Okta Importer for Assets syncs People, Groups, Devices, Applications, Cost Centers, Organizations, Divisions, Departments and User Types from Okta into JSM Assets. This guide covers the part security teams care most about: giving the importer only the access it needs.
Before you start
You need an active JSM Cloud Premium or Enterprise subscription and an Okta super administrator to create the integration.
1. Create an API Services app
In the Okta admin console, create an API Services app integration for the importer. This is the identity the importer uses to read from Okta.
2. Grant only read scopes
Grant the Okta API scopes for the object types you plan to import, and nothing else:
| Scope | Needed for |
|---|---|
okta.users.read | People |
okta.groups.read | Groups |
okta.devices.read | Devices |
okta.apps.read | Applications |
okta.userTypes.read | User Types |
Note:
okta.devices.readis only available if the Devices feature is turned on in your Okta org. If it isn't, leave Devices switched off in the importer.
3. Assign the Read-only Administrator role
Assign the Read-only Administrator role to the API Services app, and remove any other admin roles from it. Together with the read scopes above, the importer can see your directory but never change it.
4. Test, then schedule
Enter the app's credentials in the importer and run a test import to check the connection, scopes and data model. When it passes, set an hourly or daily schedule. People becomes the central record in Assets, linked to Groups, Devices and the organisational lookups.
Staying in control
- Failure notifications tell you when a scheduled import fails.
- Logs and audit logs record each run. Audit log entries are authenticated on the server, so they can't be faked by impersonating a user.
- Credentials are stored using the hardened storage introduced in recent versions.
