# Okta MCP for AI Agents AI Agent Connect > Okta MCP lets your AI agent manage users, groups, and authentication in your Okta Identity Cloud without you having to click through a dashboard. ## Overview - **Category:** industry-titans - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_DJcfQxMpslN5RaSwntHvGXz3VHnAhxE3QnKoSlfk/ai-agent-connect - **Tags:** authentication, user-provisioning, sso, identity-management, access-control, security-policy ## Description Okta MCP connects your AI agent directly to your identity cloud so you can handle user management through simple conversation. Instead of hunting through complex administrative menus to find a locked account or manually assigning a new hire to a dozen different groups, you just tell your agent what needs to happen. It handles the heavy lifting of provisioning identities, revoking access for departing employees, and auditing your current app integrations. You can ask it to pull a list of everyone in a specific department or check the sign-in logs for a suspicious spike in activity. By adding this to your setup through the Vinkius catalog, you turn a multi-click administrative chore into a quick request. It is about getting the right people into the right systems without the friction of traditional dashboard navigation. You can quickly see which applications are mapped to your user base or check the specific SSO configurations for your core tools. If a device is stolen, you can tell your agent to kill all active sessions for that person immediately. It removes the need to keep multiple tabs open for basic identity tasks, letting you focus on higher level security strategy instead of manual data entry. You can also use it to see which users were automatically granted licenses through directory mapping. This means you spend less time on the "how" of identity and more time on the "who" of your organization. ## Tools ### clear_user_sessions Terminate all active login sessions for a specific user. This is necessary to protect data if a device is compromised or stolen. ### deactivate_user Instantly convert a user status to deprovisioned and revoke all active sessions. Use this for emergency offboarding to block all future app access. ### get_group View the details of a specific Okta group. This helps you see who is part of a group and what permissions they have. ### get_user Get a detailed profile and state for a specific Okta user. Use this to check a user's account status or department mapping. ### get_app View the detailed SSO configuration for a specific application. This includes security bindings, secrets, and token lifespans. ### list_groups List all security, app, and dynamic Okta groups. Use this to audit permissions and see how users are organized. ### list_users List all users configured in your Okta Universal Directory. This is useful for organization-wide identity reporting. ### list_system_logs Retrieve the most recent 100 Okta system and audit log events. This helps you identify malicious password spraying or configuration tweaks. ### list_apps List all applications integrated within your Okta dashboard. Use this to identify all OIDC, SAML, and SCIM connections. ### list_group_users List all users currently assigned to an Okta group. Use this to see exactly who was granted licenses or access via directory mapping. ## Prompt Examples **Prompt:** ``` Retrieve the user profile for 'mark@example.com'. ``` **Response:** ``` I found the profile for ID `00u12xxxxxxx`: Mark Johnson. The account status is currently **ACTIVE** and mapped to the 'Engineering' department. Would you like to check his group associations? ``` **Prompt:** ``` Clear all active sessions for user 'mike@example.com' immediately. ``` **Response:** ``` Success. I've sent the termination command to Okta. **All active sessions for `mike@example.com` have been cleared and closed**, forcing a re-login for any connected service. ``` **Prompt:** ``` List all active application mappings for the 'Contractors' group. ``` **Response:** ``` Scanning Group mapping ID `00xxxx` ('Contractors'): I found 3 provisioned apps tied to this cohort: * **Slack** (Provisioning Active) * **Atlassian Jira Server** (SAML) * **Zoom** (SAML) Do you want me to revoke any permissions immediately? ``` ## Capabilities ### Provision new identities Create new user accounts and assign them to the correct departments instantly. ### Revoke user access Deprovision employees and kill all active sessions to secure company data. ### Terminate active sessions Force a logout for any user across all connected applications from a single command. ### Audit group memberships Query which users belong to specific security or application groups. ### Review application configs Check SSO bindings, secrets, and token lifespans for your integrated apps. ### Monitor sign-in logs Retrieve recent audit events to spot malicious activity or configuration changes. ### List all directory users Get a complete list of everyone in your Okta Universal Directory for reporting. ## Use Cases ### Emergency session termination A laptop is stolen and you need to kill all sessions immediately. The agent uses `clear_user_sessions` to lock down the account and protect company data. ### Automated new hire onboarding A new employee joins and needs access to the Engineering group. The agent uses `list_group_users` and `get_group` to verify permissions and assign access. ### Security audit of a specific app You need to audit who has access to Jira. The agent uses `list_apps` and `list_groups` to identify all users with relevant permissions. ### Rapid user status verification An admin needs to see if a specific user is still active. The agent uses `get_user` to pull the profile and status in one second. ## Benefits - Shut down compromised accounts instantly with `deactivate_user` to stop unauthorized access before it causes damage. - Kill all active sessions for a user with `clear_user_sessions` when a laptop or phone goes missing. - Audit your entire app footprint by using `list_apps` to see every OIDC, SAML, and SCIM connection in one place. - Identify permission gaps quickly by using `list_groups` to see exactly how your security and dynamic groups are organized. - Verify specific user statuses and profile details using `get_user` without having to search through a large directory manually. - Monitor security events in real-time by pulling recent logs with `list_system_logs` to spot suspicious activity. ## How It Works The bottom line is you get a conversational interface for your entire Okta identity directory. 1. Subscribe to the Okta MCP via the Vinkius catalog. 2. Provide your Okta domain and organizational API Key. 3. Ask your agent to perform tasks like 'block user X' or 'list all admins'. ## Frequently Asked Questions **How can Okta MCP help my helpdesk team?** It lets your team handle 'I'm locked out' tickets via chat. Your agent can quickly reset credentials or clear sessions without the tech needing to open the Okta dashboard. **Can I use Okta MCP to offboard employees?** Yes, it can instantly deactivate users and kill all active sessions. This ensures that access is revoked across all integrated apps the moment an employee leaves. **Does Okta MCP work with my existing apps?** It manages the Okta integrations for your apps. If your apps are connected to Okta via SAML, OIDC, or SCIM, your agent can manage those permissions. **Is Okta MCP safe for security audits?** It's a great tool for audits because it can pull system logs and group memberships. You can quickly see who has access to what and spot any suspicious sign-in attempts. **How do I connect Okta MCP to my AI agent?** You subscribe to the Connector via the Vinkius catalog and provide your Okta domain and API Key. From there, your agent can start performing identity tasks for you. **Where do I retrieve my Okta Domain and API Token?** Log in to your Okta Admin Console. The Okta domain is simply the URL you use (e.g., `company.okta.com`). To get the API Key, navigate to **Security** -> **API**, then select the **Tokens** tab. Click **Create Token**, assign it a name, and securely copy the generated string. **Can the agent clear active sessions for a compromised user?** Yes! If you suspect an ongoing security incident, you can promptly ask the agent to clear user sessions (`clear_user_sessions`) by simply stating the user's ID or email. The integration talks back to Okta and terminates persistent connections instantaneously. **Is the administrator API key shared globally with anyone else?** No, your setup is extremely private and BYOC (Bring Your Own Credentials). The token is entered locally inside your private environment or workspace instance and injected tightly and exclusively into your isolated runtime execution. It is never exposed publically.