Okta Identity and Access Administration
CompleteOverview
Acted as the lead Okta subject-matter expert for the global IT team, owning single sign-on and MFA configuration, application onboarding, access request handling, and end-to-end user lifecycle management across an environment of 2,800+ endpoints.
Problem
Identity is where access control actually happens, and it is also where it quietly fails. Three failure modes mattered most:
Provisioning latency — a new hire without access on day one is a person being paid to wait.
Stale access — role changes that add entitlements without removing the previous ones, so permissions accumulate for the life of a tenure.
Offboarding gaps — the highest-risk moment in the lifecycle, where anything missed leaves a valid credential belonging to someone who no longer works here.
Approach
Owned the lifecycle end to end rather than treating provisioning, role change, and deprovisioning as three separate ticket types.
Provisioning ran against SLA rather than best effort, so access existed before the start date instead of being chased on it.
Application onboarding brought SaaS applications behind SSO as they were adopted, so new tools entered the environment already governed rather than being retrofitted later. App-level SCIM provisioning handled automated user creation for the applications that supported it — Adobe, Expensify, and the HR portal among them.
Role transitions were handled as a replacement of entitlements, not an addition, which is what keeps privilege from creeping across a long tenure.
MFA ran on Okta Verify, with factor policy configured per application sensitivity rather than a single blanket rule.
I also contributed to refining the new-hire onboarding workflow around Okta FastPass and Okta Verify alongside the security lead — my part of that work was pilot group coordination and the communications and rollout side, not the underlying FastPass configuration.
Architecture
Okta as the identity provider fronting SaaS applications through SAML and OIDC, with Active Directory and Microsoft Entra ID in the picture on the directory side. Access requests flowed through a reviewed process rather than direct group edits, so entitlement changes carried an approval trail.
Outcome
Sustained SLA-compliant provisioning and a measurable reduction in access-related incidents. Served as the escalation point for identity issues across the global IT organization and trained incoming team members on Okta administration alongside Jamf and Microsoft 365.
Lessons Learned
Offboarding deserves more engineering attention than onboarding and almost never gets it, because onboarding failures are loud and offboarding failures are silent. A new hire without access complains within the hour. A departed employee with a live credential generates no ticket at all — which is exactly why that end of the lifecycle needs to be the automated one.