Okta for License Logic Setup Guide

Overview

The Okta integration connects your organization's Okta identity platform to License Logic, enabling automatic synchronization of your employee directory, SSO application assignments, and sign-in activity. This gives your IT team complete visibility into who is using what software, how often, and whether those licenses are being fully utilized.

Key Benefits

• Automated employee directory sync — Employee names, emails, departments, and job titles sync daily with no manual imports required
• SSO application discovery — See every application assigned to employees through Okta SSO, including apps you may not know about
• Sign-in activity tracking — Know when each employee last used each application to identify unused licenses
• Shadow IT detection — Discover applications employees are accessing that aren't covered by a contract
• License optimization — Compare assigned licenses against actual usage to eliminate waste

Prerequisites

Before you begin, make sure you have both a License Logic account and an Okta account with the correct permissions.

License Logic Requirements

• Account: Active License Logic subscription
• Role: Admin or Manager role (viewers cannot manage integrations)
• Page: Access to Integrations from the left sidebar

Okta Requirements

• Account: Active Okta organization (any Okta plan)
• Role: Super Admin or Organization Admin in your Okta org
• Permissions: Ability to create API tokens (Security → API → Tokens)

Note for multi-tenant Okta organizations: If your organization has multiple Okta tenants (e.g., separate orgs for subsidiaries or regions), each tenant must be connected separately. Each connection requires its own API token.

Setup Guide

Connecting Okta to License Logic takes about 2 minutes. There are two connection methods available — choose whichever your organization prefers.

Method 1: API Token (Recommended for Quick Setup)

Step 1: Create an API Token in Okta

1. Sign in to your Okta Admin Console (e.g., yourcompany-admin.okta.com)
2. Navigate to Security → API → Tokens
3. Click Create Token
4. Name the token (e.g., "License Logic Integration")
5. Click Create Token and copy the token value — you won't be able to see it again

Step 2: Connect in License Logic

1. In License Logic, click Integrations from the left sidebar
2. Find the Okta card and click Connect
3. Make sure the API Token tab is selected at the top of the modal
4. Enter your Okta Domain (e.g., yourcompany.okta.com)
5. Paste the API Token you created in Step 1
6. Click Connect

License Logic will verify your token and begin syncing immediately. The Okta card will show Connected within a few seconds.

Method 2: OAuth (For Organizations Requiring OAuth)

Step 1: Install License Logic in Okta

1. Sign in to your Okta Admin Console
2. Navigate to Security → API → API Service Integrations
3. Click Add API Service Integration
4. Search for License Logic and click Install
5. Okta will generate a Client ID and Client Secret — copy both

Step 2: Connect in License Logic

1. In License Logic, click Integrations from the left sidebar
2. Find the Okta card and click Connect
3. Switch to the OAuth tab at the top of the modal
4. Enter your Okta Domain, Client ID, and Client Secret
5. Click Connect

License Logic will exchange the credentials for an access token and begin syncing immediately.

Which method should I choose? API Token is simpler and faster to set up. OAuth provides more granular access control and is managed through Okta's admin console, making it easier to revoke or audit. Both methods provide read-only access to the same data.

What Data Is Synced

License Logic syncs the following data from your Okta organization:

Employee Directory

• Name — First name, last name, and display name
• Email — Primary email address and login
• Department — Department assignment (if configured in Okta)
• Job title — Employee's job title (if configured in Okta)
• Phone — Mobile phone number (if configured in Okta)
• Account status — Active, Staged, Suspended, or Deprovisioned
• Last login — When the employee last signed in to Okta

Application Assignments

• Application name — The name of each SSO application (e.g., Slack, Salesforce, Zoom)
• Assigned users — Which employees are assigned to each application
• Application status — Whether the application is active in your Okta org

Sign-In Activity

• SSO sign-in events — When employees sign in to applications through Okta SSO
• Last sign-in date — The most recent sign-in per employee per application
• Sign-in frequency — How many times each employee has signed in to each application

Data access is read-only. License Logic does not create, modify, or delete any data in your Okta organization. We only read user, application, and sign-in data for visibility and reporting.

