Okta
Discover which AI apps your users have authorized through Okta, with automatic AI classification.
Airia connects to your Okta org for identity-side Shadow AI visibility: it enumerates users and each user's OAuth application grants, surfacing which AI applications your users have authorized through your identity provider.
Okta is a Shadow AI connector, not an agent connector: it populates the connected-app (Shadow AI) inventory through the integration scan rather than adding entries to the agent inventory. A connection showing zero agents is expected and healthy.
Authentication model
An Okta API token (SSWS token) plus your org URL. An Okta API token inherits the permissions of the admin who creates it.
Required permissions
The token's admin must have read access to Users and Applications:
| What Airia reads | Okta requirement |
|---|---|
| List users | Admin role with read access to Users |
| List each user's application grants | Admin role with read access to Applications |
The built-in Read-Only Administrator role covers both and is the least-privilege choice. Create the token from a dedicated service admin account with that role so the access is auditable and survives personnel changes.
Customer-side setup steps
- Sign in to the Okta Admin Console as (or as an account with) Read-Only Administrator.
- Go to Security → API → Tokens → Create token, name it (for example
airia-discovery), and copy the value (shown once). - Copy your org URL (for example
https://yourcompany.okta.com). - In Airia, go to Discover → Connections → Okta and create a new connection.
Form fields the Airia UI asks for
| Field | Required | Notes |
|---|---|---|
| Org URL | Yes | https://<org>.okta.com |
| API token | Yes | Stored encrypted, masked on edit |
| Max users | No | Maximum users enumerated per refresh |
Connection test checks
The connection test validates in order: configuration completeness, authentication (a one-user list call), user read access, and grant read access. If the test reports a permission failure on grants, the token's admin role is missing Application read access.
Multiple environments
Multiple Okta connections per tenant are supported: one per Okta org.