Overview

Connect Okta to Ravenna to provision users, sync groups and applications, and automate access request workflows through identity-driven automation.

Connect Okta to automate application access requests and user provisioning through Okta groups.

Sync Okta users, groups, and applications, then enable workflow actions to manage group memberships and provision application access.

What you can do

Access troubleshooting

Let an agent search the Okta System Log to explain a failed sign-in or a denied app

Group management

Add/remove users from Okta groups and check group memberships

Application access

Provision and deprovision application access automatically

Identity Governance sync

Sync OIG requestable access as access levels and file OIG requests from Ravenna

Workflow interpolation

Use Okta user metadata in workflow conditions and actions

Sync schedule

Ravenna runs a full sync on the cadence you set in Sync Interval. A full sync reads every user, group, and application in your Okta org, so it is the thorough but slow pass.

Incremental Sync Interval adds a lighter pass in between. An incremental sync asks Okta only for the users and groups that changed since the last run, so deactivations and group membership changes reach Ravenna in minutes rather than hours. It is off by default.

Turn on incremental sync

1. Open the Okta configuration

   Go to Settings > Integrations, click ⋯ on the Okta integration, then click Configure.

2. Set Incremental Sync Interval

   Choose Every 15 minutes, then save.

Turning it on queues a full sync, which starts on the next scheduled run. That pass establishes the baseline the first incremental sync compares against, so you do not wait for the next full sync to come due.

What incremental syncs cover

Incremental syncs cover users and groups: new, updated, and deactivated users, plus group profile and group membership changes. Workspace membership is reconciled for the groups that changed.

Applications and Identity Governance access levels sync on full passes only, so they keep the Sync Interval cadence.

When Ravenna runs a full sync instead

• Sync Interval has elapsed, so the next run is a full sync regardless of the incremental cadence.
• An unusually large batch of group changes arrives at once. A full sync handles that more cheaply than a delta would.
• The last full sync failed. Incremental syncs pause until a full sync succeeds, because a delta needs a known-good baseline to build on.
• You click Resync, which always runs a full sync.

Group sync

Ravenna syncs Okta groups and their membership so you can use them in access levels, workflow approvals, and forms. See Groups for how synced groups work.

Exclude app groups

Okta groups come in several types. App groups (type APP_GROUP) are groups that Okta imports from connected apps, including the target groups that Okta Group Push creates. These often duplicate your Okta groups. Include App Groups controls whether Ravenna syncs them. It is on by default.

1. Open the Okta configuration

   Go to Settings > Integrations, click ⋯ on the Okta integration, then click Configure.

2. Turn off Include App Groups

   Turn off Include App Groups, then save.

On the next sync, Ravenna stops syncing app groups and archives the app groups it already synced. Ravenna archives these groups instead of deleting them:

• Archived groups no longer appear in group pickers.
• Access levels, workflows, and forms that already reference an archived group keep working. The group displays as (Archived).
• Turning Include App Groups back on restores the archived groups on the next sync.

Exclude groups by profile attribute

Skip specific Okta groups based on an attribute in their Okta group profile, such as groups where access_service is true.

1. Open the Okta configuration

   Go to Settings > Integrations, click ⋯ on the Okta integration, then click Configure.

2. Add exclude conditions

   Under Exclude Groups, add a condition. Type the attribute’s variable name from the Okta group profile, choose is, is not, contains, or does not contain, and enter a value. Combine several conditions with AND or OR, then save.

Ravenna compares attribute values as text. On the next sync, Ravenna skips groups that match your conditions and archives matching groups it already synced, the same way it archives app groups.

User profile data

Ravenna syncs Okta user profiles for org hierarchy, approval workflows, and workflow interpolation.

Available fields

Field	Description
title	Job title
department	Department name
organization	Organization name
userType	User type classification
primaryPhone	Primary phone number
mobilePhone	Mobile phone number
city	City
state	State or region
countryCode	Country code
managerEmail	Custom Okta profile field for manager’s email address (checked first for manager relationships)
managerId	Manager’s email address or Okta user ID (checked second for manager relationships)
manager	Manager’s email address (checked last for manager relationships)
status	Okta account status, such as ACTIVE, SUSPENDED, or LOCKED_OUT
lastLogin	Date and time the user last signed in to Okta

status and lastLogin come from the Okta user account rather than the profile. You can use them in rules, agents, and workflows like any other field. Existing users get both fields on the next sync.

Ravenna checks managerEmail first, then managerId, then manager when establishing manager-employee relationships. Using email addresses ensures accurate matching across systems.

Auto-provisioning during sync

When Ravenna syncs users from Okta, any Okta user who doesn’t already have a matching Ravenna account is automatically added to your organization as a Member. This keeps your Ravenna directory in sync with Okta without manual user creation.

The managerEmail field is optional and requires a custom Okta profile field configuration. If your Okta organization uses a custom profile field for manager email addresses, configure it in your Okta admin console and ensure it’s named managerEmail.

Using profile data in workflows

Access these fields through the user’s Okta metadata when building workflow conditions or actions:

• Route approval requests based on department or organization
• Apply different access policies by user type
• Include contact information in notifications
• Build location-based access rules using city, state, or country
• Flag inactive accounts during access reviews using status or lastLogin