Skip to content

Okta access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Okta, Black Cat runs 21 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Okta connector needs.

Checks (21)

severity: medium Dormant Accounts fix difficulty: medium #

Suspend or remove Okta accounts inactive for 90+ days

  1. Navigate to Okta Admin > Directory > People
  2. Filter users by last login date to identify dormant accounts
  3. Deactivate or suspend accounts that are no longer needed
  4. Document the review decision for compliance records

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.3 SOC 2 Type II CC6.3 CIS Controls v8 CIS-05.3 NIST CSF 2.0 PR.AA-01 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Dormant Super Admins fix difficulty: medium #

Demote or deactivate Okta super-admin accounts with no recent login activity

  1. Navigate to Okta Admin > Security > Administrators
  2. Identify super admin accounts with no recent login activity
  3. Demote dormant super admins to a lower-privilege role
  4. Deactivate accounts that are no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Weak Password Policy fix difficulty: easy #

Strengthen Okta password policy to require at least 12 characters with complexity

  1. Navigate to Okta Admin > Security > Authentication > Password
  2. Set minimum password length to at least 12 characters
  3. Enable complexity requirements (uppercase, lowercase, number, symbol)
  4. Enable common password check
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC5.2 CIS Controls v8 CIS-12.6 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Weak Account Lockout fix difficulty: easy #

Configure Okta account lockout to trigger after 5 or fewer failed attempts

  1. Navigate to Okta Admin > Security > Authentication > Password
  2. Set maximum failed login attempts to 5 or fewer
  3. Set lockout duration to at least 30 minutes
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Session Idle Timeout Too Long fix difficulty: easy #

Reduce Okta session idle timeout to 1 hour or less

  1. Navigate to Okta Admin > Security > Authentication Policies
  2. Select the global session policy
  3. Set the idle session timeout to 1 hour or less
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Session Lifetime Too Long fix difficulty: easy #

Reduce Okta maximum session lifetime to 12 hours or less

  1. Navigate to Okta Admin > Security > Authentication Policies
  2. Select the global session policy
  3. Set the maximum session lifetime to 12 hours or less
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium App Not Using Federated Auth fix difficulty: hard #

Configure SAML or OIDC federation for Okta applications and disable direct password login

  1. Navigate to Okta Admin > Applications > Applications
  2. Select the application that is not using federated authentication
  3. Configure SAML or OIDC federation for the application
  4. Test the federated login flow
  5. Disable direct password-based login

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium App With Individual User Assignments fix difficulty: medium #

Replace individual Okta app assignments with group-based access management

  1. Navigate to Okta Admin > Applications > Applications
  2. Select the affected application
  3. Click on Assignments and identify individual user assignments
  4. Create or use existing groups and assign the application to groups
  5. Remove individual user assignments

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high OAuth App Broad Scopes fix difficulty: medium #

Restrict Okta OAuth app scopes to the minimum required by the application

  1. Navigate to Okta Admin > Applications > Applications
  2. Select the OAuth application with broad scopes
  3. Review the granted scopes and remove unnecessary ones
  4. Apply the principle of least privilege to scope assignments
  5. Test the application to ensure it still functions correctly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-308.a4 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium OAuth App Inactive With Grants fix difficulty: easy #

Revoke grants and deactivate inactive Okta OAuth applications

  1. Navigate to Okta Admin > Applications > Applications
  2. Identify inactive OAuth applications with active grants
  3. Revoke grants for applications that are no longer in use
  4. Deactivate or delete the inactive application

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.3 SOC 2 Type II CC6.3 CIS Controls v8 CIS-05.3 NIST CSF 2.0 PR.AA-01 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium OAuth App AI With Broad Access fix difficulty: medium #

Restrict or remove broad grant types from AI OAuth apps in the Okta admin console

  1. Navigate to Okta Admin > Applications > Applications
  2. Search for and select the flagged AI application
  3. Open the General Settings tab and review the grant types
  4. Remove risky grant types such as implicit and client_credentials if not required
  5. Revoke existing tokens issued under broad grant types
  6. Deactivate the application if it is no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-308.a4 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Access Policy Default Not Deny fix difficulty: easy #

