Data is dynamic and can change in the environment, so utilizing orchestration tools like Workflows can help track these changes. Changes can occur on custom applications using entitlements or OOTB-supported applications when imports run. This article strives to provide awareness of how entitlements are discovered and stored and how to use workflows as a mechanism to schedule a snapshot of the tenant's entitlements and store them in a Google Sheet.

• Access Certifications
• Access Requests
• Okta Workflows + Google Sheets Connector
• Okta Identity Governance (OIG)

Assumptions:

• Okta Workflows has been connected to the test Okta instance.
• Okta Workflows has been connected to the Google Sheets connector. See Related References.
• Consumption of this article does require some level of understanding of Okta Workflows. 
• All steps in the example workflow are depicted to show a basic workflow for testing in a non-production environment. Additional steps based on each customer's standards should be taken in account before using in production. 
• Create a Google sheet associated with the connector and have a file called entitlements created. That Google sheet should have the following column headings on a sheet called Entitlements
  • parentResourceOrn
  • parent.externalId
  • Parent.type
  • Id
  • Name
  • externalValue
  • Description
  • multiValue
  • Required
  • dataType
  • values

NOTE: Syntax is important.

Three Workflows are involved in this solution.

Visit the Apps API documentation and the API documentation for Identity Governance.  Please refer to the Guide on using the Okta Identity Governance APIs for more information on how to use the API.

1. Next, log into Okta as a Super Admin click on Okta Workflow console to get started. 
2. Create a new flow and name it by clicking the pencil next to Unnamed.  Enter the name, select to save all data that passed through the flow as well, and save.  In this example, the first flow will be called PullApplicationList.
3. Next, add an Event, select Scheduled Flow  under Okta Apps.  This will be used to schedule the discovery and storage of all defined entitlements. 
4. After choosing this option, there will be a prompt to set a frequency of execution. Once completed, click the Save button.

5. Next, click the Add app action button, search under Okta for Search Applications card. Select the Result Set that makes the most sense for the use case (in this example, “First 200 Matching Records” will be selected), then click Save. The Result Application box will be unchecked to unselect all Outputs. Then click only ID, Features and Settings. Click Save.

NOTE: Make sure the Connection to Okta is also connected. Otherwise, set up the connection to Okta.

6. Next, click the Add function button and look under the List menu or search for For Each.

7. Once that card is added, select Choose Flow.  There will be a redirect to a Select Flow page. Choose the New Flow button. 
8. Follow the same steps as the beginning of this document, name the document, and save all data that passes through the flow. In this example, this flow is named getEntitlements_of_Application.
9. Select Add Event button and select Helper Flow under the Okta Apps.
10. On that Helper Flow card, insert the value “applicationInfo” and click Enter.  The card should look like this:

11. Click Save and the Turn Flow OFF button and enable the flow. This is required to be able to call it from a previous flow.
12. Go back to the original flow, which should still be open in the previous tab in the browser.
13. Locate the Search Applications Card and drag the Result field Applications over to the list* on the List For Each card. It should look like this:

14. Next, click the Choose Flow button to select the second flow just created. In this case, it is called getEntitlement_of_Application. Select the Choose button. After that, it is necessary to update the bottom section of the List For Each card.  Click the down arrow to select Item.

 The final results of this flow will look like this:

Summary of steps of the first flow - PullApplicationList

15. Next, go back to the second flow (getEntitlments_of_Application) to complete it.  
16. Click the Add function button, look under the Object menu, or search for Get Multiple. Then, select that card to add it.
17. Drag the applicationInfo field from the previous Helper Flow over into the Object field. 

18. Enter the two items of the show in the previous image. These are the values being passed from the previous flow that we care about. 

• • ID
  • Settings.emOptInStatus

19. Next, it is necessary to determine if the application has been enabled to use entitlements or not. This can be done by interrogating the Settings.emOptInStatus value associated with the application. Click the Add function button and look under the Most Popular screen or search for Continue If, select that card to add.
20. Drag the Settings.emOptInStatus field from the previous Object Get Multiple card to value a.  Select equal to for the comparison and enter “ENABLED” in the value b field. It should look like this.

