Skip to main content
Applies to BloodHound Enterprise and CE

​
Overview

User objects (AKA People) represent individuals who have access to the Okta organization. Each user has a unique identifier, username in the email address format, and various attributes such as email, first name, last name, and status. Users are represented as Okta_User nodes in BloodHound.

​
Edges

The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions.

​
Inbound Edges

Edge TypeSource Node TypesTraversable
Okta_ApiTokenForOkta_ApiToken✅
Okta_ContainsOkta_Organization✅
Okta_DeviceOfOkta_Device❌
Okta_GroupAdminOkta_User, Okta_Group, Okta_Application✅
Okta_HelpDeskAdminOkta_User, Okta_Group, Okta_Application✅
Okta_IdentityProviderForOkta_IdentityProvider✅
Okta_InboundSSOAZUser✅
Okta_ManagerOfOkta_User❌
Okta_OrgAdminOkta_User, Okta_Group, Okta_Application✅
Okta_OutboundSSOOkta_User✅
Okta_PasswordSyncUser, Okta_User✅
Okta_ReadPasswordUpdatesOkta_Application✅
Okta_RealmContainsOkta_Realm✅
Okta_ResetFactorsOkta_User, Okta_Group, Okta_Application✅
Okta_ResetPasswordOkta_User, Okta_Group, Okta_Application✅
Okta_ResourceSetContainsOkta_ResourceSet✅
Okta_ScopedToOkta_RoleAssignment❌
Okta_UserPullOkta_Application❌
Okta_UserSyncUser, Okta_User, SNOW_User❌

​
Outbound Edges

Edge TypeDestination Node TypesTraversable
Okta_AddMemberOkta_Group✅
Okta_AppAdminOkta_Application, Okta_ApiServiceIntegration✅
Okta_AppAssignmentOkta_Application❌
Okta_CreatorOfOkta_ApiServiceIntegration❌
Okta_GroupAdminOkta_User, Okta_Group✅
Okta_GroupMembershipAdminOkta_Group✅
Okta_HasRoleOkta_Role, Okta_CustomRole❌
Okta_HasRoleAssignmentOkta_RoleAssignment❌
Okta_HelpDeskAdminOkta_User✅
Okta_ManageAppOkta_Application✅
Okta_ManagerOfOkta_User❌
Okta_MemberOfOkta_Group✅
Okta_MobileAdminOkta_Device✅
Okta_OrgAdminOkta_User, Okta_Group, Okta_Device✅
Okta_OutboundSSOAZUser, GH_User, jamf_Account, SNOW_User, Okta_User✅
Okta_PasswordSyncOkta_User, User✅
Okta_ReadClientSecretOkta_ClientSecret✅
Okta_ResetFactorsOkta_User✅
Okta_ResetPasswordOkta_User✅
Okta_SuperAdminOkta_Organization✅
Okta_SWAGH_User, jamf_Account, OP_User, SNOW_User❌
Okta_UserPushOkta_Application❌
Okta_UserSyncOkta_User, User, AZUser, OP_User, SNOW_User❌

​
Properties

NameSourceTypeDescription
iduser.idstringUnique user identifier.
nameuser.profile.loginstringOkta username/login.
display_nameuser.profile.displayNamestringUser display name.
okta_domainCollector context (non-API)stringOkta organization domain where the user exists.
loginuser.profile.loginstringUser login/UPN value.
emailuser.profile.emailstringPrimary email address.
first_nameuser.profile.firstNamestringUser first/given name.
last_nameuser.profile.lastNamestringUser last/family name.
titleuser.profile.titlestringJob title from user profile when present.
departmentuser.profile.departmentstringDepartment value from user profile when present.
cityuser.profile.citystringCity/location value from user profile when present.
stateuser.profile.statestringState/region value from user profile when present.
country_codeuser.profile.countryCodestringISO-like country code from user profile when present.
statususer.statusstringUser lifecycle status.
enabledIsEnabled(user.status)boolBoolean status projection used by BloodHound.
has_role_assignmentsCalculatedboolIndicates whether the user is assigned any administrative roles.
credential_provider_nameuser.credentials.provider.namestringAuthentication provider name for this user.
credential_provider_typeuser.credentials.provider.typestringAuthentication provider type for this user.
manager_iduser.profile.managerIdstringManager identifier from user profile synchronization.
activateduser.activateddatetimeTimestamp when the user account was activated.
createduser.createddatetimeUser creation timestamp.
password_changeduser.passwordChangeddatetimeTimestamp when the password was last changed.
last_loginuser.lastLogindatetimeTimestamp of the most recent successful login.
last_updateduser.lastUpdateddatetimeLast profile/update timestamp.

​
Sample Property Values

id: 00uw2sodn4ZPJJQyx697
name: john.doe@contoso.com
display_name: John Doe
okta_domain: contoso.okta.com
login: john.doe@contoso.com
email: john.doe@contoso.com
first_name: John
last_name: Doe
title: Senior Identity Engineer
department: Security Engineering
city: Seattle
state: WA
country_code: US
status: ACTIVE
enabled: true
has_role_assignments: false
credential_provider_name: OKTA
credential_provider_type: OKTA
manager_id: joe.smith@contoso.com
created: 2025-10-03T18:45:57+00:00
activated: 2025-10-03T19:02:11+00:00
password_changed: 2026-01-12T14:27:03+00:00
last_login: 2026-02-20T09:41:55+00:00
last_updated: 2025-10-29T11:09:47+00:00

​
User Status

User status can have multiple values, as illustrated below: Okta user status To simplify analysis in BloodHound, the collector maps the Status attribute to the virtual boolean Enabled attribute as follows:
Okta User StatusEnabledExplanation
ACTIVE✅User can authenticate.
PASSWORD_EXPIRED✅User’s password has expired but can still authenticate.
LOCKED_OUT✅User is locked out but can still authenticate after unlocking.
PROVISIONED✅User is provisioned but cannot authenticate yet.
RECOVERY✅User is in recovery mode and cannot authenticate.
SUSPENDED❌User is suspended and cannot authenticate.
STAGED❌User is staged and cannot authenticate yet.
DEPROVISIONED❌User is deprovisioned and cannot authenticate.
This mapping is a simplification and may not cover all edge cases. Always refer to the actual Status attribute for precise user state information.

​
Synchronization with External Directories

Users can be synchronized from external directories such as Active Directory (AD) or LDAP. When synchronized, certain attributes may be mapped from the external directory to the Okta user profile. Additional Active Directory attributes