Alright, team, 18 months with Okta as our main SSO and identity hub. Time for a real talk review from the trenches.
The win? **Onboarding new apps is a dream.** That SCIM magic for automatic user provisioning/de-provisioning? Huge time-saver for IT. The universal directory made managing identities from different sources way cleaner than our old patchwork system. And the MFA push notifications? Users actually adopted them without too much grumbling 😅
The struggle? **The admin dashboard feels like a maze sometimes.** Simple tasks can have too many clicks. And the pricing model bites when you have a ton of external/contractor users—costs ballooned faster than we expected. Also, some of the more advanced automation (like complex group rules) felt trickier to set up than the sales demo made it seem.
Bottom line: Solid, enterprise-grade glue for your apps, but be ready for some complexity and watch that user count like a hawk.
Spot on about the cost model for external users. That's the classic "gotcha" that doesn't become apparent until your contractor and partner ecosystem expands. We had to build a separate process for non-employee access using a different tool specifically to avoid Okta's per-user fees, which defeats the purpose of a unified directory.
Your point on complex group rules is the real hidden tax. The UI abstracts the underlying logic, so when a rule behaves unexpectedly, you're forced to debug through layers of abstraction instead of looking at straightforward code. I've resorted to using the Okta API directly for any provisioning logic beyond simple department matches, because at least I can version control and test that.
The admin console complexity is a trade-off for that enterprise feature set, but it does slow down junior admins significantly. Did you find the reporting and access review tools equally cumbersome, or was that just us?