Okta Identity Governance FAQs

Last Updated: Oct 30, 2026

Identity Governance

Okta Classic Engine

Okta Identity Engine

All Engines

General

What capabilities are available with Okta Identity Governance?

Okta Identity Governance (OIG) is a solution comprising Lifecycle Management, Workflows, and Access Governance. Together, these products deliver a full-suite IGA solution that helps customers govern their identities, ensuring only the right users have access to the right resources at the right time. For an in-depth overview of OIG features, please review the OIG datasheet.

Are there any help articles or product documentation I can use to familiarize myself with the products?

Yes. Navigate to the OIG product documentation from this overview page. In addition, demo videos and learning modules are available on the OIG product hub page.

In addition, there are some short videos available to demonstrate how these products work, and a Product Hub Page with updates on What's New:

Can I use Okta Identity Governance for FedRAMP and HIPAA Okta orgs or user data?

Yes, OIG is HIPAA-aligned and available in Okta’s HIPAA-aligned environment. OIG is also FedRAMP Authorized for Okta for Government High and Okta for US Military. There is no Okta for Government Moderate provisioning. Government-eligible customers (that is, U.S. Government entities or contractors, subcontractors, and/or CSPs supporting the government) will be provisioned with a FedRAMP High tenant. Logs for that government-eligible customer's FedRAMP High tenant will be consolidated and exported into the IDaaS Okta org in FedRAMP Moderate. All other customers will be provisioned with a commercial tenant that is HIPAA-aligned. Please review the details on the Okta US Public Sector page.

Please speak with your account team or Okta representative about your specific use case and outcomes to determine how Okta's FedRAMP and HIPAA-compliant identity solutions can help solve your identity challenges.

Access Requests

What are the features available with Okta Access Requests?

Access Requests introduces a modern way for organizations to support access requests and approvals. Admins can configure workflows to represent complex business processes for these requests (for example, dynamically routing approvals based on org hierarchy and resource ownership). It can streamline request and approval workflows by integrating with the tools your teams use daily, such as Slack, Microsoft Teams, and ServiceNow. Separation of duties and other access controls are enforced in real time. And finally, leverage public APIs to scale and support request management, custom workflows, and custom integrations.

Is there any product documentation to help me set up Access Requests?

Yes, please refer to this documentation for information on how to use Access Requests and other product features available at this time.

What is the difference between request conditions and request types?

Request conditions are the latest way to manage access requests in Okta by bringing the configuration to the resources being requested themselves. With this model, relationships between resources and the access levels within them can be leveraged in a more scalable way to make resources requestable to the right people, with the right levels of approval.

Request types are the original way to manage access requests in Okta. Request types have more flexible logic definitions, but only an implicit link to resources in Okta through the assignment tasks, which limits their tie-in to existing resources.

Our recommendation is to explore and implement request conditions. Expect investment in the future to primarily focus on request conditions.

Does Access Request support requests for app-sourced groups (for example, groups sourced from Active Directory)?

Access Requests does not support app-sourced groups, except for AD groups. Users can request access to applications, Okta-sourced groups, AD groups, Okta push groups, Okta admin roles, resource collections, and entitlement bundles managed within Okta. Okta plans to expand the range of resources that can be requested.

Can I track how access has been granted to a user via a report and submit it for audit purposes?

OIG offers a complete, chronological record of requests, approvals, reconciliations, and certification outcomes available on demand. That data reaches stakeholders in whatever form they need it: APIs for pulling up to three years of governance history directly into GRC tools, customizable reports exportable in CSV or PDF, and auto-generated Auditor Reporting Packages built to satisfy common audit requirements. The outcome is an organization that can easily answer who has access to what, why they have it, and how they got it.

Access Certifications

What are the features available with Okta Access Certifications?

Access Certifications are scheduled, event-driven campaigns that let reviewers assess access in granular detail using AI-powered context to deliver compliance outcomes and enforce least-privilege access. Admins are empowered to proactively initiate review cycles, customize the scope of any campaign to entitlement-level granularity, and stage the campaign for careful review before launch.

Is there any product documentation to help me use Access Certifications?

Yes, please refer to this documentation for information on how to use Access Certifications and other product features available at this time.

Which Okta Resources can I certify to using Okta Access Certifications?

We support certifying access to Okta groups (Okta- or app-sourced), applications, resource collections, entitlements, entitlement bundles, service accounts, and AI agents. Okta plans to expand the range of certifiable resources. Campaigns can also support reviews of Okta admin roles.

Can I manually upload resource information using a CSV or a flat file and run Access Certifications on that data?

Yes, Okta supports running certifications for disconnected applications where access data (for example, users and entitlements) can be uploaded to an application in Okta via CSV, and a certification campaign can then be run on that application. Okta also provides options to automate remediation using Okta Workflows. Learn more in Certifying Access for Disconnected Applications.

How do I navigate to the Okta Access Certification Reviews app?

Once logged in to the Okta End-User Dashboard, find the “Okta Access Certification Reviews” app tile, which takes you to the reviewer user experience.

Access Certifications is integrated with Okta’s email notification system. Once integrated, any individual marked as a reviewer for a given campaign will automatically receive an email notification when the campaign launches. Reviewers will be able to use that email and navigate directly to the Okta Access Certification Reviews app. Access Certifications can also integrate with 3rd-party tools like Slack to notify reviewers of new and outstanding tasks.

