---
title: "Integrate with Okta"
slug: "integrate-with-okta-1"
tags: ["Administrator Notes", "Okta Integration"]
updated: 2026-07-29T07:46:28Z
published: 2026-07-29T07:46:28Z
canonical: "docs.revealdata.com/integrate-with-okta-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate with Okta

In this topic, you'll learn how to add Okta as an identity provider.

## Configure Integration in Okta

> [!NOTE]
> **Note**
> 
> Must be performed by an Okta Administrator.

1. Go to the **Applications** page in Okta and click **Create App Integration**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/image-0PKRXPSC.png)
2. Select **OIDC - OpenID Connect** and then **Web Application**.
3. Fill out the following:
  1. **App integration name**: RevealHold
  2. **Sign-in redirect URIs**: https://legalhold.domain/signin-mt-oidc

Note: The domain can be .one or .eu
  3. **Sign-out redirect URIs**: https://legalhold.domain/signedOut

Note: The domain can be .one or .eu
  4. (Optional) Configure **Controlled access** or leave it (Okta tenant users will only be able to login to the Custodian Portal)
  5. Customize the application logo. Use the Reveal Hold logo (below) for easy identification of the Reveal Hold app:

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/iconreveal.png)

## Provide Okta Integration Credentials

> [!NOTE]
> **Note**
> 
> Must be done by an Okta Administrator.

Send to Reveal Hold contact (preferably support):

- Subscription prefix
  - **Description**: Used as URL prefix to Reveal Hold subscription, users must know it in order to access subscription, usually company name placed here.
  - **Hint**: Can be obfuscated if necessary - like you can use 'c123' instead of company name.
  - **Restrictions**: 2-24 of small Latin chars, numbers, dashes (can be placed only in the middle).
  - **Example**: contoso-us-1
- Public identity tenant name
  - **Description**: This name will be visible to everybody knowing subscription url in login screen (tenant selection screen) if subscription has more than 1 identity tenants attached. Also visible in application as Custodian/Contact field so you can determine from which identity tenant the custodian originated.
  - **Hint**: Can be obfuscated if necessary - like you can use '1' instead of your company domain name 'Contoso main Okta' but users must be able to determine their login option.
  - **Restrictions**: Up to 100 of any symbols in any language.
  - **Example**: contoso
- 'Client ID' from application configuration in Okta (created in previous step), used to determine that it is the Reveal Hold integration when Reveal Hold does requests to Okta.
- 'Okta domain' from application configuration in Okta, users will be basically redirected here if sign in via Okta selected.
- 'Client secret' from application configuration in Okta, used to prove that it's the trusted Reveal Hold integration.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Designer.png)

## Configure Okta User Roles (Optional)

When configured, some users from Okta will have roles other than custodian (Global Hold Manager, Global Hold Viewer, System Administrator, Matter Manager, Matter Viewer). See how Okta groups are mapped with Reveal Hold roles:

| **Okta** | **Reveal Hold** |
| --- | --- |
| IPRO Legal Hold - Global Hold Manager | Global Hold Manager |
| IPRO Legal Hold - Global Hold Viewer | Global Hold Viewer |
| IPRO Legal Hold - System Administrator | System Administrator |
| IPRO Legal Hold - Matter Manager | Matter Manager |
| IPRO Legal Hold - Matter Viewer | Matter Viewer |
| IPRO Legal Hold - Custodian | Custodian |
| IPRO Legal Hold - Developer | Developer |

1. Sign in to Okta tenant admin panel.
2. Create groups with names from the table above (Okta column) and assign correspondent users there.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/image-7K7G59PJ.png)
3. Assign group to Reveal Hold (from groups tab via **Manage Apps**, or from app via **Assign** button in Assignments tab).

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/image-SL9R02LR.png)
4. Allow Okta to send assigned groups with claims in application. Set **Groups claim filter** to **groups - Starts with** - "IPRO Legal Hold -" (without quotes).

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/image-KUWROCNJ.png)

1. Ask user from one of the groups to sign-in in order to check that groups propagation works.
  - **Remark 1**: Users will get roles on next sign-in and in case of changes app will update roles on each sign-in.
  - **Remark 2**: If roles synchronization does not work, please check groups names. They must be exactly the same as provided above.

## Synchronize Contacts

To ensure your contacts are kept up to date, follow the steps outlined in the [Address Book Synchronization](/reveal-hold-new/docs/address-book-synchronization-1) article to synchronize your contact list.