
2. In the customer's Okta org, open the Evidr Compliance API Service Integration and click Uninstall. This deletes the OAuth client.

Findings collected before uninstall remain in the Evidr console for audit history and can be exported or deleted at any time from the workspace settings.

For help installing or operating the integration, contact [email protected] or call +1 (323) 902-3250. The Evidr support team responds within one business day.