This workflow template outlines a robust response for disabling a specific compromised user in Okta. It is designed to be triggered on-demand, inclusive of Slack and Microsoft Teams integrations, with webhook support. Upon initiation, the workflow validates the executing user's permissions, gathers user details, sends notifications, and performs critical account containment actions such as password reset, user suspension, factor reset, and session clearance in Okta, ensuring swift mitigation against potentially compromised identities. The entire process results in a feedback loop with real-time updates provided to the initiating user or team via Slack.
Optional Triggers
Slack,"Microsoft Teams",Webhook
Use Cases
Identity and Access Management , Suspicious User Activity
Workflow Breakdown
Execute the nested workflow to confirm the user executing the workflow has permission
Gather the user details and notify the user executing the workflow
Reset the users password, suspend the user, reset any other authentication factor and clear sessions
Vendors
Slack, Utils, Okta, HTTP
Workflow Output
Messages to Slack on verdict of successful user suspension