Viewing Your Okta Data

Once connected, your Okta data appears across several areas in License Logic.

Applications Page

Okta SSO applications appear in the unified applications view alongside agent-detected and browser-detected apps. You'll see:

• Application name with the SSO source tag
• Total users — How many employees are assigned in Okta
• Contract status — Whether the app is linked to an existing contract
• Pacing — Whether you're over or under your licensed seats

Insights → Employee Tab

Okta employees appear in the Employee Overview with:

• Total applications — Combined count of SSO, agent, and browser-detected apps
• Contracted costs — License costs allocated to this employee
• Attributed spend — Ramp transaction spend attributed to this employee's apps

Click any employee to see their full application list, including which apps come from Okta SSO.

Vendors Page

Okta SSO applications are matched to vendors, giving you a complete picture of vendor usage across SSO, desktop agent, and browser data.

Sync Schedule & Refresh

Automatic Daily Sync

License Logic automatically syncs your Okta data once per day at 4:30 AM UTC. Employee directory changes, new application assignments, and sign-in activity are all pulled during each sync.

Initial Sync

When you first connect Okta, License Logic performs a full sync of all users, applications, and 14 days of sign-in history. This typically completes within 30 seconds to a few minutes, depending on the size of your organization.

What Triggers a Sync

• Initial connection — Immediately after clicking Connect
• Daily scheduled sync — Runs automatically at 4:30 AM UTC every day
• Reconnection — If you disconnect and reconnect, a full sync runs again

Tip: You can see when the most recent sync occurred on the Okta integration card under Integrations. The "Synced" date updates after each successful sync.

Disconnecting Okta

Warning: This action cannot be undone. Disconnecting Okta will permanently delete all synced employee, application, and sign-in data from License Logic. This data cannot be recovered. You can reconnect at any time to re-sync.

To disconnect:

1. Go to Integrations from the left sidebar
2. Find the Okta integration card (showing "Connected")
3. Click the menu icon (…) on the card
4. Select Disconnect
5. Confirm the disconnection in the dialog

After disconnecting:

• All synced Okta employees, application assignments, and sign-in data are permanently removed from License Logic
• Your Okta API token or OAuth credentials are deleted from our systems
• Other integrations (Entra ID, Ramp, desktop agent) are not affected
• You can reconnect at any time by clicking "Connect" again

Security & Data Handling

Authentication

License Logic supports two authentication methods for Okta:

• API Token — Your Okta admin creates a token in the Okta Admin Console. License Logic never sees your Okta username or password.
• OAuth 2.0 Client Credentials — Uses Okta's standard API Service Integration framework. Credentials are generated by Okta and scoped to specific permissions.

Both methods provide read-only access. License Logic cannot modify your Okta configuration.

Data in Transit

All communication between License Logic and Okta's API uses TLS 1.2+ encryption. Data is never transmitted in plaintext.

Data at Rest

• API tokens and OAuth credentials — Stored in AWS RDS (PostgreSQL), encrypted with AES-256-GCM using per-token random initialization vectors
• Employee and application data — Stored in AWS RDS (PostgreSQL), encrypted at rest via AWS RDS encryption

Access Control

• Only Admin and Manager users can connect or disconnect the Okta integration
• Viewer users can see synced data but cannot modify integration settings
• All API endpoints are authenticated via Clerk session management

Permissions Requested

License Logic requests the following read-only scopes from your Okta organization:

• okta.users.read — Sync employee directory (names, emails, departments, job titles)
• okta.apps.read — Discover SSO applications and user assignments
• okta.logs.read — Track sign-in activity for usage analytics
• okta.groups.read — Import group memberships for department and team mapping
• okta.devices.read — Read device profiles for device-to-employee mapping

No write access. License Logic cannot create, modify, or delete users, applications, groups, or any other data in your Okta organization. All scopes are read-only.

Data Retention

Employee and application data is retained in License Logic for as long as your integration is active. If you disconnect Okta, all synced data is permanently and immediately deleted. License Logic does not retain copies of your Okta data after disconnection.

Compliance

For more information about License Logic's security practices, please visit our Security Policy or contact security@licenselogic.co.

