Okta vs. Azure Active Directory: Medium-Size vs. Goliath

Employees log into increasingly more application and website accounts each day to do their jobs, including communications, project management, marketing, sales, and customer relationship management (CRM). As they do, every account login, especially those made from personal devices and on public networks, creates a potential entry point for hackers.

The solution to this security dilemma is identity management software, and Okta and Azure Active Directory (Azure AD) are two popular solutions. In this side-by-side comparison, we'll go over their features, support, and pricing, so you can decide which one is the best fit for your business.

Okta vs. Azure Active Directory: An overview

Okta was an early player in the identity and access management (IAM) sector, and, once this market matured, Microsoft released Azure AD. With Okta, you have a company that focuses on identity management, while Azure AD is part of the larger Microsoft ecosystem.

Who is Okta for?

Founded in 2009, Okta is an industry leader for workplace IAM software. Its primary product is a web-based single sign-on (SSO) application. Users log into a centralized interface to access multiple third-party applications, such as Gmail, Office 365, and Salesforce.

Okta uses a la carte pricing for individual applications, ranging from $2/month per user to $15/month per user, and its minimum contract is $1,500/year. Quote-based customer support plans, with prices based on total users, are extra.

Who is Azure AD for?

Azure AD is enterprise identity management software with features, including SSO and MFA, to protect your network and prevent cyberattacks. Azure AD is designed for information technology (IT) administrators managing workplace environments and application developers securing users' access.

Unlike Okta, Azure AD doesn't have a minimum contract amount, but you need at least 50 employees to make it cost-effective. It has a free customer service plan, but you'll likely need one of its paid options priced separately from your application subscription.

Okta vs. Azure Active Directory: Features

Okta and Azure AD share many of the same features: automated workflows for user provisioning, self-service password management, application programming interface (API) access management, and advanced server access. Beyond a web-based dashboard, users can access their SSO accounts via browser extensions and mobile apps.

We'll take a closer look at their core functionality: SSO, MFA, and reporting capabilities.

What Okta offers

Okta was one of the earliest cloud-based IAM providers and remains focused on that industry sector, steadily building out new applications.

Single sign-on (SSO)

Users log in via Okta's SSO portal to access their personal dashboards with direct links to third-party applications. Its left-hand menu has options to filter apps, create new app categories, add apps, and view notifications. On the right, apps are laid out in an easy-to-read grid.

Log in once for direct access to apps in your personal SSO dashboard. Image source: Author

Okta is not a one-size-fits-all solution. Instead, its flexible policy engine lets IT administrators set different permission policies by job title, department, and other factors to protect assets and limit available actions.

Multi-factor authentication (MFA)

While SSO is convenient for users, it creates an inherent security risk because one set of compromised login credentials can provide access to multiple applications. To address that problem, the best identity management software incorporates multi-factor authentication (MFA), also known as two-factor authentication (2FA).

MFA adds an extra step to the login process using information separate from your login credentials. Okta MFA options include the answer to a security question, a one-time password (OTP) sent to a mobile device, push notifications, and biometrics such as fingerprint or facial recognition. Or, use Okta Verify, a free authentication app for iOS and Android devices.

Using MFA significantly increases your network's security. Image source: Author

Okta can also provide contextual access management. More authentication factors are employed on a case-by-case basis, depending on the risk level due to a login coming from an unexpected location, network, or device.

Reports

Okta gives you the information necessary for actionable insights with three report categories: usage, security, and system log queries. Define a report's time frame, filter the results, and see events per actor and their locations on a map.

The system log report below, for example, uses the event filter to show initiated user sessions over time and by geographic location.

Use Okta's system log reports to show when and where events occurred. Image source: Author

If you use a security operations center (SOC), these reports provide critical data for endpoint security, incident response, and security information and event management (SIEM).

Additional features

Okta has more features to enhance the user experience and improve security:

• Mobile password manager app: Separate from its authenticator app, Okta's password manager mobile app lets users access their SSO dashboards on the go.
• Browser extensions: Users can access their SSO dashboard logins and add new ones via the Okta browser extension, which supports all major browsers.
• ThreatInsight: This add-on feature collects and analyzes data across the entire Okta customer base to detect and blacklist malicious IP addresses.
• Passwordless authentication: Move away from passwords with logins that use email-based magic links, factor sequencing, and personal identity verification (PIV) smart cards.

Other Okta IAM products include applications for customer identity management and multiple platform services.

What Azure AD offers

Much of Azure AD's baseline features set mirrors Okta, and it's easy to understand why. Okta is an IAM industry leader, while Microsoft was a late entrant to this market sector. Why reinvent the wheel when someone else is already doing it well?

Single sign-on (SSO)

After logging in, users access their apps via either a Windows Azure portal or the Windows My Apps portal with Azure Active AD. Choose from multiple menu options to filter available apps, which are laid out in a grid.

