Okta — Architecture Overview

Summary

Okta is the organization's central identity provider (IdP), handling single sign-on (SSO), multi-factor authentication (MFA), and lifecycle provisioning/deprovisioning across connected applications.

Architecture Diagram

flowchart TD
    user[User] --> okta[Okta]
    okta -->|SAML / OIDC| m365[Microsoft 365]
    okta -->|SAML / OIDC| zscaler[Zscaler]
    okta -->|SAML / OIDC| crowdstrike[CrowdStrike Console]
    okta -->|SCIM Provisioning| hris[HRIS<br/>Source of Truth]

    okta --> mfa[MFA Challenge]
    mfa --> okta

Components

Component	Role
Okta	Central IdP — authentication, SSO, MFA enforcement
HRIS	System of record; drives automated provisioning/deprovisioning via SCIM
Connected Apps	Any app federated via SAML or OIDC (M365, Zscaler, CrowdStrike console, etc.)
MFA	Enforced at login via push notification, TOTP, or FIDO2 key depending on policy

Authentication Flow

1. User navigates to a connected app or the Okta dashboard.
2. App redirects to Okta for authentication (SAML/OIDC).
3. Okta prompts for credentials + MFA challenge.
4. On success, Okta issues a token/assertion back to the app, granting access.
5. Lifecycle events (new hire, role change, termination) flow from HRIS into Okta via SCIM, automatically provisioning or revoking access across all connected apps.

Related

• Runbooks