Okta Identity Provider Created

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•1•0•28

Detects when a new identity provider is created in Okta. This activity can be a legitimate administrative action but could also indicate an attacker attempting to establish persistence or bypass authentication mechanisms by creating a rogue identity provider.