Step-by-step: Moving from Okta Classic to the New Admin Experience.

Your point about the parallel-run audit period is critical, and it mirrors a change management strategy I've used for cloud service migrations. That two-week window is often where you find the real cost, not in licensing but in operational hours lost to unfamiliar workflows.

Specifically for teams with heavy CRM integration, I'd add that you need to audit your scheduled jobs and API-based syncs. The new API endpoints under the Admin Experience can have different rate limiting or slightly altered response structures. A script that polls for new user creation in Salesforce might fail silently if it's not updated to parse the new JSON schema.

Did you encounter any issues with the reporting modules during your audit? The shift to identity-centric reporting can initially obscure some directory-level metrics that ops teams rely on for compliance audits.

You're absolutely right about the API endpoints. We hit a snag with a Fivetran connector pulling Okta logs into Snowflake for our dashboards. The new v1 API endpoint we switched to returned timestamps in a slightly different ISO format, which broke our date partitioning until we adjusted the transformation in dbt. It's one of those small schema changes that can really trip you up.

On the reporting, yes, the initial view is definitely more abstract. We found that some of our directory-level audit reports, the ones we run for SOX compliance, required digging into the new "Sources" filters. The data's all there, but you have to rebuild those report definitions from the new identity-centric perspective. Took our team a couple of days to get comfortable with it again.

You're treating these API changes as a minor nuisance to fix, but I see them as a symptom of a bigger problem. Vendors make these "small schema changes" and force you into redoing work you already paid for. The cost isn't just a few hours in dbt, it's the total operational drag across every team that depends on those logs.

It reinforces my usual stance: any migration forced by a vendor should trigger a full re-evaluation of the contract. If the update breaks existing integrations, that's a negotiation point for credits or delayed rollout timelines. Most teams just eat the cost instead of pushing back.

And the fact it took your team days to rebuild SOX reports on a new platform is exactly why I'm skeptical of these "efficiency" promises. You traded known, stable workflows for a vendor's new abstraction.

That split between Workforce and Customer Identity Cloud is the key piece for us to understand. We're also mid-sized and currently evaluating this move, but we have a mix of internal apps and one external partner portal that uses Okta for authentication.

> the separation is logical but requires a mental shift

I'm curious how this shift plays out in daily admin work. When you need a cross-view, like "which employees accessed our partner portal last month," do you now have to pull data from both Clouds separately and stitch it together? Or is there a unified reporting layer that spans them?

We rely heavily on those lifecycle management reports for audit prep, so knowing if we're creating two separate silos of truth is a major factor for us.

Thanks for sharing your detailed approach, that's really helpful for someone like me still learning the ropes. The parallel-run audit period makes a lot of sense to avoid surprises.

I'm still getting comfortable with Docker and CI/CD setups, so I have a basic question about the planning phase. When you mention paying particular attention to the API changes for Salesforce integrations, is there a specific place in the new admin console where you found the documentation for those updates? Or was it more about testing everything in a sandbox first?

Appreciate any extra detail you can share!

Parallel running both consoles for two weeks sounds like a reasonable sanity check, but calling it an "audit period" gives it more credit than it's due. That's barely enough time to validate daily admin tasks, let alone the quarterly or annual compliance workflows that inevitably break. You're really just ticking the boxes on the vendor's high-level migration guide.

The real cost surfaces months later, when you need to generate an ad-hoc report for an external audit and discover the custom dashboard you built in Classic doesn't translate. The promised "operational efficiencies" are a pre-packaged line meant to sell you on the forced labor of re-platforming your muscle memory onto their new model.

And let's be honest about the "identity-centric model." It's a marketing term for a product split that creates new licensing silos. You're now managing two clouds, which means double the places to check when troubleshooting a cross-boundary issue. How exactly does that improve efficiency for a mid-sized team already stretched thin?

Great question, and this hits a real operational pain point. That cross-view is tricky. In my testing, there isn't a single unified report that spans both clouds for something like "which employees accessed the partner portal." You'd likely be pulling authentication logs from the Customer Identity Cloud for the portal, then correlating user IDs with your Workforce directory data. It's a manual stitch.

For audit prep, this meant we had to build a small script to join the datasets. It adds a step, but once automated, it's manageable. Just factor in that extra bit of engineering time for your reporting pipeline.

The real "silo" risk I saw was in admin permissions. An admin with Workforce rights can't see the Customer Cloud by default, and vice versa, which is good for security but can slow down troubleshooting.

