This article covers every workflow action available through the Okta integration — looking up users, managing their lifecycle state, resetting passwords and MFA factors, and managing group and app assignments.
Note: Okta also provides 5 triggers — User Activated, User Profile Updated, User Deactivated, User Account Auto-Locked, and User Added to Group. For trigger setup, see integrating Okta with HappyFox Workflows.
Validation note legend
| Term | Meaning |
|---|---|
| Required | The workflow cannot run this step without a value. |
| Optional | The field can be left blank; the action will still run. |
| Text | A plain string of characters. |
| Yes/No toggle | A boolean — on or off. |
| List (multiple entries) | A list where you can add zero or more items. |
Note on user, group, and app resolution: For any field that accepts a user, group, or app, you can supply the Okta ID, name, login, email, or label. The integration resolves it to the correct internal ID automatically using your synced Okta metadata.
User Lookup
Get User by Login Name
Looks up an Okta user by their login name (usually their email address) and returns their full profile, status, and timestamps.
| Field | Description | Validation |
|---|---|---|
| Login Name | The Okta login name (email format) of the user to look up. | Required · Text |
User Lifecycle Actions
Create User
Creates a new Okta user account with the given profile details. Optionally assigns the user to groups and activates the account immediately.
| Field | Description | Validation |
|---|---|---|
| First Name | The user's first name. | Required · Text |
| Last Name | The user's last name. | Required · Text |
| Login | The user's Okta login name, typically their email address. | Required · Text |
| The user's primary email address. | Required · Text | |
| User Type | The Okta user type to assign. You can supply the type's name or ID. | Optional · Text |
| Second Email | An optional secondary email address for the user. | Optional · Text |
| Groups | A list of Okta group names or IDs to add the user to at creation time. | Optional · List (multiple entries) |
| Activate | Whether to activate the user account immediately after creation. If off, the account is created in a STAGED state. |
Optional · Yes/No toggle |
Activate User
Sends an activation email to a user whose account is in a STAGED or DEPROVISIONED state, moving them to ACTIVE.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user to activate. | Required · Text |
Reactivate User
Re-sends the activation email to a user who was previously deprovisioned, allowing them to regain access.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user to reactivate. | Required · Text |
Deactivate User
Deactivates an Okta user, revoking all their active sessions and access. The account moves to a DEPROVISIONED state.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user to deactivate. | Required · Text |
Suspend User
Suspends an active Okta user, preventing them from signing in without deleting their account. The account moves to a SUSPENDED state.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user to suspend. | Required · Text |
Unsuspend User
Restores a suspended Okta user back to an ACTIVE state, allowing them to sign in again.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user to unsuspend. | Required · Text |
Unlock User
Unlocks an Okta user account that was locked out due to too many failed sign-in attempts.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user to unlock. | Required · Text |
Password & Credential Actions
Reset Password for User
Triggers an Okta password reset for the user — they receive an email with a link to set a new password.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user whose password should be reset. | Required · Text |
Expire Password for User
Immediately expires the user's current password, forcing them to set a new one the next time they sign in.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user whose password should be expired. | Required · Text |
Reset User Factors
Resets MFA (multi-factor authentication) factors enrolled by a user. You can reset all factors at once, or target specific providers and factor types.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user whose factors should be reset. | Required · Text |
| Provider | The MFA provider to target. Leave blank to reset all factors regardless of provider. Allowed values: Duo, Fido, Google, Okta, RSA SecurID, Symantec VIP, Yubico. |
Optional · Text |
| Factor Types | A comma-separated list of factor types to reset within the chosen provider (for example, SMS, Time Based OTP). Leave blank to reset all factor types for the chosen provider. Allowed values: Call, Email, Push, Question, SMS, Hardware OTP, HMAC OTP, Time Based OTP, Token, U2F, Web, Hardware WebAuthn. |
Optional · Text |
| Remove Recovery Enrollment | Whether to also remove the user's recovery factor enrollment when resetting. Defaults to off. | Optional · Yes/No toggle |
Note: If you specify a Provider and Factor Types combination, but no matching enrolled factor exists for that user, the action fails with an invalid factor match error. Leave both fields blank if you just want to reset everything without checking what's enrolled first.
Clear User Sessions
Terminates all active Okta sessions for a user, signing them out of all devices and browsers immediately.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user whose sessions should be cleared. | Required · Text |
Group Actions
Add User to Group
Adds an Okta user to an Okta group.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user to add. | Required · Text |
| Group ID | The Okta group name or ID to add the user to. | Required · Text |
Remove User from Group
Removes an Okta user from an Okta group.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user to remove. | Required · Text |
| Group ID | The Okta group name or ID to remove the user from. | Required · Text |
App Assignment Actions
Assign App to User
Assigns an Okta application to a user with a specified username for that app.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user. | Required · Text |
| App ID | The Okta app ID, app name, or app label to assign. | Required · Text |
| Username | The username the user will use to sign in to this specific app. | Required · Text |
Revoke App for User
Removes an Okta application assignment from a user, revoking their access to that app.
| Field | Description | Validation |
|---|---|---|
| User ID | The Okta user ID, login name, or email of the user. | Required · Text |
| App ID | The Okta app ID, app name, or app label to revoke. | Required · Text |