How does Okta remediate after a reviewer revokes access to a resource during an audit campaign?

Access Certifications allows users to choose if they want Okta to automatically take an action (for example, remove a user’s access to a resource, or don’t take any action) once a review decision (approve/revoke) has been submitted. Users can also configure what should happen if a reviewer does not respond within the specified time of the campaign. Additionally, users can create their own custom remediation flow using Okta Workflows.

To assist with Workflows for remediation, Okta has built preconfigured Workflow templates for some of the most common remediation scenarios (for example, creating a ticket in a downstream ITSM tool after a revocation decision is made).

What are some known limitations of remediating access?

The remediation option to revoke access has known limitations depending on how the user was assigned to an app or group. If you have decided to remove a user from the resource as the remediation option, you may see the remediation status as “Manual Remediation Required” when:

The user was assigned to an application through a group or resource collection.
The user was added to a group through group rules.
The user is a member of an app-sourced group.
The user was assigned entitlements through a resource collection.

See "Understand remediation" in the product documentation for more details, including how to manually resolve access issues in various scenarios.

Can I automatically trigger a campaign (for example, when a user moves to a different role) to make certification campaigns more continuous?

Yes, users can trigger an event-driven certification with a custom process via Okta Workflows. Learn more in “How to Create an Access Certification via an Okta Workflow - User Profile Change Trigger.”

Can I schedule a campaign to run periodically (for example, once every three months)?

Yes, when building a campaign, admins have the option to “Make this recurring” and define the campaign's recurrence cadence.

Can I preview a campaign and its review items before launch?

Yes, users can stage a campaign to see the resulting review items and even reassign reviewers, if necessary (for example, reassign executives who have any reviews) before launch. Learn more in “Stage a Campaign.”

Entitlement Management

What is Entitlement Management?

Entitlement Management (EM) is a powerful set of capabilities introduced as part of Okta Identity Governance to offer a modern approach to managing and governing fine-grained entitlements for SaaS and on-premises applications and infrastructure. EM enables you to gain centralized visibility into which users have which levels of access across hybrid environments and to enforce least-privilege access through app-level policies.

What capabilities are available with Entitlement Management?

Entitlement Management capabilities include, but are not limited to, the ability to:

Discover entitlement data from SaaS or on-premises apps and bring it into Okta through OOTB connectors, Okta Workflows, or build your own SCIM connectors.
Create attribute-based access control (ABAC) rules for who has access to which entitlements.
Create entitlement bundles, which are groupings of entitlements for any application.
Access requests and approvals for elevated access to any application.
Access certification campaigns for any specific entitlement.
Prebuilt reports on which users have access to what entitlements.

Are there any help articles or product documentation I can use to familiarize myself with Entitlement Management?

Yes, visit the Okta documentation website for more information on Entitlement Management.

Do you have any public-facing API docs for Entitlement Management?

Yes, visit the Okta Identity Governance API documentation.

What are some new concepts that are introduced with Entitlement Management?

Concept Name	Description
Entitlement	An entitlement is the category of permissions that allows users to perform specific actions in an application. For example: Role, License
Entitlement Value	The specific permission of the Entitlement that can be set for users. For example: Business Operations Manager may be an Entitlement Value of Role.
Bundle	A collection of related entitlements: entitlement value key-value pairs that can be assigned together as a single unit. For example: Business Ops bundle may include Role: Business Operations Manager and License: Standard.
Policy	Programmatic rules that can use attributes to automate entitlement assignment. For example: If the user's department is BizOps, then assign Role: Business Operations Manager.
Grant	The individual instance or event that changes a user’s entitlements. For example: John may receive a policy grant that assigned him Role: Business Operations Manager. He can subsequently request additional entitlements, and those instances will create additional grants for John.

Where can I see more information on Entitlement Management?

See the Entitlement Management FAQs here:

Governance-Focused Reports

How are these governance reports different from others within Okta today?

The reports introduced as part of Okta Identity Governance offer significant improvements along three dimensions:

Breadth of data presented
Admin experience
Scale

Our governance-focused reports combine data from multiple sources, aiming to provide admins with all the information they need in a single report. These reports give admins more flexibility to manipulate and extract data from Okta.

Do you have any product documentation to help me navigate Governance-Focused Reports?

Yes, please refer to this documentation for information on how to use these reports.

Is the data available in the reports user interface all that is available?

No, the data presented in the Okta Admin Dashboard represents only a subset of the data contained in these reports. For visibility and ease of consumption, Okta has included the fields necessary to help you understand what the report contains, as well as filters to narrow the dataset. To view the full dataset, you can export it as a CSV.

I just made a change to a user’s access in Okta. When can I expect to see this in reports?

Some reports leverage live data, whereas others use data that must be stored in a background process and may not be available immediately. The Access Certification Campaign reports are an example of this; the reports may not show the most recent campaigns, depending on when the data sync ran. For many reports, changes in Okta are synced to the reporting platform periodically, several times a day. If you know a change has been made recently and want to see it reflected in these reports, please wait a few hours for it to be captured.

Can I run a report on a scheduled basis or use an API to generate a report?

You can build a custom process with Okta Workflows to run a report on demand or on a schedule.