Okta identity governance: what it covers, what it costs, where it stops

This guide is for IT managers at 50 to 500-person companies on Okta who were just quoted Okta Identity Governance for an ISO 27001, SOC 2 or NIS2 audit, not for admins looking for OIG setup steps.

Okta Identity Governance (OIG) is Okta's identity governance module that bundles Lifecycle Management, Okta Workflows and Access Governance, which covers access requests, access certifications, entitlement management and separation-of-duties rules. On Okta's public price list in September 2026, OIG is not available in the Starter ($6) or Core Essentials ($14) suites and is included from Essentials at $17 per user per month, billed annually. OIG governs the apps, groups and entitlements Okta already manages, so apps outside Okta stay outside its reviews.

Last updated: September 29, 2026. Okta prices checked on Okta's public pricing page on September 28, 2026.

What is Okta Identity Governance?

Okta Identity Governance is an identity governance and administration (IGA) layer built into the Okta Workforce Identity platform, which uses the users, groups and app assignments Okta already holds to run access requests, access reviews and identity lifecycle automation. If the category itself is new to you, our definition of identity governance and administration (IGA) covers the basics.

According to Okta's help center, OIG "consists of three Okta offerings": Lifecycle Management, Workflows and Access Governance. Each one does a different job, and each one has a different boundary.

What Access Governance includes

Access Governance is the part most buyers mean when they say "OIG". Okta documents these features:

• Access Requests: employees make self-service access requests for apps, app entitlements or groups from their End-User Dashboard, and request types limit who can ask for what.
• Access Certifications: scheduled campaigns and ad hoc security access reviews, which Okta positions for SOC 2 and SOX audit requirements.
• Entitlement Management: import or create app entitlements and assign them through policies based on user profile attributes.
• Resource collections, owners and labels: bundles of apps and entitlements, owners who approve requests, and labels to filter resources.
• Separation of duties: rules that define which combinations of entitlements create a conflict of interest, so OIG can flag conflicting permissions. See our separation of duties (SoD) glossary entry for the concept.
• Reports, APIs and System Log events for past campaigns and requests.

Is Okta Workflows part of OIG?

Yes. Okta's help center lists Workflows as one of the three OIG offerings, and the footnote on Okta's pricing page states that "the Okta Identity Governance (OIG) add-on includes Access Governance, Lifecycle Management, and Workflows". Some third-party reviews still say OIG shipped without native Workflows integration; that describes OIG at general availability, not the package Okta sells in 2026.

What does Okta Identity Governance cost?

On Okta's public pricing page, Identity Governance is included from the Essentials suite at $17 per user per month, and it is marked "not included" in Starter and Core Essentials. All Okta Workforce Identity suites are billed annually, with a $1,500 annual contract minimum. Professional and Enterprise are quoted by sales.

What OIG costs a 50, 200 and 500-person company at list price

Okta prices suites per user, so moving to Essentials applies to every person in the directory, not only to the users you plan to review. Here is the annual list cost at three mid-market sizes.

Two readings matter for budgeting. If you are on Core Essentials already, OIG costs $3 per user per month more at list price. If you are on Starter, the jump is $11 per user per month, and you pay for features beyond governance.

Why the "$4 per user" figure does not match Okta's price list

Zluri's widely read OIG review quotes "$4/user/month" as "the commonly cited estimate" and asks readers to check whether it is additional to their tier. Multiplier's review says you buy OIG "as a subscription add-on to your existing Okta tenant". Okta's own pricing page settles it for new purchases: governance is marked as unavailable on Starter and Core Essentials and included from Essentials upwards. The same page still calls the bundle "the OIG add-on", so a customer on an older contract may see it quoted as a line item. Ask your Okta rep which of the two you are being offered.

Questions to ask your Okta rep before you sign

• Suite or add-on? Is governance quoted through an Essentials upgrade or as an add-on to your current contract?
• Which users count? Suites are priced per user, so check whether contractors and service accounts sit in the billable directory.
• How many flows? Essentials includes 50 Workflows, and custom governance automations consume them.
• Which apps can be governed on day one? Ask for the list of your apps with SCIM or OIN provisioning, not the size of the integration catalog.
• What does implementation cost? Confirm whether professional services are included or billed separately.

Where does Okta Identity Governance stop?

OIG stops where Okta's view of your stack stops. Access Governance reviews and grants resources that Okta already knows, and Lifecycle Management handles user provisioning through connectors, SCIM or On-Premises Provisioning. An app that no one connected to Okta never appears in a request catalog or a certification campaign.

Is a dedicated IGA worth it if SCIM covers only part of your apps?

That is the exact question a practitioner raised on r/IdentityManagement, and one reply put the constraint bluntly: IdP-based governance relies on SCIM and SAML, "which indeed only covers a fraction of apps". For an Okta shop, the practical test is simple: list the apps your teams use, then mark the ones connected to Okta with SCIM or an OIN provisioning connector. Everything unmarked is outside OIG's reach.

The size of the gap shows up when a company counts. When Satelia inventoried its SaaS usage with Corma, it found 160 applications in use, against 30 identified in its manual reports. Eriel Cruz, Technical Project Manager at Satelia, described what that visibility unlocked:

"Corma has opened a clear report channel where we can get from the whole company what tools are they using, how often are they using it, when the access was given. Without having those details, we couldn't move forward with the ISO 27001 and SOC2 certifications."Eriel Cruz, Technical Project Manager, Satelia. Source: Satelia's identity governance rollout, July 2026.

