Okta Certified Professional study plan

Okta Certified Professional · Give each week a clear focus.

8 weeks · About 7 hours per week

Week 1

User management & Basic security configurations

Map the Okta Universal Directory object model by drawing the relationships among org, users, groups, and group rules from memory
Create a free Okta developer org and populate it with at least 15 test users using three different provisioning methods (manual, CSV import, and API)
Configure a password policy and an enrollment policy, then document each setting you changed and why
Explain in writing how profile masters and attribute-level mastering affect user data ownership

A one-page directory diagram plus a settings log listing every policy you configured with a one-line rationale for each

Week 2

Build five group rules that assign users to groups based on department, title, and location attributes
Test each group rule against edge cases such as missing attributes and conflicting conditions, and record the outcomes
Configure a self-service registration flow with at least two required custom attributes
Practice deactivating, reactivating, and deleting users, noting how each state affects group membership and app assignment

A test matrix of five group rules with at least three edge cases each and the observed result per case

Week 3

Import users from a CSV that includes custom attributes and resolve every import error until the run completes cleanly
Configure inbound and outbound profile mappings between Okta and a test directory or app
Set up at least two authenticator enrollment options and walk a test user through enrollment
Write a short runbook for onboarding a new user end to end

A completed onboarding runbook plus a clean CSV import log showing zero errors

Week 4

Define SAML 2.0 roles (IdP, SP, assertions, NameID) in your own words without notes
Integrate a SAML app end to end, including downloading and uploading metadata and mapping attributes
Use the Okta SAML assertion viewer to inspect a live assertion and label each element
Diagnose and fix at least one intentionally broken SAML configuration, such as a wrong ACS URL or audience URI

A screenshot-free written walkthrough of the SAML integration with an annotated list of assertion elements and the fix for the broken configuration

Week 5

Integrate an OIDC or OAuth 2.0 app, configuring grant types, redirect URIs, and scopes correctly
Compare SAML and OIDC for a given business scenario and justify a choice in writing
Configure app assignment so that only members of a specific group can access the app, then verify with a test user outside that group
Set up and test single logout behavior for at least one app

A two-app integration record (one SAML, one OIDC) documenting settings, assignment rules, and logout test results

Week 6

Configure a multifactor authentication policy with at least two factors and a context-based rule (for example, network zone or device)
Create a network zone and apply it to a sign-on policy, then test access from inside and outside the zone
Configure global session policy settings and explain how session lifetime interacts with app-level policies
Review the system log and locate events for a successful login, a failed login, and a policy denial

A policy configuration summary with test results proving each rule triggers as intended

Week 7

Run a full practice scenario: create a user, assign apps, enforce MFA, and verify access from login to logout
Review every missed or uncertain item from earlier weeks and re-test the underlying configuration
Explain the interaction between group rules, app assignment, and sign-on policies in a single written flow
Time yourself on a set of self-written scenario questions and identify weak areas

A scored self-assessment sheet listing weak areas and the specific lab you will repeat for each

Week 8

Re-run every lab that you flagged as weak in week 7 until each passes without notes
Summarize each domain's key configuration decisions on a single reference sheet
Complete a final timed review covering all three domains and score it
Restate the exam logistics, domain weightings, and your readiness level in writing

A final readiness report with practice scores per domain and a pass or delay recommendation

Week 2: Can explain Universal Directory structure and demonstrate working group rules without reference material

Week 4: Can complete a SAML app integration end to end and correctly annotate a live assertion

Week 6: Can configure MFA, network zones, and session policies and prove each rule works via testing

Week 8: Scores at least 80 percent on a timed mixed-domain review and passes all previously weak labs without notes