> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/okta-reset-credentials.md).

# Okta: Reset Credentials

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

## Scope and Limitations <a href="#h_01j7kzj88ex6fwepzfjmj4wd48" id="h_01j7kzj88ex6fwepzfjmj4wd48"></a>

When choosing this auto remediation, remember the following:

* While an account is temporarily disabled, the user will not be able to reset their password; they will be forced to change their password as soon as the account is re-enabled.

## Prerequisites <a href="#h_01j7kzjrgtywbzeknw86aq4whx" id="h_01j7kzjrgtywbzeknw86aq4whx"></a>

1. You must have admin access in Workbench, as auto remediations are enabled at the organization level.
2. Make sure all end-user accounts have MFA enabled to allow the auto remediation to run properly.

## Step 1: Configure Auto Reset Credentials for Okta <a href="#h_01j7kzm3m1mzc350fgbz3npfq2" id="h_01j7kzm3m1mzc350fgbz3npfq2"></a>

This procedure applies to a regular Okta installation in Workbench. If you have questions or need assistance, [contact Support](/support/how-to-reach-us.md).

The Okta API token uses the [Read-only admin permission](https://help.okta.com/en-us/content/topics/security/administrators-read-only-admin.htm) and Expel's Auto Reset Credential feature requires the [Group admin permission](https://help.okta.com/en-us/content/topics/security/administrators-group-admin.htm). In Okta, API tokens have the same permissions as the user who creates them and if user permissions change, the API token permissions also change. As a result, you have the following options:

* [Option 1](#h_01j7kzr0bqt7ax4nz2qyjtnm8r): Edit the existing user to add the Group admin role. This existing user should be the same one you used to configure an API key in [Okta Workforce Identity Setup for Workbench](/connect-your-technology/l-p-integrations/okta-workforce-identity-setup-for-workbench.md).
* [Option 2](#h_01j7m1fjf4qmd46gcwp875q5wc): Generate a new separate API token with the required permissions level.

### Option 1: Edit the Permissions of the User that Created the Existing API Token <a href="#h_01j7kzr0bqt7ax4nz2qyjtnm8r" id="h_01j7kzr0bqt7ax4nz2qyjtnm8r"></a>

1. Identify the Read-only admin account used to create the API token.
2. Log into the Okta console from an account that has [Super administrator privileges](https://help.okta.com/en-us/content/topics/security/administrators-super-admin.htm) and add the permissions of the **Group admin** to the existing user for Expel.

### Option 2: Generate a New API Token and Update Workbench <a href="#h_01j7m1fjf4qmd46gcwp875q5wc" id="h_01j7m1fjf4qmd46gcwp875q5wc"></a>

1. Generate a new API token in Okta using an account with **Report administrator** and **Group administrator** privileges. For instructions, follow [Step 2 of the Okta Workforce Identity Setup for Workbench guide](/connect-your-technology/l-p-integrations/okta-workforce-identity-setup-for-workbench.md#h_01hyebzs0p1gyt5w8asegrh3k9), replacing "Read-only Administrator" with "Report Administrator" and "Group Administrator" privileges.
2. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
3. Navigate to **Organization Settings > Security Devices**.
4. Find Okta in the security device list.
5. In the Okta row, select the **down arrow**, and select **Edit**.
6. Replace the API Token with the newly generated token.
7. Select **Save**.

## Step 2: Update Your Context <a href="#h_01jhrm39k6zwpsdc6r9c995qgr" id="h_01jhrm39k6zwpsdc6r9c995qgr"></a>

**If you do not want to specify any credentials for a "do not reset" or "always reset" list, and instead wish for Expel to automatically reset all identified credentials, skip to** [**Step 3**](#h_01j7kypdqgvzxv5wa84vspabyr)**.**

Working with your Customer Success Manager, prepare to create an allow or deny list by adding credentials as context for your environment. You will then be able to select those credentials as "Never reset" or "Always reset" assets when you enable the auto remediation in Workbench.

{% hint style="info" %}
If our SOC identifies credentials that must be reset and you have created either an allow ("Always reset") or deny ("Never reset") list in Workbench, any credentials falling outside of those parameters are assigned to you as actions rather than being reset automatically.
{% endhint %}

## Step 3: Return to the Main Setup Guide <a href="#h_01j7kypdqgvzxv5wa84vspabyr" id="h_01j7kypdqgvzxv5wa84vspabyr"></a>

Your Okta device is now ready for the Reset Credentials Auto Remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/okta-reset-credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.