Okta Certified Administrator · Part I

Identity and Access Management

36% of the exam — the single largest domain.

Identity & Access Management

Module 2: Single Sign-On (SSO) Federation

4 sub-topics · this deck covers sub-topic 4 of 4 — the last one in this module

The Exam Bullet

"Demonstrate knowledge of Org2Org use cases"

Sometimes the "other identity system" is just... another Okta org. Org2Org is Okta's own app for connecting two Okta orgs to each other — this sub-topic is about when and how that connection gets built.

The Mechanism

Org2Org enables authentication and optional user provisioning between a source (spoke) org and a target (hub) org. The integration is installed and configured in the source org.

The Federation Options

OIDC (recommended) — install the Org2Org app in the source org pointing at the target org's domain, create an OIDC identity provider in the target org, then add that IdP's ID back into the source org's settings.

SAML (alternative) — a similar setup, but SAML assertion encryption isn't supported for this integration, and the IdP issuer URI and certificate values must be configured manually.

The Provisioning Methods

OAuth 2.0 with Auto-Rotation (recommended) — key management handled automatically via dynamic URL fetching.

OAuth 2.0 with Manual Keys — requires configuring API credentials and rotating keys by hand.

API Token — simpler setup using a security token generated in the target org.

The Settings

Once provisioning is wired up, several settings control the actual behavior:

User creation (auto-provision assigned users) · Group import/push · Initial user status (active w/ password, pending, etc.) · Attribute mapping · Hide app from End-User Dashboard

The Exam Angle

Watch for scenario questions built around these traps:

→ "Two Okta orgs need to share identities, no external IdP involved." = Org2Org, not a generic SAML/OIDC IdP setup.

→ "The SAML federation option needs encrypted assertions." = not supported — use OIDC instead, or accept unencrypted SAML.

→ "Key rotation needs to happen automatically." = OAuth 2.0 with Auto-Rotation, the recommended provisioning method.

One Line To Remember

Org2Org connects a source (spoke) org to a target (hub) org, configured in the source org. OIDC federation is recommended over SAML (which can't encrypt assertions). Provisioning: OAuth2 auto-rotation (recommended), OAuth2 manual keys, or API Token. Settings control user creation, group sync, initial status, and dashboard visibility.

Sources: help.okta.com — org2org-main.htm · org2org-integrate.htm

✓ Module 2: SSO Federation — complete (4 of 4 sub-topics)