Okta Certified Professional key terms

Okta's cloud store of user profiles and attributes that acts as the authoritative source for identity data used by apps, policies, and sign-in flows.

The admin console area where you add, remove, and label user attributes and map them between Okta and connected apps or directories.

Rules that translate attribute values between a source (such as Okta or an identity provider) and a target app, including direction and default values.

The setting that declares which source owns a given user attribute, so edits flow from that source and other sources cannot overwrite it.

A named data field on a user profile, such as department or employee ID, that can be mapped, used in policies, or passed to apps.

A collection of users used to assign applications and apply policies; membership can be manual or driven by group rules.

An expression evaluated against user attributes that automatically adds or removes users from a group, keeping membership current without manual edits.

Bringing users and their attributes from an external source, such as a CSV file or directory integration, into Okta for management and assignment.

A connector that syncs users and groups from on-premises Active Directory into Okta and can also handle password validation or provisioning.

Pushing an Okta group and its members into a connected app or directory so the target system receives matching group membership automatically.

Automatically creating, updating, and removing user accounts in a downstream app based on Okta profile changes and assignments.

Granting a user or group access to an application in Okta, which enables the app tile and any configured provisioning or policy evaluation.

Suspending a user so sign-in is blocked and active sessions and app access stop, while the profile is retained for later reactivation or cleanup.

Removing or disabling a user's accounts in connected applications when access ends, typically triggered by deactivation or unassignment.

A configuration where a user authenticates once with an identity provider and gains access to multiple applications without signing in again.

The system that authenticates a user and asserts identity to applications; in Okta SSO, Okta usually plays this role, though external providers can too.

The application that relies on an identity provider for authentication and accepts the resulting assertion to grant access to the user.

An XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider.

The signed SAML document that states who the user is and what attributes or entitlements they hold, sent from the identity provider to the app.

An XML file describing an identity provider or service provider, including endpoints and signing certificates, used to configure a trust relationship.

An SSO sequence that starts when the user opens the application, which redirects to the identity provider and then returns with an assertion.

An SSO sequence that starts from the identity provider portal, which sends an unsolicited assertion directly to the application without an initial app request.

An authentication layer built on OAuth 2.0 that issues an ID token and user info, commonly used for modern web and mobile app sign-in.

A framework for granting scoped access tokens to applications without sharing user credentials, focused on authorization rather than authentication.

A signed token in OpenID Connect that carries claims about the authenticated user, such as subject identifier and authentication time.

A credential presented to an API to prove authorization for specific actions and resources, typically short-lived and scoped.

A named permission requested by or granted to an application that limits which resources and operations an access token may be used for.

A statement about a subject inside a token or assertion, such as an email address or group list, used by apps to make access decisions.

The part of a SAML assertion that lists user attributes, such as email or role, so the service provider can personalize or authorize the session.

A public-key credential used to sign and verify assertions or tokens; its expiry and trust must be managed to keep SSO working.

Checking a cryptographic signature on an assertion or token against a trusted certificate to confirm it was issued by the expected party and not altered.

A rule set that determines whether a user must authenticate, be prompted for an extra factor, or be denied when accessing an application.

Rules evaluated at initial Okta sign-in that decide whether a session is created and which factors are required before any app access.

Requiring two or more independent verification factors, such as a password plus a push approval or one-time code, before granting access.

A method or device a user registers to prove identity, such as Okta Verify, a security key, SMS, or a password.

The process and policy that governs which authenticators a user must or may set up, and when they are prompted to do so.

A time-bounded authenticated state in Okta or an app; its lifetime and idle timeout control how long access continues without re-authentication.

Rules controlling password length, complexity, history, lockout, and recovery behavior for users whose credentials Okta manages.

Temporarily blocking sign-in after repeated failed attempts, protecting accounts from guessing attacks while allowing recovery through defined paths.

A named set of IP ranges and locations used in policies to treat traffic differently, for example trusting office networks or blocking risky regions.

Risk signals based on user activity, such as new device or unusual location, that policies can use to demand step-up authentication.