managing-cloud-identity-with-okta

name	managing-cloud-identity-with-okta
description	Implement Okta as a centralized cloud identity provider: configure SSO with AWS, Azure, and GCP, deploy phishing-resistant MFA with Okta FastPass, automate user provisioning/deprovisioning, and enforce adaptive access policies on device posture and risk signals. Use when standing up Okta SSO, rolling out FastPass MFA, automating identity lifecycle, or building risk-based conditional access for cloud environments.
domain	cybersecurity
subdomain	cloud-security
tags	["okta","cloud-identity","single-sign-on","phishing-resistant-mfa","identity-lifecycle"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1537","T1580","T1566"]
mitre_f3	{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1110.004","name":"Brute Force: Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1110.003","name":"Brute Force: Password Spraying","tactic":"initial-access","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"}]}

Managing Cloud Identity with Okta

When to Use

• When centralizing authentication across AWS, Azure, and GCP console access through a single identity provider
• When implementing phishing-resistant MFA to replace SMS or TOTP-based authentication
• When automating user provisioning and deprovisioning across cloud platforms and SaaS applications
• When enforcing adaptive access policies based on device compliance, user risk, and network context
• When auditing identity-related security controls for SOC 2 or zero trust compliance

Do not use for cloud-native identity management without external IdP requirements (use AWS IAM Identity Center or Azure AD natively), for application-level authorization logic, or for secrets management (see implementing-secrets-management-with-vault).

Prerequisites

• Okta organization with admin console access and appropriate license tier (Workforce Identity)
• AWS, Azure, and GCP accounts configured for SAML or OIDC federation
• Okta Universal Directory populated with user identities synced from HR system or Active Directory
• Device management platform (Intune, Jamf) for device trust integration

Workflow

Step 1: Configure SSO Integration with Cloud Providers

Set up SAML 2.0 or OIDC federation between Okta and each cloud provider console for centralized authentication.

Okta AWS SSO Integration (SAML 2.0):
1. In Okta Admin Console: Applications > Add Application > AWS Account Federation
2. Configure SAML settings:
   - Single Sign-On URL: https://signin.aws.amazon.com/saml
   - Audience URI: urn:amazon:webservices
   - Attribute Statements:
     - https://aws.amazon.com/SAML/Attributes/RoleSessionName -> user.email
     - https://aws.amazon.com/SAML/Attributes/Role -> appuser.awsRoles
3. Download Okta metadata XML
4. In AWS IAM: Create Identity Provider (SAML) with Okta metadata
5. Create IAM roles with trust policy referencing the Okta SAML provider

AWS IAM Trust Policy:
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "Federated": "arn:aws:iam::123456789012:saml-provider/Okta"
    },
    "Action": "sts:AssumeRoleWithSAML",
    "Condition": {
      "StringEquals": {
        "SAML:aud": "https://signin.aws.amazon.com/saml"
      }
    }
  }]
}

# Azure AD integration via OIDC
# Configure Okta as external IdP in Azure AD
az ad sp create --id <okta-app-client-id>

# GCP integration via Workforce Identity Federation
gcloud iam workforce-pools create okta-pool \
  --organization=123456789 \
  --location=global \
  --display-name=

gcloud iam workforce-pools providers create-oidc okta-provider \
  --workforce-pool=okta-pool \
  --location=global \
  --issuer-uri= \
  --client-id= \
  --attribute-mapping=