Navigating complex configurations
Navigating Complex Configurations
This domain tests policy composition, expression language, authorization servers, federation routing, and layered session controls. The exam expects you to predict which policy wins.
Core rules and concepts
- Okta evaluates policies by type and priority. Global session policy controls initial authentication and org-wide session lifetime; app sign-on policies add app-specific MFA and re-authentication.
- Authenticator enrollment policies define which factors users can enroll; MFA is enforced at sign-on policy evaluation, not by the enrollment policy alone.
- Authorization servers issue OAuth 2.0/OIDC tokens. Access policies govern grants, scopes, and token lifetimes. Claims use expression language and must not collide with reserved claims.
- IdP routing rules and discovery direct users by domain, group, or request context to the correct inbound IdP.
- Network zones, behavior detection, and ThreatInsight feed risk signals; do not treat a zone as an authentication factor.
Worked example
Employees authenticate through Okta, partners through an external SAML IdP, and both need an internal API. Create an inbound SAML IdP for partners and routing rules: partner email domain to the partner IdP, default to Okta. For the API, create a custom authorization server with scopes read:orders and write:orders. Add an access policy requiring MFA for the write scope and a one-hour access token. Add a groups claim filtered to the API group. Test both a partner token and an employee token; the partner should receive only read:orders if that is the assigned scope.
Traps
Global session policy is not app-specific; changing it affects every app. App sign-on policy cannot override a failed global session. Scope names are case-sensitive and must exist on the authorization server. A groups claim without a filter can exceed token limits. Routing rules that match too broadly send users to the wrong IdP.