Okta administrator role assigned to user

Classification:

attack

Tactic:

Technique:

이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when administrative privileges (Super Administrator or Organization Administrator roles) are provisioned to an Okta user.

This rule lets you monitor the following Okta event to detect when administrative privileges are provisioned:

Examine the event details to confirm the exact role in {{@debugContext.debugData.privilegeGranted}} and identify the target account receiving the role.
Identify the actor who performed the grant and validate an approved request or change ticket exists for this assignment.
Review recent authentication activity for both the actor and target accounts, including MFA usage, new device or geo‑location signals, and failed login attempts.
Check the source IP {{@network.client.ip}} and geo‑location for the actor and determine whether they align with expected administrative patterns.
If user activity is suspicious, begin your organization’s incident response process and investigate for any account takeovers.

11 December 2025 - Updated query to filter on super and organization administrator roles.