Add an Okta connection · SN Doc Reader

Connect Okta to AI Control Tower so that policies and AI agent containment with kill switch protocol prevent future tokens from being issued to a deactivated AI agent.

Before you begin

Confirm the following:

You have an Okta tenant with admin access to generate an API token scoped to okta.aiAgents.manage. This scope is dedicated to AI agent lifecycle operations and meets least-privilege requirements; it isn't the broader okta.users.manage scope. Requires the Okta SUPER_ADMIN role.
A security connection is already established for the platform hosting the AI agent — AWS Bedrock, AWS Bedrock Agent Core, Azure AI Foundry, Gemini Enterprise Agent Platform, or ServiceNow Agents. An Okta connection extends containment for agents whose identity is federated through one of those platforms; it doesn't replace the platform connection. See Add an AWS Bedrock or AWS Bedrock Agent Core connection or Add a Gemini Enterprise Agent Platform connection.
The AI agents you want covered are actively configured on the Okta tenant — in other words, their identity is federated through Okta.

Operation	Kill switch use case	Okta endpoint
Activate AI agent	Reinstate after investigation clearance.	`POST /api/v1/agentregistration/{id}/activate`
Deactivate AI agent	Deactivate the agent as a containment action.	`POST /api/v1/agentregistration/{id}/deactivate`
Get all agents	Discover agent inventory for targeting.	`GET /api/v1/agentregistration`

Role required: Creating the Connection Alias, credential, and HTTP connection in steps 1–3 below typically requires an instance admin or integration admin role. Creating the security connector in steps 4–6 requires sn_ai_governance.ai_steward.

About this task

An Okta connection is optional but strengthens how AI agent containment using kill switch protocol works. If an identity provider isn't connected, AI agent containment acts at the runtime platform only; existing identity provider-issued session tokens aren't revoked and new tokens aren't blocked.

When Okta is configured and the agent's identity is federated through Okta, deactivating the agent additionally prevents future tokens from being assigned to it.

Procedure

Create the Connection Alias.

Navigate to Connection & Credential Aliases (sys_alias.list) and select New.

Field	Description
Name	Descriptive name, such as `Okta Identity Sync Alias`.
Type	Select Connection.
Connection Type	Select HTTP Connection.
Is Internal	Clear this option.
Multiple Connections	Clear this option.
Retry Policy	Select Default HTTP Retry Policy.
Application / Scope	Select AI Security and Privacy.

Select Submit.

Create the API key credential.

Navigate to Credentials (discovery_credentials.list), select New, and choose credential type API Key Credentials.

Field	Description
Name	Descriptive name, such as `Okta SSWS Token - <your_okta_tenant_name>`.
Active	Select this option.
Type	Select API Key.
API Key	Your Okta API token.
API Key Prefix	`SSWS`.
Application	Select AI Security and Privacy.

Note: The SSWS prefix is automatically prepended to the token in the Authorization header. Don't include SSWS in the API Key field itself.

Select Submit.

Create the HTTP connection.

Navigate to HTTP Connections (http_connection.list), or select New from the Connections related list on the Connection Alias record you created earlier.

Field	Description
Name	Descriptive name, such as `Okta Dev Tenant - <your_okta_tenant_name>`.
Active	Select this option.
Connection URL	`https://<your_okta_tenant>.oktapreview.com`
Connection Alias	The Connection Alias record from the first step.
Credential	The API key credential from the previous step.
Protocol	https
Host	`<your_okta_tenant>.oktapreview.com`
Application Scope	Select AI Security and Privacy.
Use MID	Clear this option.
MID Selection	Select Auto select.
Mutual Auth	Clear this option.

Select Submit.

Navigate to AI Control Tower > Settings > Integrations > Control Enforcement Points.
On the Available security connectors sub-tab, select Okta.

In the Configure connector panel, fill in the fields and select Submit.

Field	Description
Name	Unique, descriptive name for this connection, such as `Okta - Dev Tenant`.
Provider Type	Select Okta.
Connection Alias	The Connection Alias you created in the first step.
Active	Select this option.

Result

The connector appears on the Established connections sub-tab. If Okta deactivation is skipped and only hyperscaler deactivation is performed, the AI agent is still effectively disabled; the Okta connection adds token-level containment on top of that.

To verify the setup:

Open the Connection Alias record and confirm the HTTP connection appears in its Connections related list.
Optionally, test the connection with a GET request to https://<tenant>.oktapreview.com/api/v1/ai-agents?limit=200``https://<tenant>.oktapreview.com/api/v1/agentregistration using the alias, and confirm a 200 OK response.

Parent Topic:Configuring security connections

title	Add an Okta connection
description	Connect Okta to AI Control Tower so that policies and AI agent containment with kill switch protocol prevent future tokens from being issued to a deactivated AI agent.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/australia/intelligent-experiences/aict-configure-okta-security-connection.html
release	australia
topic_type	task
last_updated	2026-09-10
reading_time_minutes	4
keywords	ServiceNow OttoAI Agentsgenerative AIagentic AI
breadcrumb	Configuring security connectionsConfiguring integrationsConfigureAI Control TowerEstablishing AI governanceEnable AI Experiences