Work with people Okta manages
For organization Admins in an account that uses Okta. How to spot a member Okta manages, what you can still change, what to ask IT for, why an invite can be refused, and what happens when someone leaves.
Who can do this: Organization admins · Web and desktop
When your account uses Okta, your IT team decides in Okta who belongs to which organization, with which role, and on which teams. The account's rules turn Okta groups and attributes into BloomText access. As an organization Admin you still run your organization day to day. This page shows what Okta manages, what you can still do, and what to ask IT for.
How to tell who Okta manages
On your organization's Members tab, a person Okta manages has:
- an Okta badge next to their name, and
- 🔒 Managed by Okta where Manage and Remove would be.
Okta-managed people have no Manage or Remove, and no Resend invite: Okta brings them in through single sign-on, not an email invite.
Other locks you may see:
- 🔒 Managed by API, or 🔒 Managed by API: and a key's name: an API key added them, and your company's system manages them through the API.
- 🔒 Set on the Account page: an Owner or IT person. Their access is set on the Account page.
What you can still do
- Add an Okta-managed person to more teams in your organization. See Create, edit and delete teams.
- Approve or decline join requests labeled via SSO. Someone Okta let in before a rule placed them asks to join your account's default organization. See Approve join requests and find members.
- Manage people outside Okta, such as contractors, the usual way: invite them, change their role, remove them. See Change a member's role or title, or remove them.
What to ask IT for
Ask your IT team, and give them the person's name and the change, for:
- A different role. Rules give Admin or User. IT changes the person's Okta group or attributes, or the rule.
- Another organization, or leaving one. Same: IT changes their Okta group or attributes, or the rules.
- Teams a rule set. IT changes the rule's teams.
- Owner or IT. Rules never give these. An account Owner sets them on the Account page.
Changes from Okta reach BloomText within 5 minutes.
When an invite is refused
Your account can stop organization Admins inviting people who aren't in Okta. Then inviting someone who isn't in Okta says:
Your account only lets Owners and IT add people who aren't in Okta. Ask them to add this person.
Ask an Owner or IT person to add them, or ask IT to add them to Okta.
When someone leaves
IT deactivates them in Okta. Within 5 minutes BloomText removes them from every organization on the account, including memberships and teams an Admin added by hand, and signs them out on every device. You don't need to remove them yourself.
This works for people whose BloomText email matches Okta. If someone who left still shows on your Members tab without 🔒 Managed by Okta, remove them yourself.
Your own role
If a rule made you an Admin, your own membership shows 🔒 Managed by Okta too. To change your role, ask IT.
Related
- Okta setup guide for IT
- Change a member's role or title, or remove them
- Invite teammates and choose their role
- Approve join requests and find members
- Sign in with Okta single sign-on (SSO)
Referenced by
Okta setup guide for IT
How IT connects Okta to a BloomText account, maps Okta groups and attributes to organizations, roles and teams with rules, tests the result, and what BloomText does when someone changes or leaves in Okta.
See which messages the API sent
Messages your own systems send through the BloomText API show the key's name and an API label. Owners and IT create, see and revoke keys on the Account page.