Why email-based access requests take so much time
A new hire at a client's office needs access to the company's CRM. She emails her manager, who replies "approved" and forwards the message to your help desk. A technician opens a ticket, confirms the approval, grants the access, and closes the ticket.
Six months later, the client's operations lead asks why that user still has edit rights in the CRM. Or a new technician is cleaning up group memberships and wants to know which ones are still needed. The answer usually exists—in a ticket, an email thread, or a chat message—but getting to it means searching, cross-referencing, and confirming that the person who approved the request was the right person to approve it. Multiply that by every request, for every client, and it adds up to a meaningful share of your team's time.
Temporary access presents a similar problem. A contractor needs an app for the length of a project; a staff member needs different access while traveling. Removing that access later depends on a calendar reminder or a follow-up ticket that someone has to act on. Most of the time, this works—but sometimes it doesn’t. Okta rightly identified that this often manual process is better handled inside the identity platform—where the request, the approval, and the access itself can be seen, managed, and tracked in the same place.
What Okta Identity Governance (OIG) adds to ZeroTek’s Okta Pro
OIG brings three capabilities into the Okta org you already manage for a client:
Access requests let users ask for access and route each request to the right approver.
Access certifications run periodic reviews in which reviewers confirm or revoke existing access.
Entitlement management governs the specific roles and permissions users hold inside supported apps.
Because OIG is built into Okta, it works with the users, groups, and app integrations you've already configured. It extends the Lifecycle Management (LCM) capabilities included in ZeroTek's Okta Pro licensing rather than requiring a separate governance tool to integrate and maintain.
OIG also includes Okta Workflows, raising the client's limit from the 5 active flows included with Okta Pro to 50, the same as ZeroTek's standalone Workflows add-on. OIG includes Lifecycle Management (LCM) too, which ZeroTek's Okta Pro licensing already covers, so we've discounted our OIG pricing to reflect that. You don't pay for Lifecycle Management twice.
How access requests work in OIG
Here's the basic flow once OIG is set up for a client:
Users request access from tools they’re already using. Requests can come from the Okta end-user dashboard or from your messaging app—Okta supports submitting requests from Slack and Microsoft Teams.
Requests route to the right approver. Approval sequences can use manager data already flowing into Okta from the client's HR system, so a request goes to the requester's manager without anyone forwarding it.
Owners outside IT approve their own resources. You can make a non-IT owner—a finance lead for the accounting app, say, or a department head for their team's tools—responsible for approving access to those resources.
Approved access is provisioned automatically. Once an approval sequence completes, Okta grants the access in connected apps without a technician handoff.
Every step is recorded. The request, each approval, and the resulting access change are captured together, so tracing a decision later doesn't mean digging through tickets.
You decide which requests follow which path—which need a manager's approval, which need an app owner's, which still need IT, and which can be approved automatically under conditions you define.
Because OIG includes Okta Workflows, you can extend the process further. You might post a message to the client's IT channel when someone is granted access to a sensitive app, open a ticket when a request needs hands-on setup, or remind a user a day before their time-bound access ends.
A tip for MSPs: Okta notes that requests and approvals made in Slack or Teams use the chat app's session rather than the Okta session and recommends enforcing frequent re-authentication for those chat apps. The same guidance notes that users can't approve their own requests unless they're the individually assigned approver. Build both into your standard OIG configuration.
Time-bound access that ends automatically
For many MSPs, this is the capability that sells OIG—and it's one our partners ask about often.
When you set up an app for access requests, you can define how long access lasts: either a fixed duration you set, or a duration the requester chooses up to a maximum you configure. When the period ends, Okta removes the access automatically. Nobody has to remember.
A few places this fits:
A staff member traveling abroad requests membership in a group with a travel-appropriate sign-on policy for the dates of the trip.
A contractor gets access to a project app for the length of the engagement.
An external auditor gets read-only access to the systems under review for two weeks.
A user gets elevated permissions for a defined window to complete a specific task.
