| Okta_AddMember | ✅ | Ability to add or remove members in scoped Okta groups |
| Okta_AgentMemberOf | ✅ | Membership of an Okta agent in an agent pool |
| Okta_AgentPoolFor | ✅ | Relationship between an AD agent pool and its backing AD application |
| Okta_ApiTokenFor | ✅ | User ownership of an Okta API token |
| Okta_AppAdmin | ✅ | Application administrator role assignment |
| Okta_AppAssignment | ❌ | Assignment of users or groups to an Okta application |
| Okta_Contains | ✅ | Contains relationship between the Okta organization and its objects |
| Okta_CreatorOf | ❌ | Creator relationship for API service integrations |
| Okta_DeviceOf | ❌ | Ownership relationship between a device and its assigned user |
| Okta_GroupAdmin | ✅ | Group administrator role assignment |
| Okta_GroupMembershipAdmin | ✅ | Group membership administrator role assignment |
| Okta_GroupPull | ✅ | Import of group memberships from an external application |
| Okta_GroupPush | ❌ | Provisioning of group memberships to an external application |
| Okta_HasRole | ❌ | Assignment of a built-in or custom role to a principal |
| Okta_HasRoleAssignment | ❌ | Relationship between a principal and a role assignment |
| Okta_HelpDeskAdmin | ✅ | Help desk administrator role assignment |
| Okta_HostsAgent | ✅ | Relationship between an AD server and the Okta agent running on that host |
| Okta_IdentityProviderFor | ✅ | Trust relationship between an identity provider and Okta users |
| Okta_IdpGroupAssignment | ❌ | Identity provider group assignment to an Okta group |
| Okta_InboundOrgSSO | ✅ | Single sign-on from an external organization into Okta |
| Okta_InboundSSO | ✅ | Single sign-on from an external identity provider into Okta |
| Okta_KerberosSSO | ✅ | Agentless desktop SSO relationship from on-prem AD user account to Okta AD application |
| Okta_KeyOf | ✅ | JSON Web Key associated with an Okta application |
| Okta_ManageApp | ✅ | Ability to manage scoped Okta applications |
| Okta_ManagerOf | ❌ | Manager relationship between Okta users |
| Okta_MemberOf | ✅ | Membership of a user in an Okta group |
| Okta_MembershipSync | ✅ | Bidirectional synchronization between Okta groups and external groups |
| Okta_MobileAdmin | ✅ | Mobile administrator role assignment |
| Okta_OrgAdmin | ✅ | Organization administrator role assignment |
| Okta_OrgSWA | ❌ | Secure Web Authentication from an Okta application to an external organization |
| Okta_OutboundOrgSSO | ✅ | Single sign-on from an Okta application to an external organization |
| Okta_OutboundSSO | ✅ | Single sign-on from Okta to an external identity provider |
| Okta_PasswordSync | ✅ | Password synchronization between user accounts via AD integration, Org2Org, or SCIM |
| Okta_PolicyMapping | ❌ | Association of a policy with an Okta application |
| Okta_ReadClientSecret | ✅ | Ability to read client secrets for scoped Okta applications |
| Okta_ReadPasswordUpdates | ✅ | Application can read password updates over the SCIM protocol |
| Okta_RealmContains | ✅ | Contains relationship between an Okta realm and its users |
| Okta_ResetFactors | ✅ | Ability to reset MFA factors for scoped Okta users |
| Okta_ResetPassword | ✅ | Ability to reset passwords or temporary credentials for scoped Okta users |
| Okta_ResourceSetContains | ✅ | Membership of objects within an Okta resource set |
| Okta_ScopedTo | ❌ | Scope relationship between a role assignment and its target |
| Okta_SecretOf | ✅ | Client secret associated with an application or service integration |
| Okta_SuperAdmin | ✅ | Super administrator role assignment |
| Okta_SWA | ❌ | Secure Web Authentication from Okta to an external application |
| Okta_UserPull | ❌ | Import of users from an external application |
| Okta_UserPush | ❌ | Provisioning of users to an external application |
| Okta_UserSync | ❌ | Bidirectional synchronization between Okta users and external identities |