The Microsoft SSO My Apps portal in Azure AD gives you access to multiple apps after logging in. Image source: Author

System administrators can connect authentication-based apps hosted on-premise or in the cloud and set multiple authorization levels for users.

Multi-factor authentication (MFA)

Azure AD uses MFA to increase the security of the sign-in process and self-service password resets. Azure AD's MFA includes verification codes, texts, or calls via your smartphone, or you can download the free Microsoft Authenticator app.

MFA security in Azure AD decreases the chances intruders can access your network. Image source: Author

For greater security, Azure AD administrators select the MFA options users can employ.

Reports

Azure AD has two report categories: activity (audit logs and sign-ins) and security (risky sign-ins and flagged users). Drill down into data with multiple filter options, including administrative unit, contact, device, and policy.

In the security report below, new risky users by day are identified in the bar chart on the left. On the right, select from the four content boxes for more information about different user risk categories.

An Azure AD security report can identify when risky logins occurred and investigate high-risk users. Image source: Author

All Azure AD plans report users flagged for risk and risky sign-ins, but accessing more in-depth data depends on your specific subscription.

Additional features

Like Okta, Azure AD has more specialized features that work to maintain high levels of security with minimal impact on the user experience:

• Browser extension: Users are prompted the first time they log into the My Apps portal to add the companion browser extension.
• Customized password protection: Create your own list of banned passwords to prevent employees from using company product names, locations, or local sports teams.
• Adaptive authentication: Define the conditions where MFA is deployed, such as a login from a new device, network, or location.

Azure AD integrates with other Microsoft products to further extend its capabilities, but it requires experienced IT personnel to configure and maintain this functionality.

Results

It's a draw between Okta and Azure AD in this category. Each has a robust features set that provides a streamlined user experience and a high degree of configuration customization. Okta is platform-agnostic, which will appeal to companies that don't use a Windows or Linux infrastructure.

For others, much of Azure AD's appeal comes from its integration with and access to Microsoft's extensive catalog of software and hardware products. This is especially true for companies with an existing Microsoft-based network.

Even if you're using a Windows-based network, you can deploy Okta for identity management because the Okta Active Directory (AD) agent integrates with your on-site AD. This Okta AD integration allows you to seamlessly incorporate Windows and non-Windows applications.

Okta vs. Azure Active Directory: Support

Unlike many other applications that include customer support, almost all IAM software providers require you to pay for it. Or, if support is free, you get what you pay for, which isn't robust enough for workplace environments where you must quickly resolve login issues without waiting 24 hours for a response to a help ticket.

What Okta offers

Okta's quote-based customer support plans include:

• Basic: Has a 24-hour response time for support requests by phone or email.
• Premier: Upgrades response time for support requests to one hour and offers 20% off instructor-led training classes.
• Premier Access: Adds a customer success manager (CSM) and periodic virtual meetings.
• Premier Plus: Adds a VIP support line and periodic onsite meetings.

The Basic plan has 9 a.m. to 9 p.m. EST support Monday through Friday, but the others have 24/7/365 support.

Okta's online resources include a knowledge base, community forums, training, and webinars. Okta's resources are in two locations -- the help center and a separate content library -- which sometimes makes it difficult to find what you're looking for.

What Azure AD offers

Azure AD's four support packages include:

• Basic: Provided free to all Azure customers and includes the ability to submit multiple support tickets and access to self-help resources, Azure AD tutorial and portal how-to videos, technical documentation, and community support.
• Developer: $29/month -- Designed for nonproduction and trial environments and adds email support during business hours, with an eight-hour response time.
• Standard: $100/month -- Designed for production workload environments and adds 24/7 support by phone and email, with one- to eight-hour response times.
• Professional Direct: $1,000/month -- Designed for business-critical dependence environments and adds 24/7 support by phone and email, with one- to four-hour response times.

Quote-based, system-wide enterprise support plans are also available.

Results

Okta edges out Azure AD here. Sure, the lack of transparent pricing is a concern, but with Azure AD you likely need the Professional Direct support package, which starts at $12K/year. And because Okta produces only IAM applications, its customer support has focus and expertise that could be lacking if your software is wedged in with a million other Microsoft products.

Okta vs. Azure Active Directory: Ease of use

Two constituencies within your organization will use IAM software: the IT department and everyone else.

IT departments like IAM software because it reduces password reset and related help desk requests, which can make up 50% of their workload. This reduction in routine low-level help tickets allows them to focus on high-level concerns and projects.

Your other employees will like having SSO dashboards to provide immediate access to multiple on- and off-site applications without requiring individual logins. Most user complaints relate to MFA processes, which can be confusing without enough upfront notice and training.

What Okta offers

IT personnel like how Okta streamlines the onboarding process for new users and report that it works well on both external Wi-Fi connections and a company's intranet. Some comment that problems can arise when third-party vendors update their apps, and the technical documentation could be organized better.

