Okta: Identity Provider Creation via system.idp.lifecycle.create

title: "Okta: Identity Provider Creation via system.idp.lifecycle.create"
id: d749ed57-c1b9-4dbd-93d4-131297a1016e
status: test
description: This rule flags Okta System Log events where a new identity provider (IdP) is created. Creating or onboarding an IdP can be used by attackers to establish persistent access paths or enable unauthorized authentication flows, making it a high-signal privilege and persistence indicator. It relies on Okta telemetry matching the event type system.idp.lifecycle.create.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_identity_provider_created.yml
author: kelnage, Huntrule Team
date: 2023-09-07
modified: 2026-04-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098.001
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType: system.idp.lifecycle.create
  condition: selection
falsepositives:
  - When an admin creates a new, authorised identity provider.
level: medium
license: DRL-1.1
related:
  - id: 969c7590-8c19-4797-8c1b-23155de6e7ac
    type: derived