MCP Store

Okta MCP Server

Okta MCP server

Connect the Okta MCP server

Connect the Okta MCP server to Atomicwork to enable secure, agentic administrative actions.

Connecting the Okta MCP (Model Context Protocol) server to Atomicwork allows your AI Workforce, workflow builder, and coding agents to securely execute administrative actions in Okta. Once connected, your AI coworkers can autonomously manage users, groups, applications, and security policies within the precise boundaries you define.

[!NOTE] Note: This integration is specifically for the Okta MCP server, which enables agentic actions and workflows. If you need to sync employee attributes or run standard IT workflows, please connect the standard Okta integration instead. See Okta: Permissions and setup.

Before you begin

To set up the Okta MCP server, make sure you have the following permissions and information:

Atomicwork admin access: You must have organization administrator permissions in Atomicwork to access the MCP Store.
Okta admin access: You must have administrator permissions in Okta to create an API Services application and assign admin roles.
Okta Org URL: Your Okta organization URL (e.g., https://atomicwork.okta.com). Do not include -admin or a trailing slash.

Connect the Okta MCP server

Setting up the Okta MCP server involves creating an API Services app integration in Okta, configuring key-based authentication, and connecting it to Atomicwork. Follow these steps to complete the setup:

Create the App Integration in Okta: Log in to your Okta admin console, navigate to Applications > Applications, and click Create App Integration. Select API Services, click Next, name the application atomicwork-mcp, and click Save.
Switch to key-based authentication: On your new app's General tab, locate the Client Credentials panel and click Edit. Select Public key / Private key, and leave the panel in edit mode.
Generate and save the private key: Scroll down to the Public keys section, click Edit, and click Add. In the dialog, click Generate new key. Copy the JSON payload from the black text box and save it securely—this is the Private Key (JWK) you will paste into Atomicwork. Click Save.
Confirm the key is active: Verify that the row in the Public keys section shows Status: Active and Key use: sig.
Save Client Credentials: Return to the Client Credentials panel and click Save.
Disable DPoP: In the General Settings panel, click Edit. Uncheck Require Demonstrating Proof of Possession (DPoP) header in token requests and click Save.
Assign an Admin role to the app: Go to the Admin roles tab of the app. Assign the role that matches the actions you want the Okta MCP server to perform (e.g., Application Administrator, or a custom read-only role to limit access). This role authorizes the app's actions in your Okta organization.
Grant Okta API scopes: Go to the Okta API Scopes tab and grant the scopes that match the tools you want Atomicwork to use (e.g., read-only directory lookups or write access to users and groups). Narrower scopes limit the tool capabilities on the Atomicwork side.
Connect in Atomicwork: In Atomicwork, navigate to Settings > MCP Store > Okta. Click the Okta tile, then click Connect. Enter your Org URL, paste the Private Key (JWK) JSON you saved in Step 3, and in the Scopes box, enter the scopes you granted in Okta in Step 8 as a comma-separated list (e.g., okta.users.read, okta.groups.manage). Then complete the setup.

Managing Okta tool access

Once the setup is complete, you can control which tools your AI Coworkers can access. To configure tool access:

Navigate to AI Workforce > AI Coworker > Tools.
Select your AI Coworker from the list.
Grant granular or complete access to the available Okta tools based on your workspace requirements.

Available Okta MCP tools

The Okta MCP server provides a wide range of tools grouped by category. These tools allow your AI Coworkers to retrieve information and execute tasks across your Okta org:

