Connecting the Okta MCP (Model Context Protocol) server to Atomicwork allows your AI Workforce, workflow builder, and coding agents to securely execute administrative actions in Okta. Once connected, your AI coworkers can autonomously manage users, groups, applications, and security policies within the precise boundaries you define.

Note: This integration is specifically for the Okta MCP server, which enables agentic actions and workflows. If you need to sync employee attributes or run standard IT workflows, please connect the standard Okta integration instead. See Okta: Permissions and setup.

Before you begin

To set up the Okta MCP server, make sure you have the following permissions and information:

Atomicwork admin access: You must have organization administrator permissions in Atomicwork to access the MCP Store.
Okta admin access: You must have administrator permissions in Okta to create an API Services application and assign admin roles.
Okta Org URL: Your Okta organization URL (e.g., https://atomicwork.okta.com). Do not include -admin or a trailing slash.

Connect the Okta MCP server

Setting up the Okta MCP server involves creating an API Services app integration in Okta, configuring key-based authentication, and connecting it to Atomicwork. Follow these steps to complete the setup:

Create the App Integration in Okta: Log in to your Okta admin console, navigate to Applications > Applications, and click Create App Integration. Select API Services, click Next, name the application atomicwork-mcp, and click Save.
Switch to key-based authentication: On your new app's General tab, locate the Client Credentials panel and click Edit. Select Public key / Private key, and leave the panel in edit mode.
Generate and save the private key: Scroll down to the Public keys section, click Edit, and click Add. In the dialog, click Generate new key. Copy the JSON payload from the black text box and save it securely—this is the Private Key (JWK) you will paste into Atomicwork. Click Save.
Confirm the key is active: Verify that the row in the Public keys section shows Status: Active and Key use: sig.
Save Client Credentials: Return to the Client Credentials panel and click Save.
Disable DPoP: In the General Settings panel, click Edit. Uncheck Require Demonstrating Proof of Possession (DPoP) header in token requests and click Save.
Assign an Admin role to the app: Go to the Admin roles tab of the app. Assign the role that matches the actions you want the Okta MCP server to perform (e.g., Application Administrator, or a custom read-only role to limit access). This role authorizes the app's actions in your Okta organization.
Grant Okta API scopes: Go to the Okta API Scopes tab and grant the scopes that match the tools you want Atomicwork to use (e.g., read-only directory lookups or write access to users and groups). Narrower scopes limit the tool capabilities on the Atomicwork side.
Connect in Atomicwork: In Atomicwork, navigate to Settings > MCP Store > Okta. Click the Okta tile, then click Connect. Enter your Org URL and paste the Private Key (JWK) JSON you saved in Step 3, then complete the setup.

Managing Okta tool access

Once the setup is complete, you can control which tools your AI Coworkers can access. To configure tool access:

Navigate to AI Workforce > AI Coworker > Tools.
Select your AI Coworker from the list.
Grant granular or complete access to the available Okta tools based on your workspace requirements.

In addition to standard AI Coworkers, the workflow builder and the coding agent automatically have access to the Okta MCP server while building workflows and writing custom code scripts respectively.

Warning: Always practice the principle of least privilege. Only grant your AI Coworkers the minimum set of tools and Okta API scopes required to perform their tasks to avoid unexpected behavior or unauthorized actions.

Available Okta MCP tools

The following table lists the administrative tools available through the Okta MCP server:

Category	Tool Name	Description
Applications	`create_application`	Create a new application in Okta.
Applications	`activate_application`	Activate an application.
Applications	`deactivate_application`	Deactivate an application.
Applications	`confirm_delete_application`	Confirm and execute application deletion (requires typing 'DELETE').
Groups	`create_group`	Create a new user group.
Groups	`add_user_to_group`	Add a user to a group by their user ID.
Groups	`confirm_delete_group`	Confirm and execute group deletion (requires typing 'DELETE').
Users	`create_user`	Create a new user (optionally staged, without sending an activation email).
Users	`deactivate_user`	Deactivate a user (required prerequisite before deletion).
Policies	`create_policy`	Create a policy (Sign-On, Password, MFA Enroll, Access, etc.).
Policies	`activate_policy` / `deactivate_policy`	Activate or deactivate an existing policy.
Policies	`create_policy_rule`	Create a rule for a policy.
Policies	`activate_policy_rule` / `deactivate_policy_rule`	Activate or deactivate a policy rule.
Policies	`create_device_assurance_policy`	Create a Device Assurance Policy (per-platform OS, encryption, and screen-lock rules).
Branding & Domains	`create_brand`	Create a new brand (sign-in page, emails, dashboard look-and-feel).
Branding & Domains	`create_custom_domain`	Create a custom domain (manual or Okta-managed certificate).
Branding & Domains	`create_email_domain`	Create a custom email-sending domain.
Branding & Domains	`create_email_customization`	Add a localized email template variant.

Next steps

Now that you have connected the Okta MCP server, explore how to configure your AI coworkers and workflows to use these tools:

Setting up an AI Coworker — Learn how to assign tools and set up guardrails for your AI coworkers.
Connect the JumpCloud MCP server — Learn how to connect other identity provider MCP servers to your workspace.
Connect the Cloudflare MCP server — Explore connecting other service-principal-style MCP integrations.