Okta runs a graded certification ladder, and picking the wrong rung wastes an exam fee, because several exams require an active lower credential and the formats now lean heavily on hands-on configuration in a live tenant. This guide sets out, credential by credential, what Okta publishes about each exam: the exam code, format, duration, fee, prerequisites, recommended experience, topics and renewal rules. Every fact comes from Okta's own certification handbook, exam pages, study guides and renewal page, checked on 8 November 2026. Okta changes exam formats often (several exams were discontinued or marked legacy in the last two years), so confirm details on the exam page before you book. It is written for Okta administrators, implementers, developers and the managers who fund their training. For a cross-vendor view of identity credentials, see the Identity Certifications Guide.
Key takeaways
- The ladder is Professional, Administrator, Consultant, then Technical Architect. Administrator requires an active Professional certification, Consultant requires an active Administrator certification, and Technical Architect requires current Consultant and Developer certifications plus an approved application.
- Most exams are hands-on. The current Professional exam (OKPRO1) is six performance-based use cases in 150 minutes, and the Administrator, Consultant and Developer exams pair a multiple-choice part with four hands-on use cases.
- Fees are flat. The handbook lists US$250 for Professional, Administrator, Consultant, WIC Developer and CIC Developer, US$100 per retake, and US$5,000 for Technical Architect with US$2,500 per retake.
- Renewal is every 24 months. Pass a US$100 unproctored maintenance exam for your highest credential, or earn a higher-level certification, and every lower Okta certification renews with it. The Technical Architect overview states a 36-month renewal.
- Security policy is the heaviest topic. In the Professional study guide, Security Enforcement (authenticators, enrolment, global session and authentication policies, recovery) carries 38% of the weight, more than any other use case.
Who the certification is for
Okta certifications are granted to individuals, not companies, and each one targets a distinct job. Okta's exam pages describe the intended candidate through recommended experience rather than formal job titles, which is the clearest guide to where you should start.
| Credential | Typical role | Okta's recommended experience | Product focus |
|---|---|---|---|
| Okta Certified Professional | Help desk lead, junior identity administrator, IT generalist running Okta | 1+ year in a technical security and identity role, 3+ months hands-on Okta, experience administering Okta Identity Engine (OIE) | Day-to-day Workforce Identity administration |
| Okta Certified Administrator | Identity administrator who owns the tenant | 2+ years in a technical security or identity role, 1+ year hands-on Okta | Directory integration, SSO, MFA, lifecycle, policies, Workflows |
| Okta Certified Consultant | Implementation engineer, partner consultant, identity architect | 5+ years in IAM, 1+ year implementing Okta | Migrations, federation, advanced SSO, device trust, APIs |
| Okta Developer (Workforce Identity Cloud) | Application developer integrating with Okta | 4+ years software development, 6+ months hands-on Okta | Okta APIs, OIDC and OAuth flows, Hooks, Sign-In Widget |
| Auth0 Certified Developer (Customer Identity Cloud) | Developer building customer-facing login | Hands-on work with the Auth0 Management and Authentication APIs and SPA, native, regular and M2M applications | Auth0 tenants, Universal Login, Actions, MFA |
| Okta Certified Technical Architect | Senior architect designing large Okta estates | Holders of current Consultant and Developer certifications | End-to-end solution design |
| Specialty: Workflows, Access Gateway | Engineers running those specific products | Hands-on experience with the product (Access Gateway page) | Okta Workflows (OKWF1), Okta Access Gateway (OKAG1, OKAG3) |
Okta's handbook lists the WIC Developer and CIC Developer credentials by those names; the exam catalogue titles them the Okta Developer Certification Exam (OKDEV1) and the Auth0 Certified Developer Exam.
Exam format and domains
All live exams are delivered online. The handbook states that exams are administered and proctored by ProctorU, and the Professional study guide notes that Okta migrated from Examity to ProctorU by Meazure Learning. Exams may include unscored questions that you cannot identify, results are pass or fail only, and Okta does not publish cut scores. Results are emailed within 10 business days (15 for Technical Architect).
| Exam (code) | Format | Duration | Languages |
|---|---|---|---|
| Okta Certified Professional Performance Exam (OKPRO1) | Six performance-based, hands-on use cases | 150 minutes | English |
| Okta Certified Administrator Hands-On Configuration Exam (OKADM1H) | Part I: 35 Discrete Option Multiple Choice (DOMC) questions; Part II: four hands-on use cases | 2 hours 45 minutes (45 + 120) | English, Japanese |
| Okta Certified Consultant Hands-On Configuration Exam (OKCON1) | Part I: 47 DOMC items; Part II: four hands-on use cases | 180 minutes (60 + 120) | English, Japanese |
| Okta Developer Certification Exam (OKDEV1) | Part I: 45 multiple-choice questions; Part II: four hands-on use cases | 150 minutes | English |
| Auth0 Certified Developer Exam | Part I: 35 multiple-choice items; Part II: seven hands-on use cases in your own development environment (Customer Identity Cloud exam page). Okta announced a refreshed, more performance-focused exam for early November 2026, so confirm the format on booking | 180 minutes (60 + 120) | English |
| Okta Certified Access Gateway Specialty (OKAG1, OKAG3) | 50 DOMC items, assessed in a live Access Gateway environment | 90 minutes | Not stated |
Watch the Administrator exam status. The OKADM1H page calls it a legacy exam that will be retired, and the catalogue already lists a free practice exam for a new Okta Certified Administrator Performance Exam. Okta's pages read on 8 November 2026 did not give that exam's code, format or duration. Anyone planning the Administrator credential should check which exam is live on the day of booking.
