If you already have an internal directory/SSO (e.g. Active Directory) the advantage to using something like Okta (or another decent SAML app/provider) is the us

If you already have an internal directory/SSO (e.g. Active Directory) the advantage to using something like Okta (or another decent SAML app/provider) is the user experience. It makes SSO really simple (you could install the agent on a desktop), has simple directory sync and allows you to create network source rules (e.g. trusted networks) and integrates with several 2FA/MFA solutions out of the box. If you don’t already have an internal system like Active Directory it might not be worth the extra single point of failure/compromise. I can see Amazon displacing these services over time (they have a lot of the components already) but last time I looked they weren’t there yet. I don’t want it to seem like this is a sales pitch either. Okta has plenty of warts, odd decisions, glaringly obvious missing features and has done some bizarre 180s in terms of organizational direction. It was a long time ago but one bug I won’t forget that was shocking: a combination of special characters in a password resulted in a sync failure for a couple of accounts. That’s bad on its own because it raises all kinds of questions about how they’re handling and sanitizing strings. But the whopper was that the errors presented to admins had the passwords in clear text. You would assume masking would be a key thing in their code and logging systems and it made me question if they even had masking at all if a user password made it all the way to the dashboard.