Connect your AI Agents to Okta in minutes

What is an Okta MCP?

It's an MCP server that lets your agents access data and functionality from Okta via tools. Your agents can invoke these tools to look up a user's account status, check group membership, review recent sign-in activity, list assigned applications, and more.

Okta offers an official MCP server, but you can also use one from a third-party platform, like Merge Agent Handler.

How can I use the Okta MCP server?

The use cases naturally depend on the agent you've built, but here are a few common ones:

• Offboarding automation: when an HR system marks an employee as terminated, an agent can deactivate the corresponding Okta user and remove them from all assigned groups, cutting off access the moment the trigger fires

• Suspicious sign-in investigation: an agent watching for anomaly alerts can pull a user's recent Okta system log events, correlate the location and device against their normal pattern, and flag the session for a security analyst

• Access review reporting: on a recurring schedule, an agent can list group memberships and application assignments for a department and compile a summary for a compliance audit

• App assignment provisioning for new hires: triggered by a new employee record in the HRIS, an agent can assign the right Okta applications and add the user to the groups their role requires

What are popular tools for Okta's MCP server?

Here are some of the most commonly used tools:

• list_users: returns Okta user records filtered by status, group, or search query. Useful for agents that need to check who's active, suspended, or deactivated before taking action

• get_user: fetches the full profile and status for a single Okta user by ID or login. Call this when an agent needs to confirm account state before a downstream action like resetting a factor or updating group membership

• list_groups: retrieves Okta groups and their metadata, including group type and membership rules. Good for workflows that map organizational structure or check whether a user belongs to a privileged group

• list_applications: lists the applications configured in an Okta org along with their assignment status. Helpful when an agent needs to confirm which apps a user or group has access to

• list_system_log_events: pulls Okta's system log filtered by actor, event type, or time range. Use this when an agent is investigating sign-in activity or reconstructing a sequence of account changes

• list_user_factors: returns the MFA factors enrolled for a given user, such as push, SMS, or security key. Useful for agents handling factor troubleshooting or verifying MFA enrollment status

What makes Merge Agent Handler's Okta MCP server better than alternative Okta MCP servers?

There are several reasons to use Merge Agent Handler's Okta MCP server over building or maintaining one yourself:

• Enterprise-grade security and DLP: Merge Agent Handler includes built-in data loss prevention controls that let you block or redact sensitive fields before they reach an agent. For Okta, this means you can prevent MFA factor details, session tokens, or personal identity attributes from being exposed even when the agent has broad read access

• Managed authentication and credentials: Merge stores and refreshes Okta credentials on your behalf. You never expose raw API keys or OAuth tokens to an agent or manage token rotation manually

• Real-time observability and audit trail: Every tool call made against Okta is logged with timestamp, tool name, input parameters, and response metadata. You can audit exactly what an agent read or wrote without instrumenting anything yourself

• Tool Packs and controlled access: Tool Packs let you bundle specific Okta tools with tools from other connectors into a single MCP endpoint, scoped to a specific use case. An agent gets exactly the tools it needs, nothing more

How can I start using Merge Agent Handler's Okta MCP server?

You can take the following steps:

1. Create or log into your Merge Agent Handler account.

2. Install the Merge CLI by running pipx install merge-api, then run merge configure to link the CLI to your Merge account and merge login to authenticate your session.

3. Register the Agent Handler MCP server with Claude Code by running claude mcp add --transport http agent-handler https://ah-api.merge.dev/mcp, then open Claude Code and run /mcp to confirm agent-handler appears with a connected status.

4. Select agent-handler from the MCP list. This opens a browser window where you select which integrations to authenticate. Choose Okta and complete the auth flow. Merge stores and manages the credentials going forward.

5. Open a Claude Code session and start querying Okta data directly. The first time you use an Okta tool, a Magic Link may appear to complete connector authentication.

If you want to connect Merge Agent Handler's Okta MCP with internal or customer-facing agentic products, you can follow the steps in our docs.

Can employees use Merge to connect their AI tools to Okta?

Yes, Merge for Workforce lets your employees connect Claude, ChatGPT, Microsoft Copilot, Cursor, Codex, and other MCP-compatible AI tools to Okta without bypassing IT governance.

Instead of setting up direct connections with personal credentials that IT can't monitor or revoke, each employee authenticates through Merge and gets individual credentials tied to their identity. An IT support employee, for instance, can ask their AI to check whether a user's account is locked, review recent sign-in attempts, or confirm which applications are assigned, all within the permissions IT has defined.

IT also provisions access by role or group via SCIM. A security analyst, for example, gets Okta access to investigate sign-in anomalies, Slack to coordinate incident response, and PagerDuty to escalate alerts; while an HR coordinator gets Okta access to manage new-hire app assignments, Workday to sync employee records, and Gmail to send onboarding confirmations.

Every tool call an employee's AI makes to Okta is also inspected against your DLP rules and logged to a searchable audit trail, giving security teams full visibility into what data was accessed and by whom.