Okta

All Okta users with their core profile (apply: profile updates only — use lifecycle verbs for create/delete).

Scope

—

Round-trip

Full round-trip — snapshot, diff, apply.

State file skeleton

module: okta
kind: users
items:
  - # <fields specific to this kind — see snapshot output>

Okta groups with their member logins, keyed by group name (full apply for OKTA_GROUP type).

Scope

—

Round-trip

Full round-trip — snapshot, diff, apply.

State file skeleton

module: okta
kind: groups
items:
  - # <fields specific to this kind — see snapshot output>

Automatic group-membership rules (full apply: create/update/delete with lifecycle).

Scope

—

Round-trip

Full round-trip — snapshot, diff, apply.

State file skeleton

module: okta
kind: group-rules
items:
  - # <fields specific to this kind — see snapshot output>

IP / dynamic / location network zones (full apply).

Scope

—

Round-trip

Full round-trip — snapshot, diff, apply.

State file skeleton

module: okta
kind: network-zones
items:
  - # <fields specific to this kind — see snapshot output>

CORS / redirect trusted origin allowlist (full apply).

Scope

—

Round-trip

Full round-trip — snapshot, diff, apply.

State file skeleton

module: okta
kind: trusted-origins
items:
  - # <fields specific to this kind — see snapshot output>

User + group assignments for one application (full apply: add/remove only).

Scope

app

Round-trip

Full round-trip — snapshot, diff, apply.

State file skeleton

module: okta
kind: app-assignments
app: <value>
items:
  - # <fields specific to this kind — see snapshot output>

Application catalog metadata — label/status/signOnMode (snapshot+diff only).

Scope

—

Round-trip

Snapshot + diff (apply not wired).

State file skeleton

module: okta
kind: apps
items:
  - # <fields specific to this kind — see snapshot output>

All policies (sign-on / password / MFA / discovery / access) with rule names (snapshot+diff only).

Scope

—

Round-trip

Snapshot + diff (apply not wired).

State file skeleton

module: okta
kind: policies
items:
  - # <fields specific to this kind — see snapshot output>

External IdPs (OIDC / SAML / Google / Microsoft / ...) (snapshot+diff only).

Scope

—

Round-trip

Snapshot + diff (apply not wired).

State file skeleton

module: okta
kind: identity-providers
items:
  - # <fields specific to this kind — see snapshot output>

Authorization servers with their nested scope / claim / policy names (snapshot+diff only).

Scope

—

Round-trip

Snapshot + diff (apply not wired).

State file skeleton

module: okta
kind: auth-servers
items:
  - # <fields specific to this kind — see snapshot output>

Behavior detection rules (snapshot+diff only).

Scope

—

Round-trip

Snapshot + diff (apply not wired).

State file skeleton

module: okta
kind: behaviors
items:
  - # <fields specific to this kind — see snapshot output>

Tenant authenticator catalog — MFA factor types (snapshot+diff only).

Scope

—

Round-trip

Snapshot + diff (apply not wired).

State file skeleton

module: okta
kind: authenticators
items:
  - # <fields specific to this kind — see snapshot output>

User-profile schema attributes (base + custom; snapshot+diff only).

Scope

—

Round-trip

Snapshot + diff (apply not wired).

State file skeleton

module: okta
kind: user-schema
items:
  - # <fields specific to this kind — see snapshot output>

Group-profile schema attributes (base + custom; snapshot+diff only).

Scope

—

Round-trip

Snapshot + diff (apply not wired).

State file skeleton

module: okta
kind: group-schema
items:
  - # <fields specific to this kind — see snapshot output>

Onboard a new hire end-to-end

Activate the user, drop them in the right groups, and assign the SSO app.

weave okta find user new.hire@example.com
weave okta do activate new.hire@example.com --yes
weave okta do add-user-to-group new.hire@example.com 00g1abcdEFG --yes
weave okta do assign-user-to-app new.hire@example.com 0oa1abcdEFG --yes
weave okta show user-apps new.hire@example.com   # sanity

Bulk-reset MFA after a phishing incident

List the impacted users from the system log, then reset every factor.

weave okta list logs --filter 'eventType eq "user.account.report_suspicious_activity_by_enduser"' --json > incident.json
jq -r '.[].actor.alternateId' incident.json | sort -u > affected.txt
Get-Content affected.txt | foreach { weave okta do reset-mfa $_ --yes }
weave okta watch user-events alice@example.com   # confirm next-login factor re-enrolment

Quarterly access review

Snapshot groups + per-app assignments, commit, and diff next quarter.

weave okta snapshot groups
foreach ($app in @('0oa1abcdEFG','0oa2xyz')) { weave okta snapshot app-assignments --app $app }
git add .weave-state/okta && git commit -m 'okta access review Q1'
# … next quarter …
weave okta diff groups
weave okta diff app-assignments --app 0oa1abcdEFG

Quarantine a compromised account

One-shot containment: suspend, expire password, drop sessions.

weave okta find user alice@example.com
weave okta do suspend alice@example.com --yes
weave okta do clear-sessions alice@example.com --yes
weave okta do expire-password alice@example.com --yes
weave okta watch user-events alice@example.com --limit 100