Skip to content
Documentation

Okta

What this guide covers

How to actually buy Okta for a Maryland agency — which statewide vehicle you ride, which reseller fulfills the order, the FedRAMP/ATO path, and the functionality gates to clear before you sign. Okta’s Maryland path runs through NASPO and a dedicated DoIT Okta agreement rather than the COTS line, and its FedRAMP High authorization attaches to a specific government boundary — both decisions matter here.

Who it’s for

Engineering leads, identity/security staff, and procurement officers at a Maryland State agency or education entity who have decided they need Okta for IdP, SSO, or identity governance (or are comparing it against the self-hosted alternatives) and need the path from “we want it” to “it’s authorized and on contract.”

Part of the SaaS Catalog. For the vehicles themselves, see Maryland Master Contracts; for the process and thresholds, see Maryland Procurement.

Disclaimer. Not legal or procurement advice. FedRAMP authorizations, contract catalogs, and contract numbers change as awards are renewed and authorizations are re-baselined. Verify every figure below against the FedRAMP Marketplace, the Carahsoft Okta contracts page, and the DoIT Statewide Contracts hub before relying on it. Whether Okta sits on the specific Carahsoft MD COTS line is unverified (see below) — confirm against the live catalog.

TL;DR

  • Category: Identity — IdP / SSO / identity governance (Workforce Identity Cloud).
  • Maryland vehicle: NASPO ValuePoint (master agreement AR2472) via Carahsoft, plus a DoIT Okta renewal ICPA (signed 2024). Whether Okta sits on the specific Carahsoft MD COTS line (060B2490021) is UNVERIFIED — confirm against the live catalog.
  • Reseller: Carahsoft — Okta’s named master government aggregator since 2016, and the only authorized reseller of Okta under the NASPO contract.
  • Authorization: Okta IDaaS Government High Cloud (GHC) = FedRAMP High (certified 2023-03-23, Marketplace ID FR2131856836, marketed as “Okta for Government High”). A separate Okta for Government Moderate boundary (DoD IL-4) also exists. Okta Workflows also reached FedRAMP High.
  • The ATO trap: Use the Okta for Government High (GHC) boundary for FedRAMP High — the commercial Okta Workforce Identity Cloud tenant is a different boundary.

What This Tool Is

Okta is a SaaS identity platform — its Workforce Identity Cloud provides the identity provider (IdP), single sign-on (SSO), multi-factor authentication, lifecycle management, and identity governance that front your agency’s applications. Agencies reach for Okta when they want a managed, broadly integrated IdP instead of operating one themselves. The self-hostable IdP alternatives are Authentik / Authelia / Keycloak — see Tools and Software → Identity & Access — but for a managed, FedRAMP-authorized IdP most agencies treat Okta as a procurement-and-ATO exercise, which is what this page covers.

Which Maryland Vehicle

VehicleContractHow Okta rides it
NASPO ValuePointMaster agreement AR2472 (via Carahsoft)The primary path. Carahsoft fulfills your order against the NASPO ValuePoint master agreement through Maryland’s participating addendum.
DoIT Okta renewal ICPAIntergovernmental cooperative purchasing agreement (signed 2024)A Maryland-specific Okta renewal vehicle DoIT entered; confirm eligibility and ceiling terms for your order.
MD COTS 2012060B2490021 (unverified)Whether Okta sits on the specific Carahsoft MD COTS line is unverified — confirm against the live Carahsoft MD COTS catalog before assuming this path.

The clear paths are NASPO (AR2472) and the DoIT Okta ICPA. The same publisher can be reachable through more than one vehicle, and which one you ride affects ceiling pricing, terms, and which approvals apply — see Maryland Master Contracts → Where Carahsoft Fits.

