Liongard Okta Read

Answer an Okta question for CLIENT_NAME from the Liongard Okta inspector. Read-only — role removals, policy changes, and deactivations route to a technician.

1. Find the Okta inspector for this client and confirm it ran recently; date the data.
2. Read the values from its latest dataprint, verifying every field angle against the live dataprint (Okta field names — Status, Factors, Profile — vary by inspector version):
   - Admins → admin role assignments, Super Administrator first, then Org/App/Group admins. Small dedicated count, every entry explainable; unexplained recent grants escalate immediately — a Super Admin can rewrite MFA policy and app assignments tenant-wide.
   - MFA policy → the authentication/sign-on policy sections: which factors are enforced, for which groups, and which rules carve out exceptions. The exceptions ARE the audit — a strict default with a legacy rule excluding a group is the finding. Also read per-user enrolled factors (angle to verify: active users with zero enrolled factors). Never summarize a policy by its default rule alone.
   - App assignments → apps and their assigned users/groups. For an access review, per-user app list; for rationalization, apps with zero active assignments. Group-based assignment means group membership is the real access — trace it, don't stop at direct assignments.
   - Lifecycle hygiene → users by status (ACTIVE, SUSPENDED, DEPROVISIONED, long-lived PROVISIONED/STAGED). Suspended-for-months accounts get the offboarding cross-check against ticket history — suspended is reversible and keeps app grants in limbo.
   - Changes → check what changed for admin grants, policy modifications, app additions.
   - Open-ended → ask in plain language, verified with targeted reads.
3. When Okta is fed by AD or HR, reconcile against the cross-system identity view / the AD read — active in Okta but disabled at the source (or vice versa) is a sync/offboarding gap. Unexplained Super Admin grants are live leads, not report lines — verify with the client's authorized contact; unclaimed → account-takeover footing.
4. Output: answer, evidence, data as-of timestamp, policy-exception findings stated explicitly. Leave a plain-text note on request. Degradation: no Okta inspector → documentation and ticket history only, labeled "not instrumented"; for an Okta-fronted client, recommend the inspector — it's the single highest-leverage read for that stack.