Can I use CloudM Automate alongside Okta?

CloudM Automate does not have a direct integration with Okta, and it does not need one. Okta and CloudM Automate are separate layers on top of Google Workspace, and each has a different job. Okta creates, updates and suspends your user accounts. CloudM Automate acts on those users once they are in Google Workspace, for example with offboarding workflows, backup policies and signatures.

How the two fit together

Okta provisions users into Google Workspace, and CloudM syncs with Google Workspace in both directions. A change made in Okta therefore reaches CloudM through Google Workspace.

CloudM picks up profile changes from Google Workspace using Automatic Google profile sync. It is enabled by default. If it is turned off, profile changes can take up to 48 hours to appear in CloudM.

For details on how Okta syncs with Google, see Okta’s Google Workspace provisioning guide.

Examples

Provisioning

CloudM syncs your Google Workspace directory, so it holds every user with their profile information, the OUs they sit in and the groups they belong to. Automations can be assigned to OUs or to groups. To assign an automation to a group, the group must be a Smart Team: convert an existing group, or create a new Smart Team. A Smart Team is a Google Group with the extra settings CloudM needs to use it in automations.

When Okta creates a user in Google Workspace, CloudM picks them up with their profile information, OU and groups. If that OU or Smart Team has automations, such as an offboarding workflow, a backup policy or a signature, they apply to the user from the start.

Offboarding

When Okta suspends a user, the account is suspended in Google Workspace straight away. Google Workspace then sends CloudM a notification that the user has changed. If you have automated offboarding enabled, CloudM starts the offboarding workflow when it receives that notification.

Many customers use CloudM successfully with both Okta Workflows and Okta Identity Management.