Set the Okta access policy catch-all rule to deny access by default

  1. Navigate to Okta Admin > Security > Authentication Policies
  2. Select the access policy to review
  3. Ensure the catch-all rule at the bottom of the policy is set to deny access
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Super Admin API Tokens fix difficulty: hard #

Replace Okta super-admin API tokens with service account tokens using least-privilege permissions

  1. Navigate to Okta Admin > Security > API > Tokens
  2. Identify API tokens created by super admin accounts
  3. Create replacement tokens using a service account with limited permissions
  4. Revoke the super admin API tokens
  5. Update integrations to use the new tokens

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Super Admin Count Excessive fix difficulty: medium #

Reduce Okta super-admin count to 2-4 accounts by demoting unnecessary admins

  1. Navigate to Okta Admin > Security > Administrators
  2. Review the list of super admin users
  3. Demote unnecessary super admins to more specific admin roles
  4. Keep only 2-4 super admin accounts

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.2 SOC 2 Type II CC6.3 CIS Controls v8 CIS-05.4 NIST CSF 2.0 PR.AA-01 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Super Admin Redundancy Missing fix difficulty: easy #

Ensure at least two Okta super-admin accounts exist with MFA enrolled

  1. Navigate to Okta Admin > Security > Administrators
  2. Verify at least two super admin accounts exist
  3. If only one exists, promote a second trusted user to super admin
  4. Ensure both super admins have MFA enrolled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.2 SOC 2 Type II CC6.3 CIS Controls v8 CIS-05.4 NIST CSF 2.0 PR.AA-01 GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Admin API Token Usage fix difficulty: hard #

Replace admin API tokens with service account tokens using least-privilege scopes

  1. Navigate to Okta Admin > Security > API > Tokens
  2. Identify API tokens created by non-super admin accounts with admin roles
  3. Create a dedicated service account with only the required scopes
  4. Generate a new API token for the service account
  5. Update integrations to use the new service account token
  6. Revoke the admin user API token

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low User Account Suspended fix difficulty: easy #

Review suspended Okta accounts and deactivate or reactivate as appropriate

  1. Navigate to Okta Admin > Directory > People
  2. Filter by status to find suspended users
  3. Review each suspended account to determine if it should be reactivated or deactivated
  4. Deactivate accounts that are no longer needed
  5. Reactivate accounts that were suspended in error

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium User Account Locked Out fix difficulty: easy #

Investigate locked out Okta accounts for potential brute-force attacks and unlock if legitimate

  1. Navigate to Okta Admin > Directory > People
  2. Filter by status to find locked out users
  3. Review the system log for failed login attempts from the locked accounts
  4. Determine if the lockout is due to a legitimate user or a brute-force attack
  5. Unlock the account if the user is legitimate and reset credentials if needed

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Total Admin Accounts fix difficulty: medium #

Reduce the total number of Okta admin accounts to 10 or fewer by demoting unnecessary admins

  1. Navigate to Okta Admin > Security > Administrators
  2. Review the full list of admin accounts
  3. Identify admins who no longer need elevated privileges
  4. Demote unnecessary admins to standard user roles
  5. Document justification for remaining admin accounts

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Stale API Token fix difficulty: medium #

Revoke Okta API tokens that have not been used in 90+ days or never used

  1. Navigate to Okta Admin > Security > API > Tokens
  2. Identify tokens with no recent activity
  3. Confirm with the token owner that the token is no longer needed
  4. Revoke the stale token
  5. Update any integration to use a service-account token with least privilege

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Old API Token fix difficulty: medium #

Rotate Okta API tokens older than 365 days

  1. Navigate to Okta Admin > Security > API > Tokens
  2. Identify tokens created more than a year ago
  3. Create a replacement token (prefer a least-privilege service account)
  4. Revoke the old token after migrating integrations

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Okta checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial