Okta Agent SSO is GA: your AI agents get real logins

Okta made Agent SSO generally available on August 24, and the interesting part isn't the feature — it's the price. It's included in core Okta SSO plans at no additional cost, across a base the company puts at more than 20,000 customers. AI agent identity just stopped being a line item you have to justify.

What actually happened

Per Okta's announcement, Agent SSO registers AI agents that support Cross App Access as first-class identities in Universal Directory. Instead of a static API key pasted into a config file, the agent gets short-lived, identity-governed tokens, and admins set policy for it in the same console where they manage employee access. Ric Smith, Okta's president of products and technology, framed it as bringing "SSO for your AI agents."

The plumbing is Cross App Access, an open OAuth extension that Okta says has been adopted as the official Enterprise-Managed Authorization extension for the Model Context Protocol. That matters more than the product news. MCP has spent a year moving credentials around by copy-paste; this is the first version of that story where the identity provider is in the loop by default.

The launch integration network includes Anthropic, Asana, Atlassian, Canva, Datadog, Figma, Glean, Granola, Linear, MintMCP, Notion, Slack, and Supabase. Okta's own AI Agents at Work 2026 research puts the gap plainly: 34% of organizations apply the same security controls to AI agents as they do to human workers. That's their number from their own survey, so treat it as directional — but the direction is not in dispute.

Why AI agent identity matters for your business

Here's the pattern we find in small-business stacks over and over. Somebody connected an AI assistant to the CRM and the shared drive using a personal admin token, because that account already had the access. The token never expires. It never appears in a review. And in the audit log, the agent's actions and the human's are the same actions.

Agent SSO doesn't fix that for you. It removes the excuse. If you're already paying for Okta, the work this quarter is four steps, and none of them are procurement. Inventory every AI integration and find which human's credentials it's wearing. Register the agents that support Cross App Access and cut them over to governed tokens. Scope each one to one system, read-only until read-write is proven necessary. Set expirations so the pilot you wired up in March dies on its own instead of living forever.

If your agents run on tools outside that integration list — and most small stacks have at least one — the same rule applies without the tooling: separate service account, minimum scope, hard expiry. The standard is catching up. Your access review shouldn't wait for it.

Sources: Okta Newsroom, TechNode Global.