OK1_Brochure_pages

Application Entitlement
USA Apps
Functional Apps
Functional and Location entitlement privileges are
defined by an employee’s cost center and work
location, respectively. These privileges are activated
on an employee’s first day on the job, using Okta’s
Lifecycle Management service. The success of this
process is measured by the number of application
access requests submitted to the IT Service Desk by
new employees during their first 60 days on the job.
On average, new employees typically submit only
one request for such additional privileges.
To protect our corporate data and manage our software
licenses prudently, access privileges to any application
are suspended if they go unused for 90 consecutive
days. They are terminated altogether on an individual’s
last day of employment.
Single Sign-On Access
Number
of Current
Applications
SSO Authentication Method
Birthright Apps
Enhanced access privileges allow selected users to view
sensitive information, configure aspects of an individual
application, and administer the access privileges of others.
Enhanced access is enabled by establishing multiple user
groups for individual applications.
97
SAML (Security Assertion Markup Language)
An internationally recognized standard for
exchanging authentication information between
security domains, specifically between Okta
and individual applications.
Individual Okta employees are entitled to a personalized
suite of applications based upon their employment status,
functional assignments and working locations. Common
collaboration tools such as Office365, Box and Zoom are
provided to all employees and are referred to as Birthright
applications. Specialized apps that are uniquely associated
with an employee’s job responsibilities are considered to
be Functional applications. Finally, cloud-based services
that support operations within specific geographic regions
are referred to as Location applications.
This diagram illustrates both the commonality and diversity
of apps assigned to Marketing, Finance and Engineering
employees in the United States. Note that this diagram
is only a partial portrayal of the apps used by employees
in these functions.
Many companies employ credentials stored in Microsoft
Active Directory (AD) as an authentication mechanism.
We exclusively use Okta’s Universal Directory as our
identity credential store and consequently make no use
of Microsoft AD in authenticating employee identities.
Multiple authentication methods are employed to expose
cloud-based applications to Okta's Single Sign-On (SSO)
service, as illustrated in the table to the right.
192
18
SWA (Secure Web Authentication)
An Okta-developed protocol that associates
encrypted user credentials with user-specific
private keys. When a user clicks an application
icon, Okta securely posts the user credential
to the application login page via SSL.
Bookmarks
A url link to an existing application or a portion
of an application, for example a frequently
used wiki.
4 5