Okta Workforce Identity

As someone with a background in programming, I have enjoyed the API. Being able to leverage this has allowed me to perform tasks that prior admins in my org were unable to do, as well as replicate other features in Okta that didn't have an exact one-to-one function in the SKUs we use.

1.) I can build conditional access rules based on users, groups, device state, location, and risk level to tightly control who gets access and when. 2.) Integration with MDM/EMM tools lets me enforce access policies based on device compliance for our desktop and mobile devices. 3.) While it's not a full Data Loss Prevention (DLP) platform, Okta's app level policies, session controls and authentication help reduce data exposure by limiting access and enforcing security at the identity layer.

I would say that the Okta Single Sign-On (SSO) is the product's greatest strength. I have tried and tested numerous SSO in the past and I would say that this is just top of the line - very simple yet super effective. The key card that we were given is also very sleek - it doesn't stand out, it doesn't protrude or anything - it just blends in with your ID and becomes a part of it.

One difficulty with Okta is that there are policies that can end up conflicting with each other if care is not taken when configuring them. This becomes especially challenging when taking over the platform from another administrator. These conflicts are not immediately clear when policies and rules are not given unique names, which impacts the ability to troubleshoot. Another difficulty is that there is not a good way to do a mass reset of groups and group rules without also resetting the rest of the integration. Great care should be taken by the team that is deploying Okta to design the platform with the future in mind. Lastly, the logs take some time to get used to. It helps to have authentication policies and rules have specific, unique names so that you can look at exactly what rule, and what logic in the rule triggers it on a given user.

1.) The built in reports are basic and getting deeper insights requires APIs or exporting data to external tools. 2.) While the policy engine does feel powerful, I find creating and managing many conditional access rules becomes cumbersome and hard to track. 3.) Sometimes push notifications or biometric logins in Fail or require repeated retries. This can create friction for end users. And cause extra help desk support requests. More granular policy controls would help with this.

Setting it up takes some time - especially if your equipment at work is quite dated and your connection is not that good - yes, I know I'm from a third world country. But if you get past that set up stage, I think you should be set for at least a year or when you're asked to update your password. Kidding aside, do not forget your security details i.e. password and questions - Okta doesn't mess around.