# Integrate Okta with MDM

Okta, is a cloud based identity and access management solution that provides directory services to make device enrollment and user management simpler. By integrating Okta with MDM, you can enable Single Sign On for users to login to the MDM console, AD based authentication etc.

## Integration Procedure

You need to follow the steps below to integrate your **Okta directory** with MDM:

1. On the MDM console, navigate to **Enrollment > Directory Services.**
2. Click on **Add Domain** and select **Okta.**
3. Sign in to your Okta organization as a user with administrator privileges.
4. Provide Org URL from the top right corner of your dashboard (excluding "https://"). Your Org URL will look like this:
   - example.oktapreview.com
   - example.okta.com
   - id.example.com, if you have configured a custom URL domain.

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_20.png)

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_2.png)

5. If OAuth is not configured, you will get an error message saying **"OAuth App details are not yet configured"**. Click on **here** to configure OAuth.
6. Click on **Admin** to navigate to the Okta Admin portal.

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_3.png)

7. Go to **Applications** and then click on **Create App Integration.**

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_5.png)

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_4.png)

8. Select **OIDC - OpenID Connect** as Sign-in method and Web Application as **Application type.**
9. Click on **Next.**
10. **Enable Refresh Token** option and enter the **Redirect URI** obtained from the MDM server.

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_6.png)

11. Under **Assignments** choose the appropriate option as applicable.

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_7.png)

12. Upon clicking **Save,** a new set of **Client ID** and **Client Secret** will be generated which is to be copied and pasted back on the MDM server.

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_8.png)

13. Federation Broker Mode must be enabled to sync all Okta users with the MDM server.

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta-integration-10.png)

14. Under Okta API scopes, grant the following oAuth scope permissions:
    - okta.groups.read
    - okta.users.read
    - okta.users.read.self

![okta_integration_1](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_9.png)

15. Once you have entered the Client ID and Client Secret on the MDM server, click on **Integrate.**

Now the Okta will be successfully integrated with the MDM server. After this, you can make use of Okta credentials for authenticating users during enrollment and allowing users to login to the MDM console via Single Sign-On (SSO).