Complete List of Okta Event Hooks Use Cases

Okta uses Event Hooks to communicate with external systems about events taking place in an Okta organization. This allows developers and DevOps teams to leverage event data from Okta to trigger workflows in other applications managed by their organizations.

Okta supports a lot of events, and to easily make sense of their functions, these events are categorized into different types/groups when setting up an event hook.

In this article we take a look at different event types supported by Okta Event Hooks, and list a couple of scenarios where you can make use of them.

Device trust events

Okta Multi-factor Authentication (MFA) allows users to authenticate using apps like Duo, Google Authenticator, or custom apps embedded with Okta SDK.

These apps are installed on the user's device and can receive a push notification or generate an OTP to authenticate the user.

Device trust events are fired when devices are registered to be used to authenticate into an Okta organization.

Use cases

• Track information on devices used to log into your organization.
• Track which users are using which devices.
• Track information on apps used to authenticate into your organization.

Device identity events

These events are sent when an admin enrolls or removes a device from an organization. There are also events for adding or removing a user from an organization's device.

Use cases

• Track device status on your organization.
• Gather device lifecycle metrics into a system like BigQuery or Holistics for analytics.
• Block users from using a removed device to authenticate into your external applications.

Security events

Users often report suspicious activities in their organizations to the organization admin. An example of suspicious activity is when an unknown person tries to sign into your organization using your credentials. Okta supports event hooks for this type of activity.

Use cases

• Broadcast notification of suspicious activity report cases.
• Temporarily deactivate a user's account pending investigation of the suspicious activity.
• Collate data on suspicious activities for analytics.

User auth events

These events are triggered when activities related to user authentication occur. These activities include sign in, sign out, password change, or when a user authenticates via their phone using MFA.

Use cases

• Track user sessions by collating sign in and sign out information into databases for analytics.
• Authenticate users on external applications based on authentication state on Okta organization.
• Detect threats like brute force attacks when spikes occur in login attempts for a particular user.

Security authenticator lifecycle

These events are fired when an admin activates or deactivates authenticators like Duo, Google Authenticator, etc. for an organization.

Use cases

• Trigger process to deactivate all user registrations on deactivated authenticator.
• Notify users about a deactivated authenticator so they don't continue to use it.
• Notify organization users about a newly added authenticator so they can begin using it.

Admin privilege events

These events are fired when admin privileges are added to or removed from users and/or groups.

Use cases

• Add or revoke privilege to users on external applications.
• Log data on when certain users had rights to perform certain actions and when these rights were revoked. This can come in very handy for audit trails in financial applications, for example in a payroll system.

User app events

These are events related to the access of users to applications within their Okta organization. For example, events are fired for activities like granting a user access to an application, revoking a user's access to an application, and denying a user's request to access an application.

Use cases

• Track usage of applications (most used applications, least used applications, dormant applications).
• Detect and alert exceeded usage limits for applications and act accordingly; for example, some applications are paid and the subscription plan can only take a limited number of users.
• Track users using a certain application.

Rate limit events

Okta fires these events when a certain client is about to or has exceeded the Okta rate limit for that organization.

Use cases

• Send notification alerts to system administrators and DevOps teams about the event in order to take necessary actions.
• Trigger CI/CD workflows to control usage rate.
• Detect suspicious usage.

Group events

Just like any typical user management system, Okta also supports grouping users for organizational or functional purposes. Group events are fired for activities like adding users to or removing users from groups.

Use cases

• Synchronize group management on external organizations.
• Use group information to assign privileges to users on external applications.
• Setup external accounts when a user is added to a group; for example, you may need to invite the newly added user to new channels on Slack or open a new 401k account for the user on your external payroll system.

User lifecycle events

These are fired for user management activities like adding users, suspending users, and removing users.

Use cases

• Create user records on external applications. For example, a new user is added to your organization and you need to automatically send an invite to add them to your Slack or Microsoft teams account.
• Remove a user from an external application when removed from an Okta organization; for example, you can remove a user from your external payroll system once they leave your firm and are deleted from your Okta organization.

User import events

These events are triggered when users are imported into Okta using a batch process, for instance uploading a CSV file containing users' information.

Events are raised and Event Hooks are triggered for both the start and end of the process, or when a roadblock is encountered due to the admin exceeding the import threshold.

Use cases

• If the import is automated, trigger a workflow to prevent the import from exceeding Okta's threshold when a threshold exceeded event is fired.
• Send push notifications to admins when the import is complete.
• Trigger account creation process on external applications for newly added users when the import is complete.

Group lifecycle events

These events are fired when groups are added or removed, either directly or by a batch process.

Use cases

• Trigger batch process to revoke group privileges from users on external applications.
• Remove or deactivate all external accounts created for users in the group; for example, delete all contractors from a Contractors list on your payroll when the contract is done and the group has been removed from Okta.

Policy events

These events are fired when Okta policies and rules contained within policies are added, updated, or deleted.

Use cases

• Synchronization of policies and policy rules on external applications.
• Broadcasting rules and policy information updates via email or other notification systems within an organization.

Application lifecycle events

Just like other lifecycle events in Okta, application lifecycle events are fired when applications are added to, updated, or removed from an Okta organization.

Use cases

• Alert users using a particular app when the app is removed.
• Revoke access of removed app from external applications, for example by deleting API keys or removing whitelisted IPs on external apps.

Conclusion

There are a lot of custom integrations you can build in to Okta using Event Hooks, and this list doesn't even scratch the surface! Hopefully through the example use cases in this article, you picked up one or two use cases where Okta Event Hooks can be beneficial to your organization's workflow.

Happy coding!