Troubleshooting

"Invalid API token" error when connecting

This means the token you entered could not be verified against your Okta org. Common causes:

• The token was copied incorrectly (missing characters at the start or end)
• The token has been revoked or deactivated in Okta
• The Okta domain doesn't match the org where the token was created

Create a new token in Security → API → Tokens and try again.

"Invalid OAuth credentials" error when connecting

This means the Client ID and/or Client Secret could not be used to obtain an access token. Verify:

• The Client ID and Client Secret were copied correctly from the Okta API Service Integration
• The License Logic integration is still active in your Okta admin console
• Your Okta domain matches the org where the integration was installed

Okta card shows "Connected" but no data appears

• The initial sync may still be in progress. Wait 2-3 minutes and refresh the page.
• Check the Synced timestamp on the integration card. If it shows a recent time, the sync completed successfully.
• Navigate to Applications or Insights → Employee to view your synced data.
• Applications with fewer than 2 users may not appear in the Applications view by default.

Connect button is disabled or Okta card is missing

The Okta integration may not yet be enabled for your organization. Contact support@licenselogic.co to request access.

API token expired or sync stopped working

Okta API tokens expire if not used for 30 consecutive days. License Logic's daily sync keeps the token active, but if syncing was interrupted for an extended period, the token may expire. To resolve:

1. Go to Integrations
2. Disconnect the Okta integration
3. Create a new API token in your Okta Admin Console
4. Reconnect with the new token

Missing employees or applications

• Staged users in Okta (not yet activated) will appear but may show as inactive
• Deactivated applications in Okta are not synced — only active applications appear
• If an employee was recently added to Okta, wait for the next daily sync or disconnect/reconnect to trigger an immediate sync

Frequently Asked Questions

Does License Logic modify any data in my Okta organization?

No. License Logic has read-only access. We never create, edit, or delete users, applications, groups, or any other data in your Okta organization.

How often does data sync?

Data syncs automatically once per day at 4:30 AM UTC. The initial sync happens immediately when you first connect.

Can I connect multiple Okta tenants?

Currently, License Logic supports one Okta tenant per organization. If you manage multiple Okta orgs (e.g., for subsidiaries), please contact support to discuss multi-tenant setup.

What happens to my data if I disconnect?

All synced employee, application, and sign-in data from Okta is permanently and immediately deleted from License Logic. No copies are retained. You can reconnect at any time to re-sync.

Do I need to keep my browser open for the sync to work?

No. Syncing happens on License Logic's servers in the background. Once you authorize the connection, syncing is fully automated.

I already have Microsoft Entra ID connected. Do I need Okta too?

It depends on your setup. If your organization uses Okta as the SSO provider for third-party apps (Salesforce, Slack, etc.) and Entra for the Microsoft 365 directory, connecting both gives you the most complete picture. Entra provides your employee directory and Microsoft app data, while Okta provides third-party SSO app usage. The data is merged automatically in License Logic.

Can I use both API Token and OAuth at the same time?

No. Each Okta connection uses one authentication method. You can switch by disconnecting and reconnecting with the other method.

Who at my company can see Okta data?

All authenticated License Logic users in your organization (Admin, Manager, and Viewer roles) can view synced employee and application data. Only Admins and Managers can manage the integration connection itself.

Is my Okta admin password shared with License Logic?

No. With the API Token method, you create a token in Okta's admin console — License Logic never sees your password. With OAuth, credentials are generated by Okta's integration framework. In neither case does License Logic have access to your Okta login credentials.

Can I revoke License Logic's access from Okta's side?

Yes. For API tokens, go to Security → API → Tokens and revoke the token. For OAuth, go to Security → API → API Service Integrations and remove License Logic. This will stop all data syncing. You should also disconnect from the License Logic side to clean up synced data.

Support

If you need help with the Okta integration, we're here to assist:

• Email: support@licenselogic.co
• In-app chat: Click the chat icon in the bottom-right corner of License Logic
• Security concerns: security@licenselogic.co

When contacting support, please include your company name, your Okta domain, and a description of the issue. Screenshots of any error messages are also helpful.