Onboarding an App Using Okta Credentials

1. Identify your Okta subdomain.

   Your Okta subdomain was included in the Okta login URL that was assigned to your organization. The URL that was assigned to your organization is in the format https://<your_okta_subdomain>.okta.com and often your Okta subdomain is the name of your company. However, your organization can define a custom URL that does not include your Okta subdomain. If you are an Okta administrator, you can identify the subdomain from the Okta administrator dashboard. Your subdomain is displayed in the header of the dashboard.

   Before you continue to the next step, make note of your Okta subdomain. You will provide this information to SSPM during the onboarding process.
2. Generate and copy an MFA secret key

   MFA provides an extra layer of security when accessing the Okta user account. To enable this extra layer of security, the Okta user account must be configured for MFA that uses one-time passcodes. These one-time passcodes are generated from authenticator apps such as Okta Verify or Google Authenticator by using an MFA secret key. The key is a shared secret between Okta and the authentication app. This shared secret enables Okta and the authentication app to generate matching passcodes for verification. Like an authentication app, SSPM will use the MFA secret key to generate one-time passcodes for accessing the Okta user account.

   If the user account is already configured for MFA, and if you know the MFA secret key value, you do not need to complete the following steps. You need only provide the MFA secret key to SSPM during the onboarding process. If the user account is not configured for MFA, or if you do not know the MFA secret key, complete the following steps.

   1. Log into the Okta user account.
   2. Locate your profile menu in the upper right corner of the page. Select Profile menuSettings.

   3. On the Settings page, locate the section that is labeled Extra Verification or Security Methods. This section shows the MFA methods that are available.
      In addition to providing SSPM with the MFA secret key, you must also configure an authentication app with the MFA secret key. Configuring an authentication app will enable the app to generate the one-time passcodes that you will need to access the account.
   4. Decide which authentication app you will use and download it to your cell phone.
      Depending on your organization, you can set up MFA for either the Okta Verify or Google Authenticator apps. Decide which of these authentication apps you will configure. This decision might be limited to the authentication apps that your organization allows, which are shown in the Extra Verification or Security Methods section of the Settings page.
   5. From the Okta settings page, Set up either Okta Verify or Google Authenticator. If the Set up button is disabled, Edit Profile to enable the action.
      If Okta Verify or Google Authenticator is already enabled for MFA, but you do not know the MFA secret key, then you must Remove the current setup, and then Set up the authenticator again.
   6. Follow the on-screen instructions for setting up the authenticator app, but, when you are presented with a QR code that contains the MFA secret key, do not scan the it with your authentication app. Instead, manually record and enter the QR code.
      1. On the MFA set up page that displays the QR code, click Can't scan?.

      2. If you are using Google Authenticator, continue to the next step. If you are using Okta Verify, you are redirected to a page with setup options. To display the MFA secret key as a character string, Setup manually without push notification.
      3. Okta displays the MFA secret key as a character string instead of as a QR code. Copy the key into a text file.
         Do not continue to the next step unless you have copied the MFA Secret Key. You must provide this key to SSPM during the onboarding process.
   7. Configure your authentication app by manually entering the MFA secret key. If you are using Okta Verify, when you are prompted to scan the QR Code, Enter key manually instead. If you are using Google Authenticator, when you are following the steps to configure MFA, Enter a setup key.