Synthèse
Workflows in Okta provide a robust way to automate tasks related to user provisioning and deprovisioning. To achieve this, Okta must be granted non-trivial permissions in connected systems. Here is an example of permissions needed by the Microsoft Office 365 connector: Figure 17. Example Okta Workflows connector permissions. Anyone in control of the workflow could perform administrative actions in Microsoft Entra. As there is no documented API for reading the information about existing workflows
Workflows in Okta provide a robust way to automate tasks related to user provisioning and deprovisioning. To achieve this, Okta must be granted non-trivial permissions in connected systems. Here is an example of permissions needed by the Microsoft Office 365 connector: Figure 17. Example Okta Workflows connector permissions. Anyone in control of the workflow could perform administrative actions in Microsoft Entra.
As there is no documented API for reading the information about existing workflows and their configuration, workflows are currently absent in our security model. BloodHound can only be used to analyze the Workflow Administrators role assignment: Figure 18. BloodHound view for Okta Workflow Administrators role assignment.