User issues revolve around nuts-and-bolts topics, including password length, updating passwords across multiple applications, and the frequency of required Okta sign-ins.

What Azure AD offers

IT administrators like Azure AD because it integrates Microsoft security throughout the deployment process. The number of available features, however, means it takes more time to learn, which isn't helped by the fact that it's not easy to navigate and inconsistencies are common. As a Microsoft product designed for Windows and Linux environments, Azure AD doesn't work with other platforms.

Users like that Azure AD is included with most Office 365 Enterprise plans, which means they can use their existing Office 365 credentials.

Results

Okta comes out on top for ease of use. Unlike Azure AD, which is part of the massive Windows ecosystem, Okta focuses strictly on IAM applications. Windows also continually strives to steer customers toward its other products, while Okta is platform-agnostic in an attempt to create a larger potential customer base.

Okta vs. Azure Active Directory: Pricing

Enterprise-grade IAM software isn't cheap, and calculating your final cost requires a close examination of the fine print. Maximizing your return on investment (ROI) requires getting the exact features you want without paying for others you don't need. Beyond the cost of your IAM plan, customer support can be a significant extra expense.

What Okta offers

Okta's workplace identity products include:

• SSO: $2/month per user -- Includes the Okta Integration Network, ThreatInsight, desktop and mobile SSO for cloud and on-premise apps, basic MFA, and third-party MFA integration.
• Adaptive SSO: $5/month per user -- Adds contextual access management, including location, device, and network, plus risk-based authentication.
• MFA: $3/month per user -- Includes possession factors, including one-time passwords (OTPs), push notifications, texts, Universal 2nd Factors (U2Fs), and voice.
• Adaptive MFA: $6/month per user -- Adds risk-based authentication and contextual access management, including location (new city, state, or country, and impossible travel patterns), network (new IP and specified IP zones), and device.

Okta pricing requires a minimum $1,500/year contract but offers deep discounts to larger organizations adding more users, and the SSO plan has a free trial. Other add-on features include Okta lifecycle management and automated provisioning.

Customer support packages are sold separately.

What Azure AD offers

Azure AD plans include:

• Office 365: Included with most Office 365 enterprise plans -- Provides company branding, service-level agreement (SLA), and device write-back.
• Premium P1: $6/month per user -- Adds user access to on-premise and cloud resources, supports advanced administration, including dynamic groups, and self-service password resets for on-premise users.
• Premium P2: $9/month per user -- Adds Azure AD Identity Protection for enhanced risk-based conditional access to apps and company data and Privileged Identity Management (PIM) to discover, monitor, and restrict administrators and provide just-in-time (JIT) access.

The Premium plan is available from multiple sources, including Microsoft representatives and Microsoft's Cloud Solution Providers and Open Volume License programs. Current Azure and Office 365 subscribers can also purchase Azure AD Premium P1 and P2 online.

Like Okta, customer support packages are sold separately.

Results

Neither Okta nor Azure AD has a particularly transparent pricing schedule. Azure AD pricing edges out Okta here because its plans and support options are more clear-cut than Okta's a la carte pricing for different features and quote-based customer support plans.

Still, calculating your true Azure AD cost requires careful research. Multiple IT admins have noted its licensing options are more complex than they seem at first blush and make determining upfront cost difficult.

Okta vs. Azure Active Directory: Integration with other software

No piece of software is an island, and this is especially true for SSO identity management because it must play well with a wide range of third-party applications.

What Okta offers

The Okta Integration Network has more than 6,500 built-in app integrations. It uses open standards protocols to ensure that connections between Okta and application providers are consistent and easily updated.

Integrated app categories include:

• Endpoint security and management
• Healthcare technologies
• Human resources information systems
• ID proofing
• Network security
• Privileged access management
• Security analytics

Unlike Azure AD, which is inherently Microsoft-centric, Okta is platform-independent and has no preference for integrations from one technology provider versus another.

What Azure AD offers

Azure AD has more than 3,300 third-party integrations and includes native integrations with much of the Windows product catalog. Like Okta, Azure AD integrations include a wide range of specialized application categories:

• Business management
• Construction
• Data services
• E-commerce
• IT infrastructure
• Supply management
• Web design and hosting

Azure AD also supports open industry standards such as OAuth 2.0, SAML, and SCIM.

Results

It's another draw here. Okta offers more pre-configured integrations, but Azure AD's catalog has everything most companies need. If an app you want in your SSO portal isn't available, both Okta and Azure AD let you create your own custom integrations.

Okta earns the win

Okta and Azure AD are both robust identity management solutions with SSO and MFA functionality. Okta comes out on top due to its intentionally narrow focus on IAM applications and cross-platform capabilities. If your large company is using a Windows network infrastructure, however, Azure AD could be your best enterprise-level solution.