Okta

Okta sits between people and the software they use. On the Okta Platform, a company's IT team connects its apps once (Salesforce, Workday, Slack, AWS and any of more than 7,000 others in the Okta Integration Network), and every employee and contractor then signs in once, proves who they are with a push, FastPass or a security key, and reaches only what their role allows. Accounts are created when someone joins and removed when they leave. On the Auth0 Platform, bought in 2021, developers add sign-up, login, social login and bot protection to the apps their own customers use, through SDKs and a hosted login page.

The technology is a multi-tenant cloud service built for availability. Identity sits in the path of every sign-in, so an outage stops a customer's whole workforce; Okta designs for zero planned downtime, with active-active-active availability zones and cross-continental recovery regions. Its other technical asset is the integration network: prebuilt, tested connections, provisioning included, that make Okta faster to deploy than scripts written against each app's API.

On top of sign-in, Okta has added products customers buy separately: Okta Identity Governance for access requests and reviews (2022), Okta Privileged Access for admin access to servers (2023), Identity Threat Protection for sessions after login and ISPM for identity misconfigurations (2024), and now products for AI agents, Okta for AI Agents and Auth0 for AI Agents, with Cross App Access proposed as a standard for how agents connect to apps.

More than 20,000 customers use it, from startups to the Fortune 50, along with universities and government agencies. They pick it for neutrality: it works the same with Google Workspace or Microsoft 365, AWS or Azure. Its principal competitor, by its own filing, is Microsoft, whose Entra ID comes with Microsoft 365. Since the start of fiscal 2026, Okta's sellers focus on IT and security teams and Auth0's on developers.

Identity is wired into everything. Leaving Okta means reconnecting every app's sign-in and provisioning to a new provider, re-enrolling every employee's MFA, rewriting access policies and Workflows automations, and testing all of it without locking anyone out of work. Leaving Auth0 means migrating every customer account and password hash and rebuilding the login flows and Actions code in the app. Both are projects of months with a risk of visible failure, so most companies take them on only when something forces the question.

What forces it is usually Microsoft. A company standardizing on Microsoft 365 E3 or E5 already pays for Entra ID, and its finance team asks why it pays for Okta too. Okta's answer is neutrality, the breadth of its integrations and the products it sells on top. Security incidents also force it: after the October 2023 breach of Okta's customer support system, some customers reviewed their choice. On the developer side, the move is usually to AWS Cognito, Firebase or newer tools such as Clerk, and the reason is price.

Okta's dollar-based net retention, the growth in what existing customers spend, has slowed from earlier years: customers expand more slowly, partly because many have cut or frozen headcount, and Okta's revenue follows the number of people it manages.

Revenue was $2.92B in fiscal 2026 (the year to January 2026), up 11.8%, after 15.3% and 21.8% in the two years before. Growth has slowed from more than 40% a year in fiscal 2021 to 2023, years that include the Auth0 acquisition. Over five years revenue grew about 28% a year, from $835M.

Running sign-in for others is cheap to deliver at scale: gross margin was 77.4%, up from 70.6% in fiscal 2023. The costs that weighed on the business were sales and marketing, R&D and equity pay. The operating loss was 43.7% of revenue in fiscal 2023 and 2.8% in fiscal 2025, and in fiscal 2026 Okta made an operating profit of $149M, a 5.1% margin, its first in the ten years on file.

Cash leads income because customers pay annually in advance. Operating cash flow was $884M and free cash flow $875M, 30.0% of revenue, with capital spending under $10M. Equity pay was $544M, 18.6% of revenue, down from $684M in fiscal 2024; after it, free cash flow was $331M, 11.3% of revenue. Okta ended the year with $2.55B of cash and short-term investments against $350M of convertible notes, net cash of $2.20B.

Okta's next step is to sell more security on top of sign-in, and to become the identity layer for AI agents. Governance, privileged access, threat protection and posture management are all sold to customers who already run Okta, which is how it grows without needing every new customer to leave Microsoft. Each answers the same question: once Okta knows who everyone is, what else can it control?

AI agents are the larger change the company describes. Agents need credentials to act in other apps, and today they often get them through long-lived API keys or a user's consent click in each app. Okta wants agents treated like employees, registered, scoped, approved and audited, through Okta for AI Agents, and wants connections between apps standardized through Cross App Access, which it has extended into MCP. On the developer side, Auth0 for AI Agents gives agentic apps a token vault and fine-grained authorization.

The competition is moving too. Microsoft has Entra Agent ID, and Palo Alto Networks bought CyberArk to build Idira, putting a large security vendor into identity. Okta's position as the independent identity company, neutral between clouds and model providers, is its argument for why customers should choose it for agents as they did for apps.

• Microsoft. Entra ID comes with Microsoft 365 licenses, works closely with Windows, Intune and Defender, and is good enough for many companies. Every renewal in a Microsoft shop has to justify Okta's price.
• Trust after the breaches. The 2022 incident at a support provider and the 2023 breach of its customer support system hit a company whose product is security. Another serious incident would cost more than the last.
• Slower growth from existing customers. Revenue grows with customers' headcount; hiring freezes and layoffs shrink the number of users, and net retention has fallen from earlier years.
• Security vendors moving into identity. Palo Alto Networks (CyberArk, now Idira) and CrowdStrike sell identity alongside the rest of the security stack, with the pitch of one vendor for everything.
• Being early on agents. The AI agent products are in early access and depend on standards app vendors have to adopt, and the platforms that host agents can build identity in themselves.
• Auth0's price at scale. Developers move to cheaper or simpler tools when a growing app's monthly active users push up the bill.