Okta Privileged Access Use Cases Covered by Okta for AI Agents and Resource Unit Consumption
Last Updated:
Okta Privileged Access (OPA) resource unit consumption depends on how agents and identities connect to OPA resources. The Okta for AI Agents (O4AA) license does not include OPA resource units, but several OPA-related use cases are available under O4AA without consuming resource units.
Does O4AA Include OPA Resource Units?
O4AA does not include OPA resource units. However, agents can connect to vaulted secrets and service accounts for SaaS Applications that are not on the Okta Supported SaaS Applications list without consuming OPA resource units. An agent accessing the OPA vault also does not consume resource units, unlike a user or workload identity accessing the OPA vault.
OPA Resource Type and O4AA Resource Unit Consumption
The following matrix maps OPA resource types to O4AA resource connection types and indicates whether OPA resource units are required / consumed:
| OPA Resource Type | O4AA Resource Connection Type | OPA Resource Units Consumed? |
|---|---|---|
| Secret | Secret | No |
| SaaS Application | Service Account | Okta Supported SaaS Applications — Yes; Other SaaS Applications — No |
| Server | Secret | No |
| Server | Custom Auth Server | Yes, provides all of the value of protecting Servers via OPA |
| Active Directory Account | Secret | No |
| Active Directory Account | Custom Auth Server | Yes, provides all of the value of protecting Active Directory Accounts via OPA |
| Database | Secret | No |
| Database | Custom Auth Server | Yes, provides all of the value of protecting Databases via OPA |
NOTE: For Okta Supported SaaS Applications, Okta provides password management. A secret can be stored in the OPA vault for Okta Supported SaaS Applications without consuming an OPA resource unit.