Users: Tools like list_users, get_user, create_user, deactivate_user, and export_users_csv let agents search and retrieve users, create accounts (with immediate or staged activation), deactivate and delete users, and export the full directory to CSV (destructive actions require confirmation).
Groups: Tools like list_groups, create_group, add_user_to_group, remove_user_from_group, and list_group_users manage groups and their membership, and surface which applications a group is assigned (deleting a group requires confirmation).
Applications: Tools like list_applications, get_application, create_application, update_application, and activate_application / deactivate_application let your AI Coworkers browse and manage app integrations and toggle their status (deleting an app requires confirmation).
Policies and Rules: Tools like list_policies, get_policy, create_policy, create_policy_rule, and activate_policy / deactivate_policy browse and manage sign-on, password, MFA-enrollment, and access policies and their rules (destructive actions require confirmation).
Device Assurance: Tools like list_device_assurance_policies, get_device_assurance_policy, create_device_assurance_policy, and replace_device_assurance_policy audit and manage device-compliance requirements such as minimum OS version, disk encryption, biometrics, and jailbreak/root detection across platforms (destructive actions require confirmation).
Branding and Themes: Tools like list_brands, get_brand, replace_brand, get_brand_theme, and replace_brand_theme manage brands and the theme colors, logos, favicons, and background images that control the sign-in experience.
Sign-in, Sign-out, and Error Pages: Tools like get_customized_sign_in_page, replace_customized_sign_in_page, list_sign_in_widget_versions, replace_customized_error_page, and replace_sign_out_page_settings customize, preview, and publish the hosted sign-in, error, and sign-out pages.
Email Templates and Customizations: Tools like list_email_templates, create_email_customization, replace_email_settings, send_test_email, and get_email_customization_preview manage localized email content, recipient settings, and test sends (destructive actions require confirmation).
Email and Custom Domains: Tools like list_email_domains, create_email_domain, list_custom_domains, create_custom_domain, and replace_custom_domain set up and manage branded sending domains and custom sign-in domains, including the DNS records needed for validation (deleting a domain requires confirmation).
System Logs and Troubleshooting: Tools like get_logs and get_login_failures query the Okta System Log and investigate sign-in problems, returning both authentication failures and policy-blocked sign-ins to explain why a user couldn't log in.

Next steps

Now that you have connected the Okta MCP server, explore how to configure your AI coworkers and workflows to use these tools:

Setting up an AI Coworker — Learn how to assign tools and set up guardrails for your AI coworkers.
Connect the JumpCloud MCP server — Learn how to connect other identity provider MCP servers to your workspace.
Connect the Cloudflare MCP server — Explore connecting other service-principal-style MCP integrations.

Connect the Okta MCP server

Connect the Okta MCP server to Atomicwork to enable secure, agentic administrative actions.

[!NOTE] Note: This integration is specifically for the Okta MCP server, which enables agentic actions and workflows. If you need to sync employee attributes or run standard IT workflows, please connect the standard Okta integration instead. See Okta: Permissions and setup.

Before you begin

To set up the Okta MCP server, make sure you have the following permissions and information:

Atomicwork admin access: You must have organization administrator permissions in Atomicwork to access the MCP Store.

Okta admin access: You must have administrator permissions in Okta to create an API Services application and assign admin roles.

Okta Org URL: Your Okta organization URL (e.g., https://atomicwork.okta.com). Do not include -admin or a trailing slash.

Connect the Okta MCP server

Create the App Integration in Okta: Log in to your Okta admin console, navigate to Applications > Applications, and click Create App Integration. Select API Services, click Next, name the application atomicwork-mcp, and click Save.

Switch to key-based authentication: On your new app's General tab, locate the Client Credentials panel and click Edit. Select Public key / Private key, and leave the panel in edit mode.

Generate and save the private key: Scroll down to the Public keys section, click Edit, and click Add. In the dialog, click Generate new key. Copy the JSON payload from the black text box and save it securely—this is the Private Key (JWK) you will paste into Atomicwork. Click Save.

Confirm the key is active: Verify that the row in the Public keys section shows Status: Active and Key use: sig.

Save Client Credentials: Return to the Client Credentials panel and click Save.

Disable DPoP: In the General Settings panel, click Edit. Uncheck Require Demonstrating Proof of Possession (DPoP) header in token requests and click Save.

