Okta Privileged Access (OPA) separates resource administration from secret access, requiring a published security policy to grant secret creation permissions. Create and publish a security policy granting the necessary secret permissions to resolve the missing folder and creation options. An administrator creates a secret folder, but the folder fails to appear under My Privileged Access > Secrets and the option to create a secret does not display.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Privileged Access (OPA)
• Secrets and secret folders
• Resource Administrator
• Delegated Resource Administrator
• Security Administrator
• PAM Administrator

Okta Privileged Access separates resource administration from resource access. Resource administrators create and manage resource groups, projects, and top-level secret folders. These administrators receive an implicit list permission on secret folders, allowing visibility of folder and secret names and descriptions. Delegated resource administrators hold this permission only within delegated resource groups. Permissions to create, update, reveal, and delete secrets, as well as create, update, and delete folders, require a published security policy. Okta hides the secret-creation controls and omits the folder from the default My Privileged Access > Secrets list until a policy grants access. The search function still returns the folder through the implicit list permission. Assigning the folder to an administrator or holding administrator roles does not replace the requirement for a security policy.

How does an administrator resolve the missing secret folder and creation option?

Create a default security policy, assign the appropriate resource groups and principals, configure the secret and folder permissions, and publish the policy to grant the necessary access.

1. Sign in to Okta Privileged Access and navigate to Security Administration > Policies.
2. Select Create policy and choose Default.
3. Enter a policy name and description.
4. Under delegation, select All resource groups, or Specific resource groups and choose the resource group that contains the folder.
5. Under How access is granted, select Direct principals.
6. Add the users, groups, or workload roles that require access.
7. Select Add rule, choose the secrets resource type, and select the secret folder.
   NOTE: Policies linked to a folder apply to child folders and secrets automatically.
8. Select the required permissions to grant:
   • Secret: Create, Update, Reveal, Delete.
   • Folder: Create, Update, Delete.
9. Select Save policy.
10. On the policy, select Actions > Publish.
    NOTE: A policy has no effect until an administrator publishes it.
11. Refresh the page and navigate to My Privileged Access > Secrets.

Additional troubleshooting steps verify the policy configuration.

Verify the policy configuration and rule conditions to ensure proper access assignment.

1. Confirm the rule targets the correct folder and that the user or group is a principal of the policy.
2. Check rule conditions such as Multi-Factor Authentication (MFA) or Access Request that hide items until the user meets them.
3. Confirm the policy status displays as Published.

OPA enforces specific requirements for moving a secret and naming folders.

Review the permission requirements for moving secrets and the character restrictions for folder names.

• Moving a secret requires Reveal and Delete permissions on the source folder and Create permissions on the destination folder.
• Folder names only support alphanumeric characters, hyphens, underscores, and periods.

Related References

• Secrets
• Secret folders
• Secret permissions
• Security policy
• Security administration