---
title: Okta user gains administrator role and creates new IDP connection
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Okta user gains administrator role and
  creates new IDP connection
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Okta user gains administrator role and creates new IDP connection
Classification:attackTactic:[TA0004-privilege-escalation](https://attack.mitre.org/tactics/TA0004)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects when a user receives an Okta administrator role and then creates an Identity Provider connection.

## Strategy{% #strategy %}

This rule monitors successful `user.account.privilege.grant` events that assign a Super Administrator or Organization Administrator role, followed by a successful `system.idp.lifecycle.create` event from the same user. This sequence can establish unauthorized control over authentication and access to connected applications.

## Triage and response{% #triage-and-response %}

- Confirm that the administrator role granted to `{{@target.alternateId}}` was authorized.
- Verify that `{{@actor.alternateId}}` created the Identity Provider connection for an approved business purpose.
- Review the new Identity Provider configuration, routing rules, signing certificates, and assigned users or groups.
- Examine authentication, session, IP address, user-agent, and administrative activity associated with the user.
- Disable unauthorized Identity Provider connections, revoke suspicious sessions, and reset affected credentials.