Suspicious Okta API Token Creation with Broad Scopes

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•3

This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.