The simplest way is to install Okta AD agents in each of those domains. Okta will know from which domain each account was imported, therefore Okta will also know which AD agent to use when resetting an account's password.

It gets trickier if you have your AD agent installed in just one domain, because then you need to make that the AD agent (1) uses a service account that has admin rights in all connected domains, and (2) has connectivity to domain controllers in all connected domains in order to perform those tasks.

My company currently uses the latter configuration. We have two AD forests, one with a child domain, so three domains in total, with our AD agents installed only in the root domain. There is a two-way trust between the forests. The service account for the AD agent has been delegated rights in all three domains, allowing it to authenticate users and reset passwords as needed.

I sometimes wonder about performance in this configuration, though, that it might be better to install AD agents in the other two domains, but it becomes a resource issue because we'd want at least two agents in each domain for high availability and redundancy, which means at least four more servers. We haven't experienced any performance issues, so there's no demonstrable business reason to stand up four new servers.