Configuring Okta Universal Logout

Use Okta Universal Logout to allow Okta's Identity Threat Protection (ITP) to immediately terminate a user's active Axonius sessions when Okta detects a security risk.

When Okta ITP identifies a compromised user — for example, due to stolen credentials, session hijacking, or employee termination — it sends a server-to-server logout signal to Axonius. Axonius receives the signal and terminates all active sessions for that user, even if the user has no browser window open.

Configuring Okta Universal Logout

No additional configuration is required in Axonius. The Universal Logout endpoint is available automatically when Okta SAML SSO is configured.

To enable Okta Universal Logout, register the Axonius Universal Logout endpoint URL in your Okta app configuration.

To configure Okta Universal Logout in Okta:

1. In your Okta Admin Console, open the Axonius app integration.

2. Navigate to the Sign On settings.

3. In the Universal Logout URL field, enter your Axonius Universal Logout endpoint URL:

   https://<your-axonius-instance>/api/logout/universal

   Replace <your-axonius-instance> with your Axonius hostname.

4. Save the configuration in Okta.

Okta can now send Universal Logout signals to your Axonius instance.

How Universal Logout Works

When Okta ITP detects a security risk and triggers Universal Logout for a user, Axonius:

• Terminates all active UI sessions for that user.
• Revokes all active API tokens associated with that user.
• Requires the user to authenticate again on their next login attempt.

The affected user sees the message: "Your session was ended by your organization's identity provider."

The user's Axonius account is not deleted or disabled — only their active sessions are terminated.