Okta Identity and Access Administration

Overview

Lead Okta subject-matter expert for the global IT team. I owned single sign-on and MFA configuration, application onboarding, access request handling, and end-to-end user lifecycle management across an environment of 2,800+ endpoints.

Problem

Identity is where access control happens, and it is where it quietly fails. Three failure modes mattered most:

Provisioning latency. A new hire without access on day one is a person being paid to wait.

Stale access. Role changes that add entitlements without removing the previous ones, so permissions accumulate for the life of a tenure.

Offboarding gaps. The highest-risk moment in the lifecycle. Anything missed leaves a valid credential belonging to someone who no longer works here.

Approach

I owned the lifecycle end to end instead of treating provisioning, role change and deprovisioning as three separate ticket types.

Provisioning ran against an SLA, so access existed before the start date instead of being chased on it.

Application onboarding brought SaaS applications behind SSO as they were adopted, so new tools entered the environment already governed instead of being retrofitted later. App-level provisioning (SCIM where the application supported it) handled automated user creation for Adobe, Expensify and the HR portal among others.

Role transitions were handled as a replacement of entitlements, which is what keeps privilege from creeping across a long tenure.

MFA ran on Okta Verify, with factor policy set per application sensitivity instead of one blanket rule.

I also contributed to refining the new-hire onboarding workflow around Okta FastPass and Okta Verify alongside the security lead. My part was pilot group coordination and the communications and rollout side, not the underlying FastPass configuration.

Architecture

Okta as the identity provider fronting SaaS applications through SAML and OIDC, with Active Directory and Microsoft Entra ID on the directory side. Access requests flowed through a reviewed process instead of direct group edits, so entitlement changes carried an approval trail.

Outcome

Sustained SLA-compliant provisioning and a measurable reduction in access-related incidents. I was the escalation point for identity issues across the global IT organization and trained incoming team members on Okta administration alongside Jamf and Microsoft 365.

Lessons Learned

Offboarding deserves more engineering attention than onboarding and almost never gets it, because onboarding failures are loud and offboarding failures are silent. A new hire without access complains within the hour. A departed employee with a live credential generates no ticket at all, which is why that end of the lifecycle needs to be the automated one.