Okta for AI Agents Licensing Scenarios and Feature Matrix
Last Updated:
Overview
Administrators require clarification regarding the licensing requirements for various Okta for AI Agents scenarios. This article provides a feature matrix detailing the capabilities included with the Single Sign-On (Agent SSO), Identity Security Posture Management (ISPM), and full Okta for AI Agents (O4AA) licensing tiers.
Applies To
-
Okta Identity Engine (OIE)
-
Okta Classic Engine
-
Okta for AI Agents
-
Single Sign-On (SSO)
-
Identity Security Posture Management (ISPM)
Solution
What features are included in each Okta for AI Agents licensing scenario?
Review the feature matrix to identify the specific Okta for AI Agents capabilities available for each licensing tier.
-
NOTE: Federal Okta for AI Agents - Core excludes Okta Privileged Access and Identity Security Posture Management. The Okta for AI Agents - Core SKU is the version of Okta for AI Agents available to FedRAMP Moderate and FedRAMP High customers. It is not available for Okta for US Military.
-
Okta Managed MCP Server is not part of any of the below licenses
|
Capability |
Single Sign-On (SSO) License (OWI Only) |
Identity Security Posture Management (ISPM) License* |
Okta for AI Agents (O4AA) License |
|---|---|---|---|
|
Agent SSO (Workload principal registration, XAA (Cross App Access) - enabled Custom or OIN SAML and OIDC connections) |
Yes |
No |
Agent SSO features part of O4AA SKU |
|
AI Agent Registry |
Yes |
No |
Yes |
|
AI Agent Discovery* |
No |
Yes |
Yes |
|
Endpoint AI agents — via CrowdStrike* |
No |
Yes |
Yes |
|
On-behalf-of token exchange |
No |
No |
Yes |
|
Client-credential grant type |
No |
No |
Yes |
|
Custom authorization servers, custom scopes and claims |
No |
No |
Yes |
|
Multi-audience support, act claim chaining |
No |
No |
Yes |
|
Any Agent as a first class identity (Workload Principal) |
No |
No |
Yes |
|
Any Agent <> Any App (regardless of XAA support) |
No |
No |
Yes |
|
Agent <> MCP |
No |
No |
Yes |
|
Agent <> Agent |
No |
No |
Yes |
|
Agent <> Service Account / Secret |
No |
No |
Yes |
|
AI agent import connectors |
No |
No |
Yes |
|
AI agent governance |
No |
No |
Yes |
|
Agent Gateway |
No |
No |
Yes |
