---
updatedAt: 2025-09-09T21:40:45.000Z
agentTools:
  projectIndex: https://help.zluri.com/llms.txt
---

# Machine to Machine (Custom Admin Role)

Connect Okta (Machine to Machine) to Zluri using a custom admin role

Machine-to-Machine (M2M) communication in Okta is an authorization method that allows backend services, applications, and/or devices to communicate securely without user intervention.

This is primarily achieved through the Client Credentials Grant flow of OAuth 2.0.

## Prerequisites

* **Super Admin** privileges in Okta
* Okta **Developer Edition** organization

## Integration steps

### Create a custom admin role

1. [Log in](https://login.okta.com/) to Okta with a **Super Admin** account.
2. In the admin dashboard, navigate to **Security** → **Administrators**, then go to the **Roles** tab.
3. Click **Create new role**.

   ![](https://files.readme.io/4b63e5571b5b7607224f20ed5dd2ea8d4611d48f497136e08e96954f16ce6e97-image.png)
4. Name the role appropriately, considering its purpose or context.
5. Depending on your use case, enable one of the following sets of permissions:

   <Table align={["left","left"]}>
     <thead>
       <tr>
         <th style={{ textAlign: "left" }}>
           Minimum required privileges
         </th>

         <th style={{ textAlign: "left" }}>
           Maximum privileges
         </th>
       </tr>
     </thead>

     <tbody>
       <tr>
         <td style={{ textAlign: "left" }}>
           * \*User\*\*: View users and their details  
           * \*Group\*\*: View groups and their details  
           * \*Identity and Access Management\*\*: View roles, resources, and admin assignments  
           * \*Application\*\*: View application and their details  
           * \*Customizations\*\*: View customizations
         </td>

         <td style={{ textAlign: "left" }}>
           * \*User\*\*:  
           * Edit users' lifecycle states
           * View users and their details
           * Edit users' profile attributes
           * Edit users' application assignments
           * Create users
           * Edit users' group membership  
             * \*Group\*\*: Manage groups  
             * \*Identity and Access Management\*\*: View roles, resources, and admin assignments  
             * \*Application\*\*: Manage applications  
             * \*Customizations\*\*: View customizations
         </td>
       </tr>
     </tbody>
   </Table>

   <br />

### Generate a new resource set

6. In the admin dashboard, navigate to **Security** → **Administrators**, then go to the **Resources** tab. Then, click **Create new resource set**.

   ![](https://files.readme.io/dfd418edf67e236a422f4d680cfc435968a3d3739f1213e1343df5fab141d7a4-image.png)
7. Enter a name for the resource set information and click ➕ **Add resource**.

   ![](https://files.readme.io/82749e7afca9a20c0ca0c5850f6bc48529efb6a2c9acf3339edc83183983f216-image.png)
8. On the **Add Resource** pop-up, select **Groups** → **All groups**, then click **Save selection**.

> 📘
>
> If you wish to do this for specific groups instead of all, click **Select groups** instead of **All groups**. See [this section](#optional-grant-access-only-to-specific-groups-andor-users) to learn more.

<Image align="center" width="70% " src="https://files.readme.io/b72164e61649ba2fb4b676f78e139fa880a0fba8b8588239b2ac1c7428a88b82-image.png" />

9. Repeat the process for **Users**, **Group** , **Applications**, **Identity and Access Management**, and **Customizations**.
10. Click **Create** to generate the new resource set.

### (Optional) Grant access only to specific groups and/or users

If you don't wish to grant access to *all* groups, follow these steps:

1. On the **Add Resource** pop-up, select **Groups**.

> 📘
>
> If you wish to do this for users instead of groups, select **Users** here

2. Click on **Select groups**, search for and select the group you wish to grant access to (`IT team` in this case). Click **Save selection**.

   <Image align="center" width="70% " src="https://files.readme.io/fe08d888c9df358cc6afd30ea67abc285edc554c517d35f58259f61d9ab0e322-image.png" />

### Create an Okta service app integration

1. [Log in](https://login.okta.com/) to Okta with a Super Admin account.
2. In the Admin Console, go to **Applications** → **Applications**, and then click **Create App Integration**.

   ![](https://files.readme.io/ef38cfcd8806c9e25a63ad4c6ddef6e6e10c9da23edfb5d57f0ed0803db5b69f-image.png)
3. Under **Sign-in method**, select **API Services**, then click **Next**.

   ![](https://files.readme.io/29ff7c2a96f0ea5b5ab501aeefa9390299667bc7664608a3c2ceb1e65c11cf71-image.png)
4. Enter a name for your app integration and click **Save**.
5. Copy the **Client ID** and store it securely. We'll use it in the final phase of the integration.

