Roles in Okta

Role assignment to principals grants them a specific set of access privileges. Principals can be users, groups of users, or client apps. When a role is assigned to a group, all members of the group automatically have the privileges granted by the role.

Roles can be one of the following types:

• Standard roles : Standard admin roles contain sets of predefined permissions to resources that are provided by default in your Okta org. See Standard administrator roles and permissions for a list of permissions included in each standard admin role.

  For standard role assignments, see the following principal-specific assignment APIs:

  • User role assignments
  • Group role assignments
  • Client role assignments
    
    
• Custom roles : You can create admin roles in your Okta org with specific permissions to access specific Okta resources .

  For custom role assignments, follow these steps:

  1. Create a custom role .
  2. Create a resource set .
  3. Create a resource set binding with your custom role.

IAM access to API resources

Okta recommends that you grant your principal (user, group, or client) least privilege access to API resources. To grant least privilege access, assign the principal a standard or custom admin role with minimal permissions.

The suggested standard admin roles and custom admin permissions are documented for some Okta API resource operations. For example, these admin roles and permissions are included in the Retrieve a user schema operation:

Admin roles: API_ACCESS_MANAGEMENT_ADMIN APP_ADMIN ORG_ADMIN

Permissions: okta.apps.manage

This indicates that you need to assign at least one of API_ACCESS_MANAGEMENT_ADMIN, APP_ADMIN, or ORG_ADMIN standard admin roles to your principal for them to access the operation for common use cases. Or if your principal is assigned a custom role, that custom role must include the okta.apps.manage permission for them to access the operation.

Standard roles

See Standard administrator roles and permissions for a list of permissions included in each standard admin role.

IAM-based standard roles

You can assign IAM-based standard roles. These roles are immutable. You can't update or delete them.

Permissions

For custom roles, permissions allow the principal to perform tasks and access resources.

For a more detailed catalog of all available permissions, see Permissions.

Permissions conditions

You can also add conditions to certain permissions. These conditions modify which attributes an admin with a custom role can create, see, or edit in a user profile. See Permission conditions.

You can add conditions if the custom admin role has one of the following permissions:

• okta.users.manage
• okta.users.read

Resources

Okta resources are identified by either an Okta Resource Name (ORN) or an Okta API REST URL.

Okta Resource Name (ORN)

The Okta Resource Name (ORN) uniquely identifies an Okta resource and has the following formats:

• orn:{partition}:{service}:{yourOrgId}:{objectType}:{objectId}:contained_resources
• orn:{partition}:{service}:{yourOrgId}:{objectType}:{appName}:{objectId}
• orn:{partition}:{service}:{yourOrgId}:contained_resources

Supported resources

Directory service

Identity Provider service

Workflow service

Governance service

Identity and Access Management service

Support service