How-to · Migrate from Okta

Migrating off Okta?
Parallel-run it. App by app.

An IdP migration is not a weekend project, and anyone who says otherwise has not done one. The good news: with both IdPs running in parallel and a per-app cutover, it is a sequence of small, reversible moves rather than one big-bang switch. Here is the honest version.

Start free trial →Open the full docs

Parallel IdP run
Per-app cutover
~8 minutes to read

Walkthrough

From Okta tenant to a clean cutover.

Six steps. The order matters: users first, apps in the middle, MFA last.

01
Export your app and user inventory
Pull the full list of applications, users, and assignments from the Okta admin console or API. Cross-check against sign-in logs: apps nobody has opened in months get retired, not migrated. The surviving list — with owners named per app — is your migration backlog.
02
Map SSO configs and groups
For each app, capture how it federates today: SAML metadata (entity IDs, ACS URLs, attribute statements) or OIDC client settings (client IDs, redirect URIs, scopes). Map Okta groups and app assignment rules to their Monosign equivalents so access policy survives the move intact.
03
Provision users into Monosign
Bring users across via SCIM or directory sync — if Okta was fed from Active Directory or another directory, point Monosign at the same source and it becomes the shared truth for both IdPs. Verify counts, group memberships, and a sample of attributes before touching any app.
Tip — Passwords generally cannot be exported from Okta. Plan for directory-backed authentication or a first-login reset flow — decide this now, not during cutover.
04
Run both IdPs in parallel, cut over per app
Keep Okta serving everything while Monosign takes apps one at a time, starting with a low-stakes pilot. Register the app in Monosign with the mapped config, re-point the app, test with real users, then move to the next. At no point does anyone depend on a half-migrated IdP.
Tip — Watch for hard-coded issuer URLs: apps that pin the Okta issuer, JWKS endpoint, or SAML entity ID in code or config will break silently. Grep your config repos for your okta.com domain before each cutover.
05
Migrate MFA enrollments last
MFA factors do not transfer between IdPs — TOTP seeds and passkeys are bound to the old tenant, so users will re-enroll their factors in Monosign. That is the honest reality of every IdP migration. Schedule it per user group with clear comms, and keep it last so users re-enroll exactly once.
06
Verify, then retire the Okta tenant
When Okta sign-in logs go quiet, do a final sweep: no active app assignments, no API tokens in use, no lingering SCIM connections. Then deactivate the apps, let the contract lapse, and archive the tenant export for your audit records.