The result is least-privilege access without the follow-up tickets: users get what they need, when they need it, and the access ends on schedule.
Access reviews for compliance
Some clients need more than well-run requests. They need to show, on a schedule, that existing access is still appropriate.
OIG's access certification campaigns handle this. You schedule a campaign, and each reviewer—a manager or an app owner—sees who has access to what and confirms or revokes each item. Revocations happen automatically based on reviewers' decisions, and the campaign produces a record of every decision.
Some frameworks are specific about this. Under PCI DSS v4.0.1, Requirement 7.2.4 requires reviewing all user accounts and related access privileges—including third-party and vendor accounts—at least once every six months, with management acknowledging that access remains appropriate. Requirement 7.2.3 requires that privileges be approved by authorized personnel, which is exactly the record that OIG access requests create.
Other frameworks expect organizations to control and document who has access to sensitive systems without setting a review interval. HIPAA's Security Rule and SOC 2 audits both examine how access is granted, reviewed, and removed, and many clients commit to a quarterly or semi-annual review cadence as part of their own security programs. OIG gives them a way to meet the commitment they've made—and evidence that they did.
Reviews also catch what offboarding can miss: access that outlived a role change, a finished project, or a one-off exception granted outside the normal process.
How ZeroTek and our partners use OIG
At ZeroTek, we use OIG for our own access requests. Employees request access from the messaging app we’re already using, requests route to the right manager or resource owner, approved access is provisioned automatically, and every step is recorded in one place. It's simpler for our team, faster for the people making requests, and far easier to trace after the fact.
Our partner Boston Tech Advisors deployed OIG for a client and saw the same benefits:
“Adding OIG was an easy call. Access requests were eating technician time, and every one of them was really a security decision being made over email. Now requests go straight to the person who should approve them, everything’s logged, and temporary access is easy to manage. It’s a better process for everyone. Our client is really happy with it. And with Okta Workflows included, the numbers work.”
— Benjamin Katz, CTO, Boston Tech Advisors
Which clients need Okta Identity Governance?
OIG is a strong fit for:
Clients in regulated industries that must document how access is approved and reviewed.
Growing clients where new hires, role changes, and contractors make it hard to keep track of who has what.
Clients whose access requests run through email or tickets and take more technician time than they should.
It may not be needed yet for:
Very small clients with a handful of apps and simple roles, where Okta Pro's group-based access and Lifecycle Management already cover the need.
Before rolling OIG out, agree with the client on who owns which apps and groups and what each approval path should look like. OIG routes decisions to owners, so the owners need to be defined first.
How OIG compares to Microsoft Entra ID Governance
Microsoft offers governance features too, including access reviews and entitlement management. But they're licensed under Entra ID P2, Entra ID Governance, or Entra Suite—above the Entra ID P1 included with Microsoft 365 Business Premium—so getting there means moving an entire client user base to a higher tier on Microsoft's licensing terms.
OIG works across the apps your clients have integrated with Okta, and it sits alongside SSO, Adaptive MFA, and Lifecycle Management in the same platform. Through ZeroTek, you add it for the clients that need it, month-to-month. For a deeper comparison, see Okta vs. Microsoft Entra ID for MSPs.
Month-to-month OIG licensing for MSPs and SMBs
ZeroTek is the only provider authorized to offer select Okta add-ons, including OIG, to MSPs on a month-to-month consumption basis. That means you can turn OIG on for a single client when their requirements call for it—and turn it off if those requirements change—without an annual contract.
If a client needs both governance and automation, OIG is the better value: it includes the same 50 active flows as our Okta Workflows add-on for only a small difference in price. If a client needs automation but not governance, the Workflows add-on is the right fit.
If you're already a ZeroTek partner, email success@zerotek.com to request OIG. To learn more first, read the Identity Governance overview and how month-to-month add-ons work.
New to ZeroTek? Book a call with an Okta-certified expert to talk through which clients would benefit from OIG.