> ## Documentation Index
> Fetch the complete documentation index at: https://docs.accessowl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta-managed applications

> Connect an application with Okta so AccessOwl manages access through Okta groups

If an application is assigned to your users through Okta, you can connect it in AccessOwl as an Okta-managed application. AccessOwl then grants and revokes access by adding or removing users from the application's Okta groups, and Okta's SCIM or SAML integration handles the actual account provisioning and deprovisioning. AccessOwl never changes accounts inside the application itself.

## Before you start

* Okta is connected as a directory in **Settings > General > Directory Integrations**. See the [Okta integration page](/integrations/all/okta) for setup.
* The application is set up in Okta and assigned through Okta groups (via SCIM or SAML).

## Connect an application with Okta

<Frame caption="Adding an Okta-managed application">
  <video autoPlay className="w-full aspect-video rounded-xl" src="https://mintcdn.com/accessowl/xV-a38zVX28tttaB/images/videos/add-okta-app.mp4?fit=max&auto=format&n=xV-a38zVX28tttaB&q=85&s=8805b7807a86e191885245bbb4a4f97f" data-path="images/videos/add-okta-app.mp4" />
</Frame>

<Steps>
  <Step title="Add the application">
    Go to **Applications**, click **New Application**, and select your application from the list.

    <Note>
      If your application is not listed, use **create a custom Okta-integrated application** below the search field.
    </Note>
  </Step>

  <Step title="Choose the Okta integration">
    On the **Choose Integration** step, click **Connect** under **Manage by Okta**.
  </Step>

  <Step title="Enter details">
    Assign a **Business Owner** and, optionally, **Application Admins**. Leave **Is requestable?** checked so your users can request access through AccessOwl. Click **Next**.
  </Step>

  <Step title="Name the permissions">
    The application's Okta groups are pulled in automatically as selectable permissions. Give each group a display name your users will understand, for example the group `1password-user` becomes "User". Add further groups with **Add other permission**.
  </Step>

  <Step title="Save">
    Click **Save**. The application is now managed through Okta.
  </Step>
</Steps>

## How access works after setup

* When an access request is approved, AccessOwl adds the user to the linked Okta group and Okta provisions the account.
* When access is revoked or the user is offboarded, AccessOwl removes the user from the Okta group and Okta deprovisions the account.
* Each linked Okta group is a separate permission in AccessOwl, so one application can offer multiple access levels, for example "User" and "Admin".

## Switching an existing application to Okta

If an application is already connected through an integration account, disconnect that integration first. Then reconnect the application and choose **Manage by Okta** on the **Choose Integration** step.