Connect Okta to Blaise, read-only.

• An Okta org, and its Okta domain (for example acme.okta.com).
• An Okta Super Administrator. Okta requires this role to add an API Service Integration.
• A Blaise account with access to the client whose Okta you are connecting.

Blaise is an Okta API Service Integration: a server-to-server connection that uses OAuth 2.0 client credentials with a client secret. It reads only. Blaise never creates, changes or deletes anything in Okta.

• Identity posture: MFA enrollment, inactive users and administrator roles.
• Access reviews: users, groups and application assignments.
• Policy settings: sign-on, password and MFA policies.
• Audit evidence for SOC 2, HIPAA, CMMC and ISO 27001.

The integration asks for these scopes, all read-only:

• okta.users.read Users and their status, to find inactive accounts and support access reviews.
• okta.groups.read Groups and membership, to show who has access to what.
• okta.apps.read Applications and assignments, for access reviews.
• okta.policies.read Sign-on, password and MFA policy settings.
• okta.factors.read Enabled factor types and MFA enrollment.
• okta.logs.read The System Log, for failed sign-ins and audit evidence.
• okta.roles.read Administrator role assignments.

In Okta

1. Sign in to the Okta Admin Console as a Super Administrator.
2. Go to Applications, then Browse App Catalog.
3. Search for "Blaise" and choose Add integration (API Service Integration).
4. Review the read-only scopes listed above and grant them.
5. Copy the Client ID and Client secret. Okta shows the client secret only once, so store it safely.
6. Note your Okta domain, for example acme.okta.com.

In Blaise

1. Open Connectors for the client, then open Okta.
2. In the Connect with Okta panel, enter the Okta domain, Client ID and Client secret.
3. Choose Connect with Okta. Blaise checks the values with one read-only token request before it saves them, so a wrong value is caught right away.

When the connection is saved, Blaise begins reading your Okta data and shows the results in identity posture and evidence.

• Blaise says a permission is missing. In Okta, open the Blaise integration, choose Okta API Scopes, grant each scope listed above, and try again.
• The client secret is rejected. Check that you copied the full value. If it was lost, generate a new client secret on the Blaise integration in Okta and enter it in Blaise.
• The domain is not accepted. Enter the domain you sign in at, such as acme.okta.com, without https:// or a path.
• You cannot add the integration. Only a Super Administrator can add an API Service Integration.
• Still stuck? Email support@useblaise.com.

1. In the Okta Admin Console, open Applications, find the Blaise API Service Integration, deactivate it, then delete it. This revokes Blaise's access immediately.
2. In Blaise, open Connectors for the client, open Okta, and choose Disconnect.

Blaise stores the Okta data it reads as compliance records for your organization only. Read how we protect it on our security page and in our privacy policy.