Okta Identity as a Service (IDaaS) Security Technical Implementation Guide

The Okta Identity as a Service (IDaaS) Security Technical Implementation Guide (V1 R3) has 29 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

29STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Sep 30 2026

Okta must be configured to disable persistent global session cookies.

Okta Identity as a Service (IDaaS) Security Technical Implementation Guide

Assessment Title

Rule Text

Okta must be configured to disable persistent global session cookies.

Description

Discussion Text

If cached authentication information is out of date, the validity of the authentication information may be questionable.

Satisfies: SRG-APP-000400, SRG-APP-000157

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-273206

Rule

SV-273206r1098885_rule

Severity

medium

Rule Version

OKTA-APP-001710

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the Admin Console:
1. Select Security >> Global Session Policy.
2. In the Default Policy, verify a rule is configured at Priority 1 that is not named "Default Rule".
3. Click the "Edit" icon next to the Priority 1 rule.
4. Verify "Okta global session cookies persist across browser sessions" is set to "Disabled".

If the above it not set, this is a finding.

Implementation Procedure

Fix Text

From the Admin Console:
1. Go to Security >> Global Session Policy.
2. Select the Default Policy.
3. In the "Rules" table, make these updates:
    - Click "Add rule".
    - Set "Okta global session cookies persist across browser sessions" to Disable.

STIG check 21 of 29 in the Okta Identity as a Service (IDaaS) STIG checklist

← Previous · V-273205The Okta Verify application must be configured to connect only to FIPS-compliant devices.Next · V-273207 →Okta must be configured to use only DoW-approved certificate authorities.