Okta

Overview

Okta is the vendor-neutral commercial option in this category, and that independence is the point: it is not tied to a productivity suite, so it brokers identity across whatever estate you actually run.

It sells two platforms rather than one, a workforce platform under its own name and a customer identity platform under the Auth0 name, and they are licensed and priced quite separately.

Its product breadth is the widest of the three. Alongside single sign-on and multi-factor it sells governance, privileged access, identity threat detection and posture management as first-party products.

Privileged access deserves particular note, because it is the only one of the three to offer it. That line absorbed Axiom Security in September 2025, extending control to cloud, software service and database resources.

Its threat detection line was similarly reshaped by buying Permiso Security, which closed in August 2026 and brought behavioural analytics across human, machine and agent identities.

Deployment is cloud only. There is no self-hosted option; on-premises reach comes from lightweight agents and a gateway that connect outward to your tenant.

Its current direction is agent identity, with a dedicated product generally available since April 2026 that registers agents in the directory, detects shadow agent use in the browser and can deactivate an agent outright.

Read that product's boundaries carefully, because several capabilities people assume are shipping are not. Agent to agent delegation, a gateway control plane and agent threat detection are all published as not yet generally available.

A separate and free capability arrived in August 2026: agent single sign-on, built on an open cross-application access standard extending OAuth, included in core plans rather than sold as an add-on.

Its support system incident of October 2023 affected 134 customers, under one percent, with five sessions hijacked, and no later incident is disclosed.

Key features and capabilities

The same headings are used for every identity & access entry, so two tools can be read side by side.

Identity and directory

• Universal Directory is a cloud meta-directory consolidating Active Directory, LDAP and HR systems into one source of truth
• Custom attributes, profile mastering and attribute-level permissions govern who can see sensitive fields
• Partner and contractor identity is a named product rather than a guest-account workaround
• Machine identity spans API access management, service account governance and agents registered in the directory
• Device identity is a separate product, with posture signals aggregated from other tools for both managed and unmanaged devices

Authentication and single sign-on

• Single sign-on is the base of every plan and by far the largest integration category in its network
• Published factors include its own phishing-resistant authenticator, FIDO2 keys, smart cards and biometrics, with a contactless option added in September 2026
• Passkeys are not named on the product pages; FIDO2 and WebAuthn are, so treat passkey wording as unpublished
• Adaptive policy weighs device, network, location, behaviour and address, with impossible-travel detection documented
• Sessions are re-evaluated against device state after sign-on, which is the published mitigation for session hijacking

Authorisation and policy

• Group and policy-based application assignment through the directory
• Governance manages fine-grained entitlements from downstream applications, discovering permission levels rather than only app access
• Privileged access is a distinct product priced on resource units, extended to cloud and database resources by the Axiom acquisition
• Access certification campaigns are preconfigured, with managers notified automatically to confirm their team's permissions
• Separation of duties appears in company writing but not on the governance product page, so treat it as unpublished

Provisioning and lifecycle

• Lifecycle management automates joiner, mover and leaver across software services and on-premises resources
• Published authoritative HR sources are Workday, SAP SuccessFactors, BambooHR and UKG
• Changes in the HR system are detected in real time and pushed downstream automatically
• Extended workforce policies can act on dates and inactivity rather than only on employment records
• Self-service requests route through the portal or through chat tools, with a no-code automation layer behind them

Standards and protocols

• OAuth 2.0 with authorisation code and proof key for code exchange, client credentials, and assertion-based grants
• OpenID Connect for authentication, plus SAML 2.0 and SCIM as first-class integration types
• A password-vaulting mechanism covers applications with no federation support at all
• The directory exposes an LDAP interface so legacy applications can authenticate against it directly
• Cross-application access is its own published standard for agents, extending OAuth and working with the model context protocol

Integrations

• More than 8,000 prebuilt integrations, with the live catalogue rendering over 8,300
• Category counts are published, led by single sign-on, then lifecycle management, automation and governance
• No data platform integration is named on any first-party page, which is a genuine gap for a data audience
• A curated collection of security-specific integrations is published separately
• Developer documentation carries API references and software development kits, though the language list is not published

Where it runs and what it costs

• Cloud only, multi-tenant, with no self-hosted option published
• Its government offering holds high-assurance federal authorisation achieved in March 2023 against more than 420 controls
• A defence impact level authorisation was achieved in May 2021, and those environments were out of scope of the 2023 incident
• The architecture is cell-based, but no current authoritative list of cells or data regions is published
• Pricing is per user per month for suites, resource units for privileged access and active users for customer identity

Pricing

SubscriptionFrom $6 per user per month, 1500 USD annual minimum

Genuinely published, unusually for this category, but only at suite level. Workforce suites list at $6, $14 and $17 per user per month billed annually, with the top two tiers quote-only, and a $1,500 annual contract minimum. Every add-on is priced on request, including governance, lifecycle management, privileged access, threat protection, posture management and the agent product. Customer identity publishes a $3,000 monthly platform fee with the suites above it quote-only. A 30-day workforce trial is published, and a developer plan for ten monthly active users that does not expire.

Vendor pricing page →

Demos and videos

• Okta Identity Governance product demo Product demo · YouTube
• How entitlement management works Tutorial · YouTube
• Preconfigured access review campaigns Product demo · YouTube

About Okta

Okta was founded in 2009 by Todd McKinnon and Frederic Kerrest, who describe themselves as having created the identity-as-a-service category, and it is headquartered in San Francisco with offices in fifteen countries. It is public on Nasdaq as OKTA, with a fiscal year ending in January. For the quarter to July 2026 it reported total revenue of $805m, up 11% year on year, with subscription revenue of $793m, remaining performance obligations of $4.86bn and free cash flow at 28% of revenue, guiding to $3.22bn for the full year. It reports more than 20,000 customers including two-thirds of the Fortune 100. Its published acquisitions are Axiom Security, closed September 2025, and Permiso Security, closed August 2026; the Auth0 deal terms are not on a current first-party page.

Founded 2009 · San Francisco, California · okta.com