Okta_RoleAssignment

A set of permissions assigned to a user, group, or an application in Okta

Overview

To help visualize role assignments in BloodHound, OktaHound creates Okta_RoleAssignment nodes for each role assignment in Okta. These nodes represent the relationship between a user, group, or application and a role (built-in or custom).

Edges

The tables below list edges defined by the OktaHound extension only. Additional edges to or from this node may be created by other extensions.

Inbound Edges

Edge Type	Source Node Types	Traversable
Okta_Contains	Okta_Organization	✅
Okta_HasRoleAssignment	Okta_User, Okta_Group, Okta_Application	❌

Outbound Edges

Edge Type	Destination Node Types	Traversable
Okta_ScopedTo	Okta_Organization, Okta_User, Okta_Group, Okta_ResourceSet, Okta_Application, Okta_ApiServiceIntegration, Okta_Device, Okta_AuthorizationServer	❌

Properties

Name	Source	Type	Description
id	roleAssignment.id + "_" + assignee.id	string	Unique role-assignment identifier derived from role assignment and assignee IDs.
name	roleAssignment.label	string	Role name associated with this assignment.
displayName	roleAssignment.label	string	Display label used in BloodHound.
oktaDomain	Collector context (non-API)	string	Okta organization domain where the role assignment exists.
assignmentType	roleAssignment.assignmentType	string	Assignment scope/type (for example user or group assignment).
type	roleAssignment.type	string	Assigned role identifier (for example WORKFLOWS_ADMIN, APP_ADMIN).
status	roleAssignment.status	string	Role assignment lifecycle status.
created	roleAssignment.created	datetime	Role assignment creation timestamp.
lastUpdated	roleAssignment.lastUpdated	datetime	Last role assignment update timestamp.

Sample Property Values

id: irbwnwe8vjjXl4FbX697_00uw2sodowQc75SUm697
name: Workflows Administrator
displayName: Workflows Administrator
oktaDomain: contoso.okta.com
assignmentType: USER
type: WORKFLOWS_ADMIN
status: ACTIVE
created: 2025-10-22T13:29:26+00:00
lastUpdated: 2025-10-22T13:29:26+00:00