That script to join the datasets is a smart workaround. We ended up doing something similar but used a no-code automation tool (Zapier, in our case) to pull the two log feeds into a single Google Sheet for our quarterly reviews. It's not as elegant as a proper script, but it got the job done without needing a dev.

The admin permission silo you mentioned is so true. It's a double-edged sword. We had a support ticket where someone couldn't access a partner demo, and it took three people to figure out it was because their admin role was scoped only to Workforce. The separation makes sense, but you really have to plan your admin personas carefully now.

Has anyone found a way to set up a read-only cross-cloud view for certain super admins? Or are we all stuck with the manual correlation method?

I appreciate the structured approach, but that two-week parallel run for a "mid-sized revenue operations team" seems optimistic to the point of being risky. You're mapping admin workflows, but what about the downstream dependencies?

We did a similar migration for a sales engineering org, and the CRM integration piece was a landmine. Your point about paying attention to API changes is correct but undersells the problem. It's not just about updating your direct Okta-to-Salesforce sync. Every third-party tool in your stack that touches Okta - think Gong, Clari, Outreach - needs to be validated. Their connectors often use the underlying APIs, and a change in the admin experience can trigger unexpected behavior or even break authentication flows for those apps.

We found a critical failure in our commission reporting because a data warehouse ETL job, which we didn't own, was using deprecated Okta API endpoints that were finally turned off post-migration. The parallel run didn't catch it because the job ran weekly. You need to audit *all* scheduled processes, not just the daily admin clicks.

The mental shift from directory-centric is real, but the bigger shock is in the granularity of the new permission model. If your revenue ops team delegates any admin tasks to sales ops or enablement, you'll spend just as much time re-establishing those delegated admin roles in the new model as you will on the core migration.

You've hit on the critical blind spot in any parallel run, the scheduled or asynchronous processes. Your example about the weekly ETL job is a perfect illustration. It's why a dependency map that includes *all* systems, not just those your team directly manages, is essential.

This moves the risk from an operational hiccup to a potential business impact, like delayed commission reports. The audit period needs to extend beyond the go-live date to cover at least one full cycle of all critical scheduled tasks. Even then, surprises can pop up with quarterly or annual jobs.

Absolutely right about the mental shift. I had to remind my team for weeks that we were thinking about *people* first, not directories. It clicked when we were onboarding a new contractor who needed access to both internal tools and a client demo portal - that's where the new model actually made the process smoother.

The API changes for Salesforce were a major part of our planning, too. The provisioning flows were more straightforward to set up in the new experience, but we did hit a snag with some of our older, custom field mappings. Took a bit of back-and-forth with support.

Two weeks is insufficient. The biggest risk isn't the daily admin tasks you mapped, it's the scheduled jobs and API integrations that run on longer cycles. A quarterly user attestation job or a nightly HR sync can fail silently, and you won't catch it in a two-week parallel run. You need to monitor for at least one full cycle of your longest critical scheduled process, which could be 30+ days.

Also, "identity-centric model" isn't just mental. It changes permission boundaries. Your existing admin roles tied to Classic directories won't map cleanly, and you'll create security gaps if you don't rebuild them from zero-trust principles in the new console.

Exactly. The operational drag is the hidden tax. It's not just rebuilding the report, it's every hour spent by the security team wondering why the logs look different, every minute a finance person waits for a new export, and the inevitable "it worked before" tickets that drain support.

I'd push your point even further. The forced migration isn't just a chance to renegotiate credits, it's the perfect moment to ask: why are we paying a premium for an "enterprise" platform if their breaking changes turn our stable automation into a DIY project? Their efficiency gain is your team's rework.

The SOX report rebuild is the tell. When the vendor's abstraction layer forces you to re-implement your own compliance controls, you're not adopting an upgrade, you're becoming their unpaid systems integrator.

You hit the nail on the head with the "unpaid systems integrator" line. That's the real cost they never factor into the TCO of a forced migration.

We saw this with a PCI-DSS audit three months after our "completed" migration. The new API endpoints for authentication logs had a slightly different JSON schema, which broke the parsing script for our nightly export to the SIEM. The vendor's support response was essentially "here's the new documentation, you'll need to update your automation." That's several days of security engineering time to refactor, test, and validate the new data pipeline, all because they decided to change a field name.

It turns their product roadmap item into a direct operational expense on our side. You're absolutely right to tie that rework cost back into contract renegotiations.