Skip to main content
Connect Okta to automate application access requests and user provisioning through Okta groups. Sync Okta users, groups, and applications, then enable workflow actions to manage group memberships and provision application access.

​
What you can do

Access troubleshooting

Let an agent search the Okta System Log to explain a failed sign-in or a denied app

Group management

Add/remove users from Okta groups and check group memberships

Application access

Provision and deprovision application access automatically

Identity Governance sync

Sync OIG requestable access as access levels and file OIG requests from Ravenna

Workflow interpolation

Use Okta user metadata in workflow conditions and actions

​
Group sync

Ravenna syncs Okta groups and their membership so you can use them in access levels, workflow approvals, and forms. See Groups for how synced groups work.

​
Exclude app groups

Okta groups come in several types. App groups (type APP_GROUP) are groups that Okta imports from connected apps, including the target groups that Okta Group Push creates. These often duplicate your Okta groups. Include App Groups controls whether Ravenna syncs them. It is on by default.
1

Open the Okta configuration

Go to Settings > Integrations, click ⋯ on the Okta integration, then click Configure.
2

Turn off Include App Groups

Turn off Include App Groups, then save.
On the next sync, Ravenna stops syncing app groups and archives the app groups it already synced. Ravenna archives these groups instead of deleting them:
  • Archived groups no longer appear in group pickers.
  • Access levels, workflows, and forms that already reference an archived group keep working. The group displays as (Archived).
  • Turning Include App Groups back on restores the archived groups on the next sync.

​
User profile data

Ravenna syncs Okta user profiles for org hierarchy, approval workflows, and workflow interpolation.

​
Available fields

Ravenna checks managerEmail first, then managerId, then manager when establishing manager-employee relationships. Using email addresses ensures accurate matching across systems.

​
Auto-provisioning during sync

When Ravenna syncs users from Okta, any Okta user who doesn’t already have a matching Ravenna account is automatically added to your organization as a Member. This keeps your Ravenna directory in sync with Okta without manual user creation.
The managerEmail field is optional and requires a custom Okta profile field configuration. If your Okta organization uses a custom profile field for manager email addresses, configure it in your Okta admin console and ensure it’s named managerEmail.

​
Using profile data in workflows

Access these fields through the user’s Okta metadata when building workflow conditions or actions:
  • Route approval requests based on department or organization
  • Apply different access policies by user type
  • Include contact information in notifications
  • Build location-based access rules using city, state, or country
Last modified on October 9, 2026