Monitor admin roles that are set to "Constrain this role to the entire organization"

Hi @BrianJ.34373 (Customer)​ , Thank you for reaching out to the Okta Community! 

To detect and audit custom admin role grants that are constrained to the entire organization, because the System Log entries for those grants look the same as grants limited to specific resources, you have a few options.

The implementation details for each option would typically fall outside of the Okta Support team scope and more in the realm of Professional Services, but I still recommend opening a support case to discuss this with them and get a feel for what is appropriate/available in your tenant. 

Here is a high-level list of options:  

1. Okta Workflows (Real-Time Automation): Configure a Workflow triggered by the user.account.privilege.grant event. The workflow executes a GET request to the Okta API (/api/v1/users/{TargetUserID}/roles), filters the JSON response for the ORG assignment type, and immediately triggers a notification (Slack, email, Jira) if a match is found.
2. Event Hook to a Serverless Function (Real-Time External Processing): Configure an Okta Event Hook to trigger on the grant event and send the payload to an external serverless script (AWS Lambda, Azure Function). The script parses the event, queries the Okta API to verify the ORG assignment type, and handles the alerting logic programmatically.
3. SIEM Log Parsing (Near Real-Time Alerting): Export Okta System Logs into a SIEM tool (Splunk, Datadog, Sumo Logic). Build a custom query alerting on user.account.privilege.grant (or iam.role.assignment.create) events where the target array explicitly lacks a group or application object, which indicates an organization-wide assignment by default.
4. Okta Access Certifications (Periodic Audit via OIG): Utilize Okta Identity Governance to schedule recurring certification campaigns targeting admin role assignments. This enforces a mandatory, periodic review by security teams to manually identify, validate, or revoke over-provisioned org-wide roles.

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added

Thank you. This did lead me in the right direction. I ended up implementing a scheduled Workflow to call some Custom API Action cards to monitor for this change. The trick is looking for the admin role grant for "Group Membership administrator (all)" wait about a minute, then check the user's "GROUP_MEMBERSHIP_ADMIN" role and get their assigned groups. If the response comes back empty, the user most likely has access to ALL groups.

Thanks!