Create a custom admin role and resource set to grant an Okta administrator limited access for monitoring Active Directory (AD) or Lightweight Directory Access Protocol (LDAP) imports. Currently, no out-of-the-box Okta admin role provides this restricted access.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Custom Admin Role and Resource
• Directories

What steps configure a custom admin role for import monitoring?

Create a new custom admin role with specific profile source permissions, define a custom resource set for Active Directory applications, and assign these to the appropriate administrators.

1. Create a new admin role named Import Admin with only Run Imports selected under Profile source.
   
2. Create a custom resource set with only All Active Directory applications selected.
   
3. Assign this role and resource set to the administrators or groups that require this access.
   

NOTE: Additional roles or resource sets may be required depending on the orgs configuration. Because of this customizability, creating these types of roles involves an inherent trial-and-error nature. This requires thorough testing by the admin to ensure the custom roles can perform the required tasks while, almost more importantly, not performing other tasks that are at a higher level of responsibility than the role is intended for. 

Related References

• Okta Custom Administrator Roles and Their Supportability
• Best practices for creating a custom role assignment
• Can Custom Admin Roles View System Logs