Resellers and Pricing Path

Carahsoft is Okta’s named master government aggregator (since 2016) and the only authorized reseller of Okta under the NASPO contract. You do not buy a “Carahsoft contract” — Carahsoft fulfills your order against the NASPO ValuePoint master agreement (AR2472) or the DoIT Okta ICPA. Request a quote referencing the NASPO AR2472 master agreement (or the DoIT Okta ICPA) so the order is priced against the cooperative ceiling rather than commercial list price. Okta is licensed per-user by product/SKU, so the quote depends on your user count and which Okta products you select — size both before you ask.

Authorization and ATO

AttributeValue
Authorized offeringOkta IDaaS Government High Cloud (GHC) — marketed as “Okta for Government High”
FedRAMP statusHigh — certified 2023-03-23
Marketplace IDFR2131856836
Other boundariesSeparate Okta for Government Moderate boundary (DoD IL-4); Okta Workflows also reached FedRAMP High
Commercial Workforce Identity Cloud tenant in scope?No — it is a different boundary, not the High ATO

The single thing to get right for the ATO: provision the Okta for Government High (GHC) boundary if you need FedRAMP High. The FedRAMP High authorization attaches only to the GHC boundary (FR2131856836) — the commercial Okta Workforce Identity Cloud tenant is a different boundary and is not the High ATO. If your classification only requires Moderate, the separate Okta for Government Moderate boundary may apply instead. Confirm the boundary matches your data classification before you commit; provisioning the commercial tenant gives you no High authorization to inherit, and the gap will surface late in your security review.

Functionality Gates to Verify

Clear these before price comparison — any one can disqualify the buy regardless of cost. See the canonical list in Tools and Software → Enterprise Functionality.

GateOkta-specific note
SSO (SAML/OIDC) + SCIMCore to the product; confirm the SCIM provisioning connectors you need are included at your tier.
Audit logsAvailable (System Log); confirm retention and export meet your records policy.
RBACGranular admin roles supported; map them to least-privilege before rollout.
Data residency / FedRAMP boundaryThe Okta for Government High (GHC) boundary is the residency answer — confirm the correct boundary (see above).
Accessibility (VPAT/ACR)Request Okta’s current VPAT; Maryland’s Nonvisual Access (NVA) requirement applies to the procurement.
BAA / DPARequired if any identity data could carry PII/PHI; confirm availability for the government boundary.

Procurement Steps

  1. Confirm the need over the OSS alternative. Okta replaces the self-hostable Authentik / Authelia / Keycloak IdPs ($0 license). Document why a managed IdP is worth the spend — that rationale is the core of the budget justification.
  2. Register / confirm eMMA. Your agency and the reseller must be set up in eMMA.
  3. Pick the vehicle. Default to NASPO ValuePoint AR2472 or the DoIT Okta ICPA; confirm whether the MD COTS line applies before relying on it (unverified).
  4. Determine your boundary. Decide whether your data classification requires Okta for Government High (GHC) or the Moderate boundary — this drives what you inherit.
  5. Get a Carahsoft quote referencing AR2472 (or the DoIT Okta ICPA), sized to your user count and product selection, for the correct government boundary.
  6. Check the threshold. The order’s dollar value drives the method — purchasing card, small procurement, or BPW review. See Maryland Procurement → how the value picks the path. Do not split a buy to dodge a threshold.
  7. Run the ATO package. Inherit the FedRAMP controls for the Okta for Government High (GHC) boundary; document the rest.
  8. Issue the order against the vehicle once approvals clear.

Sources

ClaimSource
Okta IDaaS Government High Cloud (GHC) FedRAMP High (FR2131856836)FedRAMP Marketplace — FR2131856836
Okta for Government High achieves FedRAMP HighOkta — Okta for Government High Achieves FedRAMP High Authorization
Carahsoft as Okta’s NASPO reseller / contractsCarahsoft — Okta contracts
Maryland DoIT Okta renewal ICPA (2024)MD DoIT Okta Renewal ICPA (signed)

Whether Okta sits on the specific Carahsoft MD COTS line (060B2490021) is unverified. Confirm the vehicle and the current FedRAMP boundary against the Carahsoft Okta contracts page and the Marketplace listing before relying on any figure here.