Okta, ready to run.
The Okta integration is where offboarding actually bites. Floowed reads who someone is and what they can reach, decides what has to happen, and either does it or hands a person the list with everything already checked.
What it does.
What Floowed reads from Okta
- Users, and their status
- Group memberships, and what those groups grant
- Applications a person is assigned to
- System log events, where one starts a case
What it writes back
- A user deactivated or suspended, once the decision says so
- Group memberships removed
- Sessions cleared, where the outcome calls for it
- The reasoning recorded alongside the case, so the action is explainable
This is the integration where the approval gate matters most. Revoking access is easy to do and expensive to do wrongly, so we would expect it to be a step a person confirms, at least until you trust the rules. Two limits worth knowing: deactivating a user deprovisions them from every assigned app, which Okta warns can destroy data in those apps and cannot be recovered; and only Okta-mastered groups can be changed through the API, so memberships of groups imported from Active Directory or another app have to be removed at the source.
A role change case, from transfer to right-sized access.
- Gather
A transfer is recorded in Workday. Floowed reads the person's groups and assigned apps in Okta.
- Interpret
It compares that access with what the new role's groups grant, and lists what should go and what is missing.
- Chase
The new manager has to approve one extra app, and the old manager has to confirm the handover of shared accounts. Floowed asks both.
- Decide
The policy engine runs your access rules. Anything touching admin access goes to the security lead, who decides.
- Act
Floowed changes the Okta groups it can, opens a Jira issue for groups mastered in Active Directory, and records the reasoning with the case.
Used in the same case
The connection, in detail.
How it connects.
- 1
Connect Okta
Using an OAuth 2.0 service app using client credentials with private_key_jwt. Nothing migrates and nothing is replaced.
- 2
Build your operation
Describe it in Slack, Teams or the Floowed Dashboard. Floowed builds it and asks only what it can’t work out.
- 3
Let it run
Every case runs from request to outcome, the same way each time, with the reasons on record. Anything sensitive waits for a person.
Questions
Does Floowed integrate with Okta?
Yes, through Okta's management API, as an OAuth service application your admin creates with its own scopes and role.
How does the Okta integration connect?
Your admin registers a service application and grants it scopes plus an admin role. We ask for read plus a narrow set of write scopes rather than blanket administrator rights. Worth avoiding the older API tokens: they carry no scopes at all, inherit whichever admin created them, and stop working when that person leaves.
What can Floowed do with Okta data?
Employee offboarding is the case. A termination event starts it, Floowed reads what the person can reach, works out under your rules what has to be revoked and in what order, and either acts or presents the list for approval.
Do I need to build a workflow to use it?
No. Describe your offboarding, connect Okta, and set which steps run automatically and which wait for a person.
Is this safe to automate?
Only as far as you allow. Revocation is exactly the kind of action that should sit behind an approval, and the platform is built so you decide how much it handles on its own. Every action carries its reasoning and an audit trail.
What does the Okta integration cost?
Nothing extra. Integrations are included, and you pay for the work Floowed does on a case.
Start with Okta. Add the rest.
Free to try, no card, no sales call. Your first $80 of credits is on us.