Okta Certified Consultant study plan

Map the four exam domains to a personal gap list by scoring your current confidence per domain on a 1-5 scale

Sketch the Okta org hierarchy (org, cells, environments) and write a one-page note explaining how a sandbox differs from production

Create a free Okta developer org and a second sandbox-style org to use for all later labs

Configure and document the three core directory sources: Okta Universal Directory, Active Directory agent-based import, and an LDAP or HR-as-a-Master import

Implement a group-based assignment model: create groups, map them to apps, and remove direct user assignments

Configure and test at least three authentication policies (password-only, MFA-required, and a device- or network-conditioned policy)

Build a sign-on policy that enforces step-up authentication for a sensitive app while leaving a low-risk app on a lighter policy

Document the difference between authentication policies, global session policy, and app sign-on policies using your own configured examples

Connect a SAML 2.0 application end to end, including attribute statements and a signed assertion, and verify the assertion in a SAML tracer

Connect an OIDC application using authorization code flow with PKCE and inspect the ID token claims

Configure SCIM provisioning against a test app and demonstrate create, update, and deactivate lifecycle operations

Compare SAML, OIDC, and SCIM in a written table describing what each protocol handles and where each breaks in practice

Configure an inbound federation trust with a third-party identity provider and test just-in-time user creation

Set up an outbound federation or identity provider routing scenario so users are redirected to an external IdP

Implement profile mastering with attribute mappings and resolve at least two mapping conflicts deliberately

Build a lifecycle rule set (onboarding, transfer, offboarding) and verify each rule fires with a test user

Design and implement a multi-tenant or multi-brand pattern using separate orgs or branded subdomains and justify the choice in writing

Configure custom email domains, branding, and a customized sign-in widget without breaking default flows

Implement network zones and a risk-based policy that behaves differently inside and outside a trusted zone

Test at least three edge cases such as a user in overlapping groups, a deactivated user with an active session, and a policy exclusion

Use the Okta APIs to create users, groups, and app assignments via scripted calls with a scoped API token

Build a small automation that provisions a user, assigns a group, and logs the result, then handle and document at least two API error responses

Configure an inline hook or event hook and explain when each is the right choice over a workflow tool

Review system log events for your lab activity and write queries that surface failed sign-ins and policy denials

Configure MFA enrollment policies and at least two authenticator types, including a phishing-resistant option

Set up password policies, recovery flows, and self-service unlock, then test lockout and recovery end to end

Implement delegated administration with a limited admin role and verify the boundaries of that role

Document an org security baseline covering session lifetimes, MFA requirements, and admin role assignment

Rebuild a full scenario from scratch in a clean org: directory, groups, policies, one SAML app, one OIDC app, provisioning, and lifecycle rules

Time the rebuild and identify which steps consumed the most time, then write a remediation plan for the weakest area

Complete a timed practice set weighted to your two lowest-scoring domains and review every missed item against documentation

Write a one-page consulting checklist you would use on a real implementation engagement