21. Next, click the Add app action button and search under Okta for the Read Applications card. Select the - - Enter Application ID - - option and then drag the ID field from the previous Object Get Multiple. Also, when choosing fields, only select ID, Name and Label, like below:

22. Now it is necessary to build the API call to pull all the entitlements associated with the application being processed. Click the Add function button, look under the Most Popular screen, or search for Compose and select that card to add.
23. Paste the following syntax into that card exactly as shown below.  Notice that the highlighted text “ID” is actually a field from the previous Object Get Multiple card.  

    /governance/api/v1/entitlements?filter=parent.externalId%20eq%20%22ID%22%20AND%20parent.type%20eq%20%22APPLICATION%22

When completed, the flow should look like this:

24. To run this API call, use an Okta Custom API Action card. Click Add Application and under Okta, select Custom API action card. Choose GET for the Request Type and click the Save button. Uncheck Query and Headers in the input section and click Save.

25. Drag the output value from the Compose card over to the Relative URL field in the Custom API Action card.

26. Next, click the Add function button, look under the Object menu, or search for Get Multiple and select that card to add.  Enter “data” in the fields at the bottom of the card, and drag the Body field from the Custom API Action card over to the object on the Get Multiple card. 

27. Lastly, process each item in the list that was generated by the API call. The Body section of the Custom API Action card will contain any entitlements listed by the application. To process the list, send the “data” field pulled by the Object Get Multiple card to a List For Each card.   
28. Next, click the Add function button and look under the List menu or search for For Each.

29. Once that card is added, select Choose Flow. There will be a redirect to a Select Flow page. Choose the New Flow button. 
30. Follow the same steps as the beginning of this document, name the document, and save all data that passes through the flow. In this example, this flow is named GetIndividualEntitlementsOfApp.  
31. Select Add Event button and select Helper Flow under the Okta Apps.
32. On that Helper Flow card, insert the values entitlementValue  and applicationName and click Enter. The card should look like this:

33. Click Save and the Turn Flow OFF button and enable the flow.  This is required to be able to call it from a previous flow.
34. Go back to the previous flow, which should still be open in the previous tab in the browser.
35. Locate the Object Get Multiple Card and drag the “data” field over to the list* on the List For Each card. It should look like this:

36. Next, click the Choose Flow button to select the just-created flow (in this case, the one called GetIndividualEntitlementsOfApp) and select the Choose button.  After choosing it, update the bottom section of the List For Each card. Click the down arrow to select Item and drag the Label field from the Okta Read Application card used earlier in the flow.

The end result should look something like this:

37. Return to the GetIndividualEntitlementsofApp flow and add an Object Get Multiple card. Once the card is added, drag the entitlementValue from the helper flow over to the object field. Additionally,  it is necessary to parse out pertinent information passed from the previous flow. Add the following fields:  

• • parentResourceOrn 
  • parent.externalId
  • Parent.type
  • Id
  • Name
  • externalValue
  • Description
  • multiValue
  • Required
  • dataType
  • values

NOTE: The Syntax is important.

The end result should look like this:  

38. Lastly, click Add app action, locate the Google Sheets application, and select the Create Row card. Choose the already existing Google Sheet document called Entitlements, placed in a folder associated with the Google Sheets connection previously configured.   Select the Entitlements Worksheet in that file and click Save.

39. Next, check all Inputs shown 1-11, leave the rest defaults, and click Save. Drag each value from the previous Object Get Multiple card to its respective field in the Google sheet. Also, drag the applicationName value from the first Helper Flow to store the friendly name of the application passed from the previous flow. 

The entire flow should look like this:

40. Save the flow, make sure it is turned on, and it is ready to start storing entitlements.
     

Related References

• How to create a row in Google Sheets
• Google Sheets connector
• Set a Schedule option in Okta Workflows