Closing the loop on identity risk
Cloudflare One is adding a new integration with Okta that sends Cloudflare’s user risk scores to Okta’s Identity Threat Protection in real time. The goal is to let organizations automate policy responses when a user’s risk level changes, instead of relying on manual triage across disconnected tools.
Security teams typically juggle multiple products that don’t share risk telemetry well. Cloudflare’s risk posture management capabilities, launched earlier this year, address this by providing three functions on one platform:
- Assessing user risk with first-party user entity and behavior analytics (UEBA) models
- Exchanging risk telemetry with other security tools
- Enforcing risk controls based on dynamic first- and third-party risk scores
The Okta integration builds on the second capability. Cloudflare’s real-time risk scores are shared with Okta, which can then trigger its own policy actions based on that risk input.
How Cloudflare scores user risk
Cloudflare’s user risk scoring, introduced earlier this year, evaluates real-time user activity and assigns each user a score of high, medium, or low. Risk signals include impossible travel, data loss prevention (DLP) detections, and endpoint detections that suggest a compromised device. All activity contributing to a score is logged for analysis.
Predefined risk behaviors are included so administrators can start immediately. Policies can be built around specific behaviors, and each behavior’s risk level can be tuned to match the organization’s tolerance.
Automatic response in Okta
Opting into the integration shares continuously updated Cloudflare user risk scores with Identity Threat Protection with Okta AI. If a user’s risk is too high, Okta can automatically respond—for example, by requiring multi-factor authentication (MFA) verification or by logging the user out of all applications.
Consider a user who previously had a low risk score. If Cloudflare detects impossible travel, the user’s risk level rises to high. Cloudflare transmits the updated score to Okta, which in turn triggers a Universal Logout and an MFA challenge on the next login attempt. Access to sensitive systems may be revoked entirely until the user is verified.
Event flow and token details
When a user exhibits risky behavior, it is recorded as a Risk Event. Cloudflare logs the event and determines whether further action is required. If Risk Score Sharing with Okta is enabled, any change in the risk score is sent to Okta ITP, which evaluates the change against the organization’s policies.
The transmission format is based on the OpenID Shared Signals Framework Specification (SSF). SSF’s core mechanism is the Security Event Token (SET), a specialized JSON Web Token. Providers can both produce and consume SETs, forming a shared network of user risk information across providers.
When sharing a risk score change, Cloudflare bundles metadata about the risk event and user into the SET payload. The token is then signed with Cloudflare’s private key, giving Okta cryptographic assurance of both the sender’s identity and the integrity of the payload. Once verified, Okta can apply Identity Threat Protection policies defined by the customer, such as signing out a user who receives a high risk score from Cloudflare.
Enabling the integration
Cloudflare customers can enable risk score sharing from the Cloudflare One SSO setup page, whether Okta is already integrated or being added for the first time. A confirmation will appear in audit logs.
For organizations that have already integrated Okta:
- In the Cloudflare One dashboard, go to Settings > Authentication and select the Okta login method.
- Select “send risk score to Okta.”
For organizations setting up Okta for the first time:
- Navigate to Settings > Authentication and select a new login method.
- Follow the instructions to add Okta as an SSO.
- Select “send risk score to Okta.”
Once enabled, every user risk score change is sent to Okta automatically, and the event is recorded in the audit log.
Bringing richer context into access decisions is central to Zero Trust. Risk scoring gives security teams a way to distill large volumes of user activity into a signal that Okta’s risk engine can act on, supporting the continuous evaluation that Zero Trust policies depend on.
