What ZeroTek’s Okta Pro license includes for session security
ZeroTek's Okta Pro license does a lot of work at the front door. Adaptive MFA, device context, and network signals all help decide whether a sign-in should succeed. We've covered how MSPs can tighten that foundation in our posts on session token theft and Universal Logout.
Okta Pro also lets an admin respond when something looks wrong. With Universal Logout configured, an admin can end a user's sessions and revoke their tokens across supported apps—including Microsoft 365, Slack, and Zoom—in one action.
That's a strong baseline, and for many clients it's enough. The gap ITP closes is timing. A manual response starts when someone notices the problem. ITP starts when the risk appears.
What Okta Identity Threat Protection (ITP) adds
ITP extends protection to every stage of a user's session and responds automatically at each one.
Before sign-in: bot protection. ITP now includes bot protection, which uses a machine learning model to identify requests from bots before they attempt to sign in. When it detects one, it applies the remediation you've configured, including a transparent challenge that requires no input from the user. That helps counter automated account takeover and fraud attempts without adding friction for real users.
At sign-in: entity risk. Okta's risk engine tracks risk for each user based on identity threat signals such as brute-force attempts, sign-ins from high-threat IP addresses, breached credentials, suspicious app access, residual risk from session hijacking, and users reporting a sign-in with "This wasn't me." Entity risk changes are usually evaluated at the point of sign-in, and the entity risk policy decides what happens when a user's risk level changes: Universal Logout, a workflow, or both.
After sign-in: session protection. Once a user signs in, their session carries the trust established at sign-in. Session protection watches for changes in a session's context afterward, such as a change in IP address or device. When it detects a session violation, it takes the remediation actions you've configured.
All of this happens automatically, without waiting for an admin. Admins can still step in: they can raise or lower a user's risk level manually when they know something the risk engine doesn't.
The difference from Okta Pro is simple to state: with Pro, an admin can end a user's sessions. With ITP, Okta ends them for you when risk crosses the threshold you set.
How to configure ITP for a client
For each client, plan how you want ITP to respond in different scenarios:
Responses by risk level. Decide what happens at medium risk and what happens at high risk, including whether to take no action and simply log. A common pattern is to alert at medium and act at high, but it's up to you.
Which apps support Universal Logout. Universal Logout only reaches apps that support it and have been configured for it, so confirm the client's key apps are covered.
How your team hears about it. A workflow can notify your team, post to a channel, or open a ticket when ITP raises a user's risk. Every Okta org with ZeroTek's Okta Pro licensing includes up to 5 active flows, so a notification workflow fits within what the client already has.
How the user gets back in. When ITP ends a user's sessions, they'll need to sign in again with MFA. Make sure the client's help desk process accounts for that.
Plan for a tuning period at the start. ITP's policies, including bot protection, can be set to monitor only: detections are logged, but no actions are taken. Start there, review what ITP flags in the first few weeks to rule out false positives, adjust your rules, and turn on automatic responses once you're confident in them.
ITP use cases: payments and remote work
A client that moves money. An accounting firm's staff approve payments and change banking details every day. If an attacker gains access to one of those accounts, every hour they keep it is an opportunity for fraud. Business email compromise accounted for about $3.05 billion in losses reported to the FBI in 2025. ITP doesn't replace payment verification processes, but it shrinks the window an attacker has: when the risk engine flags the account, ITP can end the user's sessions in supported apps, including Microsoft 365, and alert your team, without waiting for someone to notice.
A client whose people work from anywhere. A session’s context can change more often when staff sign in from home networks, hotel Wi-Fi, and personal devices. Session protection is built for this: it monitors for changes in a session's context after sign-in and responds according to your rules, so an unusual change is challenged or stopped rather than going unnoticed or silently trusted.
Why MSPs should run ITP in their own Okta org first
An MSP's own Okta org holds access to every client it manages, which makes it one of the most valuable places to run ITP. It's also a practical place to start: you see how ITP behaves in an environment you know well, tune your rules, and build the playbook you'll use for clients.
Our partner Renascent Technology took exactly this approach:
"Our Okta org is the front door to every client environment we manage, so it was the obvious place to start with Identity Threat Protection. We wanted to see firsthand what it flags, how it responds, and how to tune it so it protects us without getting in our team’s way. When we recommend it to a client, we’re recommending something we already rely on every day."
—Stuart Jivapongse, President, Renascent Technology
For more on why MSP tenants are a priority target, see How MSPs can defend against AI-powered identity attacks.
Which clients need Okta Identity Threat Protection?
ITP is a strong fit for:
Clients that handle payments or sensitive data, where a compromised account has immediate financial or regulatory consequences.
Clients with distributed or mobile workforces, where session context changes often.
Your own MSP, given the access your team holds across clients.
It may not be needed yet for:
Small clients with low-risk data and simple environments, where Okta Pro's sign-in security and manual Universal Logout already cover the need.
Before rolling ITP out, agree on the response actions with the client. Automatic logouts affect their users, so they should know what will happen and why. Starting in monitor-only mode gives you both a chance to see what ITP flags before it acts.
Month-to-month ITP licensing for MSPs and SMBs
SMBs face the same identity threats as larger organizations, often with less margin for recovery. Okta's direct purchasing model—annual contracts with upfront payment—is built for enterprises buying identity for themselves. To bring its technology to the MSP channel, Okta chose ZeroTek as its exclusive partner, with a licensing model built for how MSPs and their clients actually buy.
As with the rest of ZeroTek's MSP-friendly Okta licensing, ITP is billed monthly based on use, with no annual contract, and you set the price for your clients. Your client gets threat protection as a predictable monthly service, and you add a service line without committing capital ahead of demand.
Add ITP for the clients who need it
If you're a ZeroTek partner, request the ITP add-on by emailing success@zerotek.com and we’ll set you up. To learn more first, read the Identity Threat Protection overview and how month-to-month add-ons work.
New to ZeroTek? Book a call with an Okta-certified expert to talk through which clients would benefit from ITP.