   <Image align="center" width="80% " src="https://files.readme.io/287fda0f6f171891e067cd4c322ed1068f7e5e1cd61ade107280c620c8e3fab8-image.png" />

### Generate a public and private key pair

1. Under **Client authentication**, select **Public key / Private key**, then click **Add key**.

   <Image align="center" width="80% " src="https://files.readme.io/e09fccaca01aa2a78d47826377201a46e2e210da297be7a30dd158d8458f4633-image.png" />
2. Click **Generate new key**.

   <Image align="center" width="50% " src="https://files.readme.io/bee373355f73069fcf0a7b29a57d0b5cfadb5891645a72f1e9c572177f9d1dfa-image.png" />
3. Copy and securely save the values of \*\*`e`, `kid`,**and**`n`\*\**without* the quotes (") and commas at the end.
4. Under the **Private key** section, click on **PEM**, then **Copy to clipboard** and securely save the key. Click **Done**.

   <Image align="center" width="80% " src="https://files.readme.io/1cc458e31f12f2e9fbc695d15c4cab229913e16bcf1ff4c5b7137261a6e9a395-image.png" />
5. Click **Save**.

   <Image align="center" width="80% " src="https://files.readme.io/6c879c9618c61d8e08e47a02bb2ca038974e0a7b1f7243f884a51d64f5d28ab5-image.png" />
6. Click **Edit** under **General Settings**.

   <Image align="center" width="80% " src="https://files.readme.io/a48bdca56889427926a6ba56fff30e62645abdaf93f0ec7efa5862eb4d54b407-image.png" />

### Grant scopes and privileges

1. In the **Okta API Scopes tab**, grant the following scopes:
   * `okta.users.read`
   * `okta.groups.read`
   * `okta.apps.read`
   * `okta.logs.read`
   * `okta.roles.read`
   * `okta.domains.read`\ <br />
     > 📘 Optional scopes for Workflows
     >
     > If you wish to use Workflows with Okta, grant the following scopes **in addition to** the ones above:
     >
     > * `okta.apps.manage`
     >
     > * `okta.groups.manage`
     >
     > * `okta.linkedObjects.manage`
     >
     > * `okta.linkedObjects.read`
     >
     > * `okta.orgs.manage`
     >
     > * `okta.roles.manage`
     >
     > * `okta.schemas.read`
     >
     > * `okta.userTypes.manage`
     >
     > * `okta.userTypes.read`
     >
     > * `okta.users.manage`
2. Under the **Admin roles** tab, click **Edit assignments**.

   <Image align="center" width="80% " src="https://files.readme.io/9ad070dd01f724646ad8e70734cada747d46ab8c58cb18d789cd735e2056c87f-image.png" />
3. Add the following roles and click **Save changes**:

   1. `Custom Role`created in Step 1.

   2. `Report Administrator`

### Connect the Okta M2M instance in Zluri

1. Open the [Integrations Catalog](https://app.zluri.com/integrations/catalog), search for “okta”, and click ➕ **Connect** under **Okta (Machine to Machine)**.

   ![](https://files.readme.io/5cb2ce559ade5d8dbff502cda081bd3688b2c3b00246225950e86bf7e90d1b3f-image.png)

2. Choose the scopes for the integration, and click **Connect it myself**. You can click the down-arrow button towards the right of a scope to find out what it does.

   <Image align="center" width="70% " src="https://files.readme.io/ce8edb1cc2101ed08b39963f9c3f43bf7aab1500b7ec3d90e8fa0fb5b9d8913b-image.png" />

3. Fill out the other fields as follows:

   1. **Client ID**: obtained from step 5 of the [Create an Okta service app integration](#create-an-okta-service-app-integration) section
   2. **Private key**: obtained from step 4 in the [Generate a public and private key pair](#generate-a-public-and-private-key-pair) section.
   3. **Base URL**: if you access Okta using `https://mycorp.okta.com`, enter it here. If you aren't sure, consult [this doc](https://developer.okta.com/docs/guides/find-your-domain/main/#find-your-okta-domain) to find your Okta base URL.
   4. The values of `kid`, `n`, and `e` respectively from step 3 in [Generate a public and private key pair](#generate-a-public-and-private-key-pair) section.

      <Image align="center" src="https://files.readme.io/c75b622b4dcbb758f60b101914a9d5f64eb3b9685c91b014f596779c272bfaa7-image.png" />

      <br />

4. Give the connection a name and description, and you’re ready to go!

Got questions? Feel free to [submit a ticket](https://support.zluri.com/support/tickets/new) or contact us directly at <support@zluri.com>.