Configuration guide

Fewer for Okta

Any company's Okta admin can install Fewer from the Okta Integration Network and connect it in three pasted values. Fewer then reviews your Okta users, groups and app assignments to find paid app seats held by people who have left or no longer sign in.

Open Fewer

Sign in, then open Sources → Okta to connect.

Prerequisites

You need the Okta Super Administrator role to add an API service integration and grant its scopes. You also need a Fewer workspace where you can set up sources.

Supported features

Read users (status, last sign-in), groups and memberships, apps and their user and group assignments, and sign-in events.

The pick-a-person assignment action from Sources is disabled by default for launch; Okta findings remain available as recommendations. When the customer action route is enabled, removing an assignment requires approval of the exact change, and Fewer can restore that same assignment later. This uses the okta.apps.manage scope. Fewer requests no scope to manage users or groups, so it never changes a user or a group membership; access granted through a group goes to your admin as a task.

Configuration steps

  1. In the Okta Admin Console, go to Applications and Resources → API Service Integrations and click Add Integration.
  2. Search for Fewer, select it, and click Next.
  3. Review the requested scopes (the read scopes plus okta.apps.manage) and click Install & Authorize.
  4. Copy the Client Secret now; Okta shows it only once. Then copy the Client ID and Okta Domain from the General tab.
  5. In Fewer, open Sources → Okta → Connect, paste the Okta domain, client ID and client secret, and click Connect.
  6. Fewer verifies the connection and starts the first sync. It usually finishes within minutes.

Remove the integration

In Fewer, click Disconnect on the Okta card. In Okta, open Applications and Resources → API Service Integrations → Fewer → Revoke. Revoking deletes the credentials, and Fewer stops reading and changing your Okta data at once. Data Fewer already collected stays in your workspace until your account is deleted under the Privacy Policy.

Troubleshooting

  • "Invalid client" — the secret was mistyped or rotated, so revoke and reinstall to get a new one.
  • "Wrong org" — the domain doesn't match the org the credentials belong to.
  • Groups are missing — confirm the integration shows the groups scope in Okta.
  • Support — support@usefewer.com.