Satelia's case is not an Okta case. It shows the general problem: a review campaign certifies the list it is given, and the list rarely matches reality.

Licences, contracts and renewals

Okta's governance page frames cost savings as "identifying inactive app users to reduce software spend", which you orchestrate with Workflows. Contract dates, renewal notices, invoice data and per-app licence counts are not part of the OIG components Okta documents. For a mid-market IT team that also owns the software budget, that means a second tool or a spreadsheet next to OIG.

NIS2 and GDPR evidence for EU companies

Most OIG reviews are written from a US compliance angle. In the three third-party OIG reviews we analysed in September 2026, SOX appears three times while GDPR, NIS2 and DORA do not appear once. For EU companies, the relevant text is the NIS2 Directive: Article 21(2)(i) of Directive (EU) 2022/2555 lists "human resources security, access control policies and asset management" as one cybersecurity risk-management measure.

Read together with Okta's documentation, the consequence is practical. OIG can evidence access control for resources in Okta. The asset management half, knowing which apps exist and who uses them, needs a discovery source beyond the IdP. An auditor who asks "how do you know this list is complete?" is asking about that second half.

Before any audit, you can size the gap in three steps:

1. Inventory the apps actually in use, from browser and expense data rather than from the IdP.
2. Classify each app: connected to Okta with provisioning, SSO only, or not connected at all.
3. Decide the review route for each group: OIG campaigns for provisioned apps, and a governance tool or documented manual review for the rest.

If your audit scope includes apps outside Okta, the answer is not a bigger Okta suite but a governance layer that covers apps inside and outside Okta.

Where Okta Identity Governance is strong

OIG is a credible choice when your critical apps are already connected to Okta. Practitioner feedback points to the same strengths and the same catch:

• One console. In an r/IdentityManagement thread on IGA upgrades, one practitioner's argument for OIG was that it is built into the same admin console the IT team already uses.
• Native separation-of-duties rules and entitlement policies, which lighter tools often leave out.
• Governance Analyzer recommendations that Okta presents as unified risk signals for reviewers.
• The catch is price. An r/okta answer on report automation described OIG as "a more holistic (albeit certainly more expensive) solution" than scripting.
• The product is still moving. In a LinkedIn post from May 2026, IAM practitioner Shubham Singh wrote that "OIG is still evolving", and Okta's support site keeps a running "What's new in Okta Identity Governance" page, updated for September 2026.

OIG, a governance layer or the status quo: which fits a mid-market Okta shop?

OIG fits when Okta already sees your critical apps; a governance layer fits when it does not. Most 50 to 500-person companies on Okta weigh three realistic options, compared below on the criteria an auditor and a finance lead will both ask about.

Corma's CEO, Héloïse Rozès, framed the mid-market side of this choice in a December 2025 interview with Revenue Brew: "We believe that [for] midsize market companies, it doesn't make sense to have two different tools to provide governance of your software." She tied it to the audit load: "as regulations increase, the IT teams do not really increase in number or budget."

OIG is the right call when:

• your critical apps already sit behind Okta with SCIM or OIN connectors;
• you need native separation-of-duties rules on entitlements;
• you are on Core Essentials already, so the list price step is $3 per user per month.

A governance layer fits better when:

• a real inventory shows many apps outside Okta, as Satelia's did;
• you want to stay on Starter for SSO and fund governance separately;
• the same team owns access reviews, licences and renewals;
• you need EU-hosted evidence for ISO 27001 or NIS2 audits.

If you are still deciding whether to keep Okta at all, our guide to Okta alternatives for mid-market IAM covers the identity provider side, and our comparison of IGA solutions for mid-market companies covers dedicated governance tools.

How Corma governs access on top of Okta

Corma is a European SaaS management and identity governance platform that plugs into your existing identity provider, so you keep Okta for login and add governance for every app, connected or not.

• Keep Okta, extend the scope. Corma's Okta integration connects to Okta SSO to automate provisioning and access control across your SaaS stack, and Corma also connects to Microsoft Entra ID, Google Workspace and JumpCloud.
• See what Okta does not. Corma spots unauthorised and shadow applications, including tools adopted in the browser or installed on the machine.
• Run reviews auditors accept. Automated, audit-ready access reviews produce the audit trail ISO 27001, SOC 2 and NIS2 audits expect.
• Govern licences in the same place. Contract and licence management sits next to access, which is the single-tool approach Héloïse Rozès describes.
• EU-native by design. Corma is EU-hosted, GDPR-aligned and ISO/IEC 27001 certified, and was recognised in the 2025 Gartner Magic Quadrant for SaaS Management Platforms.

Access reviews and automated provisioning sit in Corma's Pro plan, and visibility with shadow IT detection starts at €3 per user per month on the Essential plan, on annual engagement. Details are on the Corma pricing page, and a side-by-side view is in our Corma versus Okta comparison.

FAQ

The bottom line on Okta Identity Governance

Okta Identity Governance is a solid governance module for resources Okta already manages, and it comes bundled in the Essentials suite at $17 per user per month on list price. Before you upgrade, count the apps Okta does not see. If that list is long, extending governance beyond the IdP will do more for your audit than a bigger Okta suite.