Published: Last updated:

Okta

Okta is a proprietary cloud identity platform from the United States and one of the market standards for identity and access management (IAM). It delivers single sign-on, multi-factor authentication and identity governance as SaaS, run in Okta-owned data-centre cells.

Okta (NASDAQ: OKTA) was founded in 2009 and runs identity management not as software organisations operate themselves, but as a hosted service. Choosing Okta means outsourcing authentication to an external, US-listed provider. That is exactly what makes the platform worth examining: it shows the maturity of an outsourced identity layer and, at the same time, the tension a US provider creates for Swiss data handling. This page describes what Okta does and sets the data situation against the sovereignty question.

Cloud identity as SaaS

Okta bundles under one surface what is otherwise spread across several building blocks. The platform splits into two product lines:

  • Workforce Identity Cloud. Identities for employees, contractors and partners. It secures access to internal applications and SaaS services.
  • Customer Identity (Auth0). Identities for end customers in the organisation's own applications, grown out of the Auth0 platform acquired in 2021.

The core building blocks are similar in both lines. Single sign-on ties many applications to one login. Adaptive multi-factor authentication adjusts the challenge to the detected risk instead of demanding it across the board. Lifecycle management automates creating and revoking accounts along the joiner and leaver process. Identity governance adds access reviews and evidence. Through the Okta Integration Network the provider states that more than 8,000 pre-built connections are available, which reduces the integration effort for common applications.

Protocols and integration

Okta speaks the established standards an open identity layer has to be measured against: OpenID Connect (OIDC) and OAuth 2.0 for modern web and API scenarios, SAML 2.0 for classic enterprise applications, and SCIM for automated user provisioning between systems. As an identity provider, Okta thus becomes the central trust anchor through which applications authenticate. In a Zero Trust architecture, such a central, protocol-based identity layer is one of the preconditions, because every access decision needs a reliable identity signal.

architecture-beta
    group user(cloud)["User"]
    group okta(cloud)["Okta SaaS"]
    group apps(server)["Applications"]
    group legal(cloud)["Provider jurisdiction"]
    service device(cloud)["User and device"] in user
    service idp(server)["Identity provider"] in okta
    service protocols(server)["OIDC SAML SCIM"] in okta
    service app(server)["Internal and SaaS apps"] in apps
    service cells(database)["Okta cells"] in legal
    service law(cloud)["US law CLOUD Act"] in legal
    device:R -- L:idp
    idp:R -- L:protocols
    protocols:R -- L:app
    idp:B -- T:cells
    cells:R -- L:law

The diagram shows the heart of the assessment: the identity layer is functionally strong, yet the control point sits with the provider and within its legal space. Where that point sits is decided by the chosen data-centre cell, not by the location of the users.

The data situation

Okta processes identity data in its own cells and offers a choice of regions, among them the United States, EMEA, Japan, Australia, Canada and India. Customers can select a region at setup to address data residency requirements. That shifts the physical storage location but changes nothing about the provider's nature: Okta remains a US company and is subject to US law. As soon as personal data flows into the platform, the revised Swiss Data Protection Act (revFADP) applies in Switzerland; with a US provider the US Cloud Act is added on top, which can give US authorities access to the data of a US company under certain conditions, even when that data is stored in the EU or elsewhere. An EMEA cell therefore does not fully resolve this legal question; it improves data residency but does not remove the provider affiliation.

Identity is also a particularly sensitive data type. Outsourcing authentication means handing a central control point out of the organisation's own hands. The risk is not theoretical: in an incident in autumn 2023, an attacker gained access to support case files through a service account stored in the support system. Session tokens contained in uploaded HAR files could be used for session hijacking; Okta initially put the directly affected customers at 134, fewer than one percent. A later review found that a downloaded report contained the names and email addresses of nearly all support users of the affected product lines. The incident illustrates why an outsourced identity layer is an attractive target and why the choice of provider remains a trust decision.

The contrast with sovereignty

Okta's appeal lies in speed: a hosted service, a broad integration network, little self-operation. The price is dependence on an external US provider for one of the most sensitive layers of IT. The opposite stance is self-operating an open identity layer. Keycloak covers the same protocols but runs on the organisation's own infrastructure and keeps user data in-house. authentik positions itself as a further open-source option, likewise self-operable. The choice between Okta and a self-operated solution is therefore less a question of function than of control. How to structure that question along cost, risk and operational effort is covered by the strategy page Digital Sovereignty.

For Swiss organisations with elevated protection needs, the balance often shifts towards self-operation. What matters then is the structured assessment of an identity provider by risk class and data flow, alongside a review of the legal and supply-chain side, such as the sub-processors of a US provider.

Assessment

  • Strength. A mature, broadly integrated identity platform with standard protocols and little self-operation. A sensible market standard for fast-scaling environments.
  • Limit. Proprietary and tied to a US provider. A regional cell improves data residency but does not resolve the legal-space question.
  • Fit. Sound where speed and integration breadth matter and the protection need of the identity data tolerates the US tie. Where protection needs are elevated, a self-operated alternative belongs honestly in the balance.

References

Related topics

  • Keycloak, the open-source, self-operable alternative with the same protocols.
  • Zero Trust, the architecture for which a central identity layer is a precondition.
  • Digital Sovereignty, the frame for the control question behind the choice of provider.
  • US Cloud Act, the legal lever that affects a US provider regardless of storage location.
  • nFADP / revFADP, the Swiss data protection law that applies to personal data.

Ask AI

These links open external AI services, the conversation and its content are sent to their providers.