Assign an Admin role to the app: Go to the Admin roles tab of the app. Assign the role that matches the actions you want the Okta MCP server to perform (e.g., Application Administrator, or a custom read-only role to limit access). This role authorizes the app's actions in your Okta organization.

Grant Okta API scopes: Go to the Okta API Scopes tab and grant the scopes that match the tools you want Atomicwork to use (e.g., read-only directory lookups or write access to users and groups). Narrower scopes limit the tool capabilities on the Atomicwork side.

Connect in Atomicwork: In Atomicwork, navigate to Settings > MCP Store > Okta. Click the Okta tile, then click Connect. Enter your Org URL, paste the Private Key (JWK) JSON you saved in Step 3, and in the Scopes box, enter the scopes you granted in Okta in Step 8 as a comma-separated list (e.g., okta.users.read, okta.groups.manage). Then complete the setup.

Managing Okta tool access

Once the setup is complete, you can control which tools your AI Coworkers can access. To configure tool access:

Navigate to AI Workforce > AI Coworker > Tools.

Select your AI Coworker from the list.

Grant granular or complete access to the available Okta tools based on your workspace requirements.

Available Okta MCP tools

The Okta MCP server provides a wide range of tools grouped by category. These tools allow your AI Coworkers to retrieve information and execute tasks across your Okta org:

Users: Tools like list_users, get_user, create_user, deactivate_user, and export_users_csv let agents search and retrieve users, create accounts (with immediate or staged activation), deactivate and delete users, and export the full directory to CSV (destructive actions require confirmation).

Groups: Tools like list_groups, create_group, add_user_to_group, remove_user_from_group, and list_group_users manage groups and their membership, and surface which applications a group is assigned (deleting a group requires confirmation).

Applications: Tools like list_applications, get_application, create_application, update_application, and activate_application / deactivate_application let your AI Coworkers browse and manage app integrations and toggle their status (deleting an app requires confirmation).

Policies and Rules: Tools like list_policies, get_policy, create_policy, create_policy_rule, and activate_policy / deactivate_policy browse and manage sign-on, password, MFA-enrollment, and access policies and their rules (destructive actions require confirmation).

Device Assurance: Tools like list_device_assurance_policies, get_device_assurance_policy, create_device_assurance_policy, and replace_device_assurance_policy audit and manage device-compliance requirements such as minimum OS version, disk encryption, biometrics, and jailbreak/root detection across platforms (destructive actions require confirmation).

Branding and Themes: Tools like list_brands, get_brand, replace_brand, get_brand_theme, and replace_brand_theme manage brands and the theme colors, logos, favicons, and background images that control the sign-in experience.

Sign-in, Sign-out, and Error Pages: Tools like get_customized_sign_in_page, replace_customized_sign_in_page, list_sign_in_widget_versions, replace_customized_error_page, and replace_sign_out_page_settings customize, preview, and publish the hosted sign-in, error, and sign-out pages.

Email Templates and Customizations: Tools like list_email_templates, create_email_customization, replace_email_settings, send_test_email, and get_email_customization_preview manage localized email content, recipient settings, and test sends (destructive actions require confirmation).

Email and Custom Domains: Tools like list_email_domains, create_email_domain, list_custom_domains, create_custom_domain, and replace_custom_domain set up and manage branded sending domains and custom sign-in domains, including the DNS records needed for validation (deleting a domain requires confirmation).

System Logs and Troubleshooting: Tools like get_logs and get_login_failures query the Okta System Log and investigate sign-in problems, returning both authentication failures and policy-blocked sign-ins to explain why a user couldn't log in.

Next steps

Now that you have connected the Okta MCP server, explore how to configure your AI coworkers and workflows to use these tools:

Setting up an AI Coworker — Learn how to assign tools and set up guardrails for your AI coworkers.

Connect the JumpCloud MCP server — Learn how to connect other identity provider MCP servers to your workspace.

Connect the Cloudflare MCP server — Explore connecting other service-principal-style MCP integrations.