---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Add an Okta connection

# Add an Okta connection {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Connect Okta to AI Control Tower so that policies and AI agent containment with kill switch protocol prevent future tokens from being issued to a deactivated AI agent.

## Before you begin

Confirm the following:

* You have an Okta tenant with admin access to generate an API token scoped to `okta.aiAgents.manage`. This scope is dedicated to AI agent lifecycle operations and meets least-privilege requirements; it isn't the broader `okta.users.manage` scope. Requires the Okta `SUPER_ADMIN` role.
* A security connection is already established for the platform hosting the AI agent --- AWS Bedrock, AWS Bedrock Agent Core, Azure AI Foundry, Gemini Enterprise Agent Platform, or ServiceNow Agents. An Okta connection extends containment for agents whose identity is federated through one of those platforms; it doesn't replace the platform connection. See [Add an AWS Bedrock or AWS Bedrock Agent Core connection](https://www.servicenow.com/docs/Ij3pGbATG~qiP6SqBMqjVg "Connect AWS Bedrock or AWS Bedrock Agent Core to AI Control Tower so policies and AI agent containment using kill switch protocol can reach and act on agents running on AWS.") or [Add a Gemini Enterprise Agent Platform connection](https://www.servicenow.com/docs/J3gPukzLg2roDKGOM04X6w "Connect Gemini Enterprise Agent Platform to AI Control Tower using a service account and OAuth 2.0 JWT Bearer authentication, so policies and AI agent containment using kill switch protocol can reach and act on agents running on Gemini Enterprise Agent Platform.").
* The AI agents you want covered are actively configured on the Okta tenant --- in other words, their identity is federated through Okta.

{#aict-configure-okta-connection__table_okta_scope_apis__entry__3}

| Operation | Kill switch use case | Okta endpoint |
|-|-|-|
| Activate AI agent | Reinstate after investigation clearance. | `POST /api/v1/agentregistration/{id}/activate` |
| Deactivate AI agent | Deactivate the agent as a containment action. | `POST /api/v1/agentregistration/{id}/deactivate` |
| Get all agents | Discover agent inventory for targeting. | `GET /api/v1/agentregistration` |
[Table 1. APIs covered by the okta.aiAgents.manage scope]

{#aict-configure-okta-connection__table_okta_scope_apis}

Role required: Creating the Connection Alias, credential, and HTTP connection in steps 1--3 below typically requires an instance admin or integration admin role. Creating the security connector in steps 4--6 requires
sn_ai_governance.ai_steward.

## About this task

An Okta connection is optional but strengthens how AI agent containment using kill switch protocol works. If an identity provider isn't connected, AI agent containment acts at the runtime platform only; existing identity
provider-issued session tokens aren't revoked and new tokens aren't blocked.

When Okta is configured and the agent's identity is federated through Okta, deactivating the agent additionally prevents future tokens from being assigned to it.

## Procedure

1. Create the Connection Alias.  
   Navigate to Connection \& Credential Aliases
   (`sys_alias.list`) and select New.
   {#aict-configure-okta-connection__table_okta_alias_fields__entry__2}

   | Field | Description |
   |-|-|
   | Name | Descriptive name, such as `Okta Identity Sync Alias`. |
   | Type | Select Connection. |
   | Connection Type | Select HTTP Connection. |
   | Is Internal | Clear this option. |
   | Multiple Connections | Clear this option. |
   | Retry Policy | Select Default HTTP Retry Policy. |
   | Application / Scope | Select AI Security and Privacy. |
   [Table 2. Okta Connection Alias fields]

   {#aict-configure-okta-connection__table_okta_alias_fields}

   Select Submit.
2. Create the API key credential.  
   Navigate to Credentials
   (`discovery_credentials.list`), select New, and
   choose credential type API Key Credentials.
   {#aict-configure-okta-connection__table_okta_credential_fields__entry__2}

   | Field | Description |
   |-|-|
   | Name | Descriptive name, such as `Okta SSWS Token - <your_okta_tenant_name>`. |
   | Active | Select this option. |
   | Type | Select API Key. |
   | API Key | Your Okta API token. |
   | API Key Prefix | `SSWS`. |
   | Application | Select AI Security and Privacy. |
   [Table 3. Okta API key credential fields]

   {#aict-configure-okta-connection__table_okta_credential_fields}  
   Note:  
   The `SSWS` prefix is automatically prepended to the token in the Authorization header. Don't include `SSWS` in the API Key field itself.

   Select Submit.
3. Create the HTTP connection.  
   Navigate to HTTP Connections
   (`http_connection.list`), or select New from the
   Connections related list on the Connection Alias record you
   created earlier.
   {#aict-configure-okta-connection__table_okta_http_fields__entry__2}

   | Field | Description |
   |-|-|
   | Name | Descriptive name, such as `Okta Dev Tenant - <your_okta_tenant_name>`. |
   | Active | Select this option. |
   | Connection URL | `https://<your_okta_tenant>.oktapreview.com` |
   | Connection Alias | The Connection Alias record from the first step. |
   | Credential | The API key credential from the previous step. |
   | Protocol | https |
   | Host | `<your_okta_tenant>.oktapreview.com` |
   | Application Scope | Select AI Security and Privacy. |
   | Use MID | Clear this option. |
   | MID Selection | Select Auto select. |
   | Mutual Auth | Clear this option. |
   [Table 4. Okta HTTP connection fields]

   {#aict-configure-okta-connection__table_okta_http_fields}

   Select Submit.
4. Navigate to AI Control TowerSettingsIntegrationsControl Enforcement Points.
5. On the Available security connectors sub-tab, select Okta.
6. In the Configure connector panel, fill in the fields and select Submit.  
   {#aict-configure-okta-connection__table_okta_connector_fields__entry__2}

   | Field | Description |
   |-|-|
   | Name | Unique, descriptive name for this connection, such as `Okta - Dev Tenant`. |
   | Provider Type | Select Okta. |
   | Connection Alias | The Connection Alias you created in the first step. |
   | Active | Select this option. |
   [Table 5. Okta security connector fields]

   {#aict-configure-okta-connection__table_okta_connector_fields}
{#aict-configure-okta-connection__steps_okta}

## Result

The connector appears on the Established connections sub-tab. If
Okta deactivation is skipped and only hyperscaler deactivation is performed, the AI agent
is still effectively disabled; the Okta connection adds token-level containment on top of
that.

To verify the setup:

* Open the Connection Alias record and confirm the HTTP connection appears in its Connections related list.
* Optionally, test the connection with a GET request to `https://<tenant>.oktapreview.com/api/v1/ai-agents?limit=200``https://<tenant>.oktapreview.com/api/v1/agentregistration` using the alias, and confirm a `200 OK` response.

*[\>]: and then