← Course Home
Okta Certified Administrator · Part II

Administrator Roles

20% of Part II — permission scoping, not just access.

Administrator Roles

Task 1: Create a Custom Admin Role

4 tasks · this deck covers task 1 of 4

↑ Administrator Roles Overview

The Task

"Create a custom admin role"

Okta's standard admin roles are broad. When a job only needs a slice of that power, a custom role is how you build exactly that slice.

The Mechanism

A role is "a set of permissions that you constrain an admin to." Two types exist: standard and custom. Currently, custom roles are limited to managing user, group, and app activity, plus running profile source imports — broader admin permissions aren't yet supported for custom roles.

What Makes Custom Roles Different — Resource Sets

Resource sets are only available for custom admin roles — this is the real distinguishing feature. A resource set lets you constrain a role to a specific collection of resources, instead of granting it org-wide reach.

You can build an assignment starting from any of three components: the Admin (user/group), the Role (permission set), or the Resource set (resource collection) — whichever makes sense for how you're thinking about the assignment.

The Gotcha — Real Limits

Max 100 custom roles per org
Max 10,000 resource sets
Max 1,000 resources per resource set
Max 1,000 admins sharing the same role + resource-set combination

These aren't soft guidelines — plan a scalable role/resource-set naming and structure strategy before you hit them.

The Angle — What Trips People Up

Watch for these in your own sandbox run:

→ Trying to grant a custom role permissions beyond user/group/app management + profile source imports — not currently supported.

→ Assuming standard roles can be scoped to a resource set — that's a custom-role-only feature.

One Line To Remember

Custom roles constrain permissions to user/group/app management + profile source imports, and are the only role type that supports resource sets (scoping to a specific resource collection). Real limits: 100 roles/org, 10,000 resource sets, 1,000 resources/set, 1,000 admins per role+resource-set combo.

Sources: help.okta.com — about-creating-custom-admin-roles.htm