Delegated Workflows allow designated Okta Admins to run selected workflows from the Okta Admin Console without having access to the Workflows Console. Delegated workflows utilize Custom Admin Roles to allow specific users to execute selected Delegated flows. Administrators must create a delegated flow, create a custom admin role, and execute the delegated flow to complete the configuration.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows
• Delegated Workflows
• Custom Admin Roles

How does an administrator create a delegated flow in Okta Workflows?

A delegated flow uses the Delegated Flow event card and accepts optional inputs when an administrator runs the flow from the Okta Admin Console. Create the flow in Okta Workflows, add the Delegated Flow event card, define the inputs, and complete the flow logic.

1. In the Okta Workflows Console, create a new flow.
2. Select Add event.
   
3. Select Delegated Flow from the Built-in triggers section.
   
4. Add the desired inputs that the flow receives when the administrator runs it.
   

NOTE: Okta prompts the administrator to enter the inputs when the flow runs, but the inputs are not required. The flow must validate the inputs and handle empty or incorrect values. The Okta User ID input in the user context section of the Delegated Flow card contains the ID of the user who runs the flow. Build the remaining flow logic as with any other workflow.

Administrators must create a custom admin role to grant access to delegated workflows.

Custom Admin Roles and resource sets define which users or groups can view and run specific delegated flows. Navigate to Security, and then Administrators in the Okta Admin Console to create the role, create the resource set, and create the admin assignment.

Create the custom admin role and assign the delegated flow permission.

Create the role, name it, and assign the delegated flow permission.

1. Open the Roles tab.
2. Select Create new role.
3. Enter a role name and description.
4. In Select permissions, select the Workflows Run delegated flow permission.
5. Select Save role.

Create the resource set and add delegated flows.

Create the resource set and add either all delegated flows or selected delegated flows.

1. Open the Resources tab.
2. Select Create new resource set.
3. Enter a resource set name and description.
4. Select + Add resource and search for Workflows.
5. Select All flows to add all delegated flows, or select Select flows to search for and add specific delegated flows.
6. Select the Save selection.
7. Select Create.

Create the admin assignment to assign the role and resource set.

Assign the role and resource set to the target user or group.

1. Open the Overview tab or the Admins tab.
2. Select Add Administrator.
3. In the Select admin dropdown menu, search for and select the target user or group.
4. In the Role dropdown menu, select the role created in the previous section.
5. In the Resource set dropdown menu, select the resource set created in the previous section.
6. Select Save Changes.

NOTE: The View delegated flow permissions only let a user view flow inputs when that user does not have Run delegated flow permissions. View permissions do not give access to the Workflows Console or workflow execution history.

How is a delegated flow executed?

An administrator can run a delegated flow from the Delegated flows page after an admin assignment grants the required permission and the flow is turned on. Run the delegated flow from the Okta Admin Console, provide any required inputs, and review the execution status.

1. Sign in to the Okta Admin Console as a user with an admin assignment that allows delegated flow execution.
2. Navigate to Workflow, and then Delegated flows.
3. Select Run for the desired delegated flow.
   
   NOTE: The Run button remains unavailable for flows that are not turned on.
4. Enter input values if the flow requires inputs.
5. Select Run to invoke the flow.
   
6. Review the first message in the lower-right corner of the browser to confirm that Okta invoked the flow.
   
7. Review the second message in the lower-right corner of the browser to confirm the execution status.
   

Related References

• Delegated flows
• Custom admin roles