> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-iam-security/integrate-prisma-cloud-with-okta.md).

# Integrate Prisma Cloud with Okta

Prisma Cloud integrates with the identity provider (IdP) service known as Okta to ingest single sign-on (SSO) data for the effective permissions calculation in the IAM Security module. After the integration, you will be able to list the effective permissions of your Okta users across your cloud accounts by using the IAM query and gain better visibility and governance into the entities accessing your cloud resources.

* Okta integration is only available with a subscription of the IAM Security module. [Learn how to get a 30-day free trial.](/content-collections/administration/configure-iam-security/enable-iam-security.md#id0561b362-921c-4e65-baaf-39a37c78e744)
* For AWS, Prisma Cloud supports a 1:1 mapping between the Okta app and your AWS account. If you have onboarded more than one AWS account on Prisma Cloud, you must create additional instances of the Okta app and generate API keys for each AWS account for which you want to ingest single sign-on (SSO) data.

1. Log in to your Okta administrator panel.
   1. Access your Okta tenant.

      The typical URL is the tenant name as a sub domain followed by userinput:\[okta.com] . For example: userinput:\[companyname.okta.com] .
   2. Enter your **username** and **password** and **Sign In**.
   3. Check that you are on the **Classic UI** view.

      <figure><img src="/files/Dv8Ul4bbPUzrmCM2L63f" alt="okta admin panel"><figcaption></figcaption></figure>
2. Add an administrator role.
   1. From the top menu navigate to **Security > Administrators**.
   2. Click **Add Administrator**.

      <figure><img src="/files/L1NC0O1zuExri9L6TJPf" alt="generate api token"><figcaption></figcaption></figure>
   3. Select your user under the **Grant administrator role to** field.

      <figure><img src="/files/DhAumCpmfKFqI5RDRdgF" alt="read only admin"><figcaption></figcaption></figure>
   4. Select **Read Only Administrator** under the **Administrator roles** section.
   5. Click **Add Administrator**.
3. Generate an API token.

   API tokens are unique identifiers that are used to authenticate requests to the Okta API—they’re needed to connect your Prisma Cloud account to Okta so that Prisma Cloud can ingest the SSO data.

   1. From the top menu navigate to **Security > API**.
   2. Select **Tokens.**
   3. Click **Create Token** and under **Grant administrator role** select your user.
   4. Enter a name for your token and click **Create Token**.
   5. Upon successful completion the message **Token created successfully** will display, along with a generated token that is associated with the current user.

      <figure><img src="/files/5BumjesaIGpQMV88V9LR" alt="create token sucessfully"><figcaption></figcaption></figure>
4. Configure Okta with Prisma Cloud.

   After you generate the API token, you can use it to connect your Prisma Cloud account to Okta.

   1. In Prisma Cloud navigate to **Settings > Integrations**.
   2. Click **+Add New**.
   3. Click **Integration Type** and select **Okta**.

      <figure><img src="/files/bJ5elM99idbU5qxUd2ox" alt="iam security add integration"><figcaption></figcaption></figure>
   4. Enter your **Description**.
   5. Enter your **Domain**.
   6. Enter your **API Token**.
   7. Click **Test** to verify that the integration was successful.
   8. Click **Save**.

      <figure><img src="/files/FTq81GBGnNBN2tAaTPw1" alt="okta integration success"><figcaption></figcaption></figure>
5. Run the IAM queries for Okta.

   After Okta is integrated with Prisma Cloud, you will now be able to see the results of the IAM queries for Okta and gain visibility and governance into your cloud environment.

   1. View all the RQL attributes for Okta.

      Enter the following RQL query on the **Investigate** tab.

      `config from iam where source.idp`

      <figure><img src="/files/j7rUdSXxAoJOfOGMVz2D" alt="iam security source idp"><figcaption></figcaption></figure>
   2. Use auto complete to build your idp RQL query.

      Select the attribute that you want to add to your RQL query. For example, if you select userinput:\[source.idp.username], then the results will return all the Okta users in your cloud environment.
   3. View the results.

      Click the magnifying glass icon to render the results.

      <figure><img src="/files/u4n7NxDhq9pmyVEEUUed" alt="iam security okta demo"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/configure-iam-security/integrate-prisma-cloud-with-okta.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.