Your first Okta backup
in under 10 minutes.

CYBBACK offers two ways to get started. Both unlock the full Okta feature set.

Option A — Free trial

1. Open cybback.com/essai-gratuit.
2. Fill in your work email, company and a password. Click Start free trial.
3. Confirm via the verification email.
4. On the trial selection screen, pick Okta. Your trial workspace is provisioned instantly.

Option B — Paid licence (Stripe checkout)

1. Go to cybback.com/tarifs and pick the Okta plan that matches the number of Okta users to protect.
2. Click Subscribe. Stripe Checkout supports cards, SEPA and invoicing on annual plans.
3. Your licence is active immediately — visible under Account → Subscription.

CYBBACK reads and restores your Okta data through the Okta Management API. Two authentication modes are supported; the OAuth API Services app is recommended for production because it never expires.

Option A — SSWS API token (simplest)

1. Sign in to the Okta Admin Console with a dedicated Super Administrator account (the token inherits the rights of its creator).
2. Open Security → API → Tokens and click Create token.
3. Copy the value — it is shown only once.

Option B — OAuth 2.0 API Services app (recommended)

1. Applications → Create App Integration → API Services. Name it CYBBACK Backup.
2. Client authentication: Public key / Private key → generate a key pair, download the PEM, note the kid.
3. Tab Okta API Scopes: grant okta.users.manage, okta.groups.manage, okta.apps.manage, okta.policies.manage, okta.authorizationServers.manage, okta.idps.manage, okta.networkZones.manage, okta.roles.manage, okta.orgs.read, okta.logs.read (full list in the in-app guide).
4. Tab Admin roles: assign Super Administrator to the app — scopes alone are not enough.

Paste the credentials into CYBBACK

1. Open app.cybback.com/dashboard/okta-backup → Configuration → Add an org.
2. Enter the org URL (https://your-org.okta.com), pick the authentication mode, paste the token or the client ID + private key + kid.
3. Click Validate. CYBBACK calls /api/v1/org, /users, /groups and /apps live, checks the granted scopes and detects the topology (Org2Org). Then Save.

Everything restorable is captured by default. Fine-tune the optional categories and declare your hub and spoke topology.

Captured on every backup

• Users & groups — profiles, statuses (deprovisioned included), memberships, group rules, admin roles, manager.
• Applications — SAML / OIDC / SWA / Org2Org with assignments, OIDC secrets, SAML keys, features, grants.
• Policies & rules — session, password, MFA enrollment, app access, profile enrollment, IdP routing.
• Security objects — network zones, trusted origins, device assurance, behavior rules, authenticators, ThreatInsight.
• Federation — authorization servers (scopes, claims, policies), identity providers, keys.
• Org configuration — brands & themes, domains, hooks, custom admin roles, resource sets, features.

Options

• System Log — archive audit events (initial window 1–90 days, then incremental). Okta keeps them 90 days only.
• Devices — Okta Verify / Device Trust inventory.
• Workflows bridge — Okta exposes no management API for Workflows, so the capture is pushed from your own tenant. Click Enable, copy the one-time token, URL and header, and paste them into the flow you build in Okta Workflows (step-by-step procedure in the Configuration tab: System Log trigger on workflows.user.flow.save → Export Folder → File · Multipart Upload, the only card that accepts a file). Every saved flow is then pushed to CYBBACK and attached to the next backup.

Hub and spoke

Add one credential per org: the hub first, then each spoke with role Spoke and its hub selected. The topology is detected at validation (an okta_org2org app marks a spoke). Each org gets its own backup job; sourced users are matched by login on restore.

Want full data sovereignty? Point CYBBACK at your S3-compatible bucket — AWS S3, GCS, Scaleway, OVH, Wasabi, MinIO. Your data, your provider, your region.

Provision the bucket

1. In your S3 provider, create a private bucket (no public access, versioning recommended).
2. Create an access key / secret key with permissions limited to that bucket.
3. Note your endpoint URL and region.

Configure CYBBACK

1. Open Dashboard → Storage.
2. Select My own S3 storage.
3. Fill the form, click Test connection, then Save.

• Required IAM actions: PutObject, GetObject, DeleteObject, ListBucket.
• Resilience: CYBBACK stores an encrypted snapshot of S3 credentials with each backup. Old backups remain restorable even after you switch providers.
• Optional encryption at rest: enable AES-256-GCM encryption so every JSON file (.x) is encrypted before upload.

You're now fully configured. Time to run your first Okta snapshot — manually for instant peace of mind, then let the automatic schedule take over.

Manual backup

1. Go back to the Dashboard tab.
2. Click Start Okta backup (tick Force a full backup to ignore the incremental state). One job per configured org is queued.
3. Progress is streamed live: identity, apps, security, configuration, System Log, manifest.

Automatic schedule

1. The first backup creates an Auto - Okta schedule (05:00 and 17:00 Europe/Paris).
2. Adjust it from Dashboard → Schedules: daily, weekly or custom cron.

Track your backups

• Real-time: the Events page streams every operation across all services via SSE.
• Notifications: success / failure / drift alerts via email, Slack and webhooks.
• Drift detection: alerts on suspicious patterns — mass deprovisioning, group or policy deletions between two runs.

CYBBACK restores from any previous Okta snapshot. Recreate a user, a group, an app, a policy — with the objects it depends on — into the original org or another one.

The 3-step restore flow

1. Selection. Open the snapshot, browse the categories (identities, security, applications, configuration), search, and tick the objects. Toggle Recycle bin to show the objects deleted from Okta since the backup.
2. Options. CYBBACK checks live in your org what still exists and shows a dependency plan: missing groups, app assignments, missing apps (blocking), admin roles, deleted members, linked policies, missing managers. Switch on the cascades you want, then choose Dry-run, Update existing, a name prefix and the user activation mode (STAGED, activation email, silent).
3. Execution. The async worker recreates the dependencies first (schemas → zones → groups → users → rules → policies → IdPs → apps → roles), then the selection. Live log and a summary of what was created, updated or skipped.

Best practices

• Always start with a dry-run — the worker reports exactly what it would create without touching Okta.
• Review privileged cascades (admin roles, policies) before enabling them: they change who can sign in and how.
• Restore apps before their assignments when the plan flags a missing app — assignments towards a missing app are skipped.