> For the complete documentation index, see [llms.txt](https://docs.natoma.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.natoma.ai/apps/okta-natoma.md).

# Okta (Natoma)

**Type:** Official

**Source Type:** Repository

**Source:** Natoma Remote Hosted

**Description:** The Okta MCP server enables AI assistants to interact with your Okta organization using natural language. It provides capabilities for user and group management, application administration, policy configuration, system log access, and brand customization for enterprise identity workflows.

**Prerequisites:**

* An Okta Admin Console account with permission to create app integrations
* A Natoma account with Admin or App Admin permissions

## Setup Steps

### Step 1: Create an App Integration in Okta

1. Log in to your Okta Admin Console.
2. Navigate to **Applications → Applications** and click **Create App Integration**.
3. Select **OIDC – Web Application**.
4. Name your application **"Okta MCP"**.
5. Check the box for **Client Credentials**.
6. Under **Sign-on Redirect URIs**, enter the Natoma callback URL:

   ```
   https://api.natoma.app/mcp/server/callback
   ```
7. Save the redirect URI.
8. Go to the **Okta API Scopes** tab and click **Grant** next to each scope your use case requires (see the scopes table below).
9. From the app's **General** tab, copy the **Client ID** and **Client Secret**.

### Step 2: Connect Okta to Natoma

1. In Natoma, navigate to **Apps** and find **Okta (Natoma)**.
2. Click **'...'** → **Allow Personal Connections**.
3. In the drawer that appears, enter your **Org URL**, **Client ID**, and **Client Secret**.

   > Scopes are not required here — the Okta app handles scope selection.
4. Click **Enable**.
5. Click **Test Connection**, then **Save**.

Admin setup is complete. Users will be able to establish personal connections at this point.

***

## Scopes and Relevant Tools

| Scope                  | Required By                                                                                                                                                                                                   |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `okta.users.read`      | `list_users`, `get_user`                                                                                                                                                                                      |
| `okta.users.manage`    | `create_user`, `update_user`, `deactivate_user`, `delete_deactivated_user`                                                                                                                                    |
| `okta.groups.read`     | `list_groups`, `get_group`, `list_group_users`, `list_group_apps`                                                                                                                                             |
| `okta.groups.manage`   | `create_group`, `update_group`, `delete_group`, `add_user_to_group`, `remove_user_from_group`                                                                                                                 |
| `okta.apps.read`       | `list_applications`, `get_application`                                                                                                                                                                        |
| `okta.apps.manage`     | `create_application`, `update_application`, `activate_application`, `deactivate_application`, `delete_application`                                                                                            |
| `okta.policies.read`   | `list_policies`, `get_policy`, `list_policy_rules`, `get_policy_rule`                                                                                                                                         |
| `okta.policies.manage` | `create_policy`, `update_policy`, `delete_policy`, `activate_policy`, `deactivate_policy`, `create_policy_rule`, `update_policy_rule`, `delete_policy_rule`, `activate_policy_rule`, `deactivate_policy_rule` |
| `okta.logs.read`       | `get_logs`                                                                                                                                                                                                    |