Okta Certified Administrator · Part II
Administrator Roles
20% of Part II — permission scoping, not just access.
The Task
"Assign users to the admin role"
Creating a role (Task 1) doesn't do anything by itself — it has to actually be assigned to someone for that constrained permission set to take effect.
The Mechanism
You can "create and assign those roles to the users, groups, and apps in your org" — either through custom administrator roles (granular permissions) or standard role assignments.
Other Setup Capabilities in the Same Area
Custom Administrator Roles · Standard role assignments · Help desk administrator configuration · Third-party administrator management · Email notification settings for admin roles · MFA enforcement for Admin Console access
Two worth flagging specifically: Help Desk Administrator is its own distinct, narrower configuration — and admins can require MFA specifically for Admin Console access, on top of whatever MFA policy applies elsewhere.
The Honest Gap
This source is largely navigational — it lists the available setup capabilities but doesn't detail exactly what permissions each standard role includes. That level of detail lives in the individual standard-role subtopics, not summarized here. No specific permission list is invented to fill this gap.
The Angle — What Trips People Up
Watch for this in your own sandbox run:
→ Assuming a role assignment is "live" the moment the role exists — it isn't until it's actually assigned to a user, group, or app.
One Line To Remember
Roles (custom or standard) must be assigned to users/groups/apps to take effect — creating one alone does nothing. The same admin setup area also covers Help Desk admin, third-party admin management, email notifications, and MFA enforcement specifically for Admin Console access.
Sources: help.okta.com — administrators-set-up-admins.htm
Next: Task 3 →