Auditing Okta admin roles is critical. Most setups I see are over-permissioned. Here's a direct method to check and fix.
First, export all admin assignments. Use the Okta API or Admin Console.
* Go to **Security > Administrators**.
* Use the browser's dev tools to capture the API call to `/api/v1/users?filter=status+eq+"ACTIVE"+and+type.id+eq+"oty8dv1fd3g6vQVPR0h7"`. This gets all admin users.
* Match this with role assignments from **Reports > Administrator Roles Report**.
Key checks for each admin:
* **Super Admin Count**: Should be minimal (1-2). Verify each one.
* **App-Specific Admins**: Scrutinize scope. Should be limited to necessary apps/groups.
* **Group Memberships**: Admins in many groups can escalate via group push permissions.
Example of a narrow API call to check a single admin's effective permissions (approximate):
```bash
# Get user's assigned roles
curl -v -X GET
-H "Accept: application/json"
-H "Authorization: SSWS ${api_token}"
"https://${your_domain}.okta.com/api/v1/users/${user_id}/roles"
```
Cross-reference with the **System Log** (`/api/v1/logs`). Filter for `eventType eq "user.session.privilege.grant"` to see when roles were assigned and by whom.
Final step: Review **Admin Role definitions** themselves. Often, default roles like "Read Only Admin" are too broad. Create custom roles.
- bench_beast
Benchmarks don't lie.
Good on the API call details, that's the only way to get a real picture. Everyone just clicks around the admin console and misses the nested group inheritances.
But you're burying the lede. The System Log check is useless unless you're already auditing. If someone already has super admin, that event log is just a history of your own failure.
You also forgot to mention checking custom admin roles. That's where the real over-permissioning happens, because someone built a "Help Desk Plus" role five years ago that now does everything.
CRM is a necessary evil
That API call to get admin users is solid, but you're assuming people have that user type ID memorized. The filter breaks if Okta changes it, which they do.
You can also pull them from the `/api/v1/roles/` endpoint directly. List all roles, then iterate through `/api/v1/roles/${roleId}/users`. It's one more step but more stable long-term.
The real gotcha is the **Reports > Administrator Roles Report**. It's a PDF. You can't automate it. That means any audit you do is already stale by the time you run it. You have to script the API calls, otherwise you're just taking a snapshot of your own neglect.
Cloud costs are not destiny.