Professional domain weights
The Professional study guide is the only one read that publishes weights. They show where to spend preparation time.
| Use case | Weight | Tasks named in the study guide |
|---|---|---|
| 1. Account creation and user management | 26% | Users, custom attributes, groups, group rules, admin roles, custom roles with resource sets |
| 2. Application setup with the Okta Integration Network (OIN) | 10% | SAML SSO for an OIN app, provisioning, group assignment |
| 3. Attribute mapping and offboarding | 8% | Map attributes, deactivate a user, confirm access is blocked |
| 4. Security enforcement | 38% | Authenticator and enrolment policies, global session policy rules, authentication policies, self-service recovery |
| 5. Troubleshooting | 12% | Sign-in failures, expiring passwords, clearing sessions, dashboard and group assignment faults |
| 6. Syslog and Okta Support | 6% | Finding events in the System Log, Okta support resources |
The study guide allows the Okta Help Center during the exam and requires Okta Verify on your phone, which you may use only for tasks that need it.
Topics for the higher exams
- Administrator (OKADM1H): user and group management, AD and LDAP directory integration, SAML and OIDC SSO, MFA policies, lifecycle management, access and security policies, app integration, troubleshooting and logs, and Okta Workflows.
- Consultant (OKCON1): configuration and integration, user and password migration, profile sourcing, inbound federation, advanced SSO (SAML, OIDC, RADIUS), adaptive MFA and ThreatInsight, device trust, custom configurations, directory integrations including desktop SSO, Advanced Server Access, OAuth 2.0, and Okta APIs and troubleshooting.
- Developer (OKDEV1): Okta APIs and REST APIs, OIDC and OAuth flows, Okta Hooks, debugging, the Sign-In Widget, SSO and API Access Management, design principles and Lifecycle Management.
- Auth0 Certified Developer: OAuth 2.0 and OpenID Connect, JWTs, tenant and application setup, Universal Login and SSO, user management and migration, Rules and Actions, MFA, branding, and logs and troubleshooting.
- Access Gateway: installation and configuration, Kerberos, header-based, EBS and PeopleSoft applications, security, high availability, data stores, and monitoring and troubleshooting.
Prerequisites and experience
Okta's formal rules are few, but the chain of active prerequisites is strict: if a lower credential lapses, you cannot sit the next exam until it is renewed.
- Age: candidates must be at least 18, or a parent or guardian must co-sign the minor form.
- Professional: no formal prerequisite. Okta recommends the Administration: Onboarding learning plan or Okta Essentials for Administrators.
- Administrator: an active, unexpired Professional certification, plus the Administration: Series I learning plan, the Okta Essentials for Administrators course or an equivalent programme.
- Consultant: the OKCON1 page states that an active, unexpired Administrator certification is required.
- Developer and Auth0 Developer: no formal prerequisite listed; recommended experience only.
- Technical Architect: current Consultant and Developer certifications, an application that Okta approves, and an exam offered once a quarter during a one-week delivery window.
Treat the recommended experience as real. The hands-on parts expect you to configure a live tenant under time pressure, and the handbook notes that training alone does not guarantee success.
Preparation plan
- Confirm the live exam. Open the exam page on certification.okta.com and record the code, format and duration. Several older exams (the original Professional exam, the English Professional Hands-On Configuration exam and the earlier Administrator exam) have been retired or discontinued.
- Read the study guide twice. Okta advises reviewing it before each attempt because its content may change. Map each use case to features you have or have not configured.
- Build a practice tenant. Use a non-production Okta org to configure users, groups, group rules, custom admin roles with resource sets, OIN SAML apps with provisioning, and each policy type: authenticator enrolment, global session, authentication and password recovery.
- Weight your time. For Professional, spend over a third of practice on security enforcement, then user management. For Consultant, rehearse migrations, inbound federation and device trust, which day-to-day administrators rarely touch.
- Take the free practice exam, then the premier one. Okta offers a free standard practice exam for knowledge and a paid premier practice exam that rehearses the hands-on use cases.
- Rehearse troubleshooting from the System Log. Practise finding failed sign-ins and policy evaluations by event, because troubleshooting and log use appear in every administrator exam. See the Okta System Log Detection Guide.
- Prepare the exam room. Book at least 24 hours ahead to avoid an on-demand fee, test your equipment, keep one monitor and a clear desk, and have formal ID ready. A proctor can stop an exam, and a stopped exam is void.
Cost, renewal and continuing education
| Item | Fee (US$) | Rule |
|---|---|---|
| Professional, Administrator, Consultant, WIC Developer, CIC Developer exam | 250 | Plus tax where applicable |
| Retake of those exams | 100 | 24 hours after the first fail, 14 days after each later fail; passed exams cannot be retaken; beta exams once only |
| Technical Architect exam | 5,000 | Application and approval first |
| Technical Architect retake | 2,500 | Per attempt |
| Maintenance exam (any) | 100 | Unproctored, online |
Fees for failed exams are not refunded. You may reschedule or cancel up to 24 hours before the start; a no-show is charged the full fee. Accommodation requests go to Okta at least 30 days before the exam.
Maintenance exams
Okta's renewal page says a certification renews for 24 months when you pass the maintenance exam for your highest-level credential (which renews all your Okta certifications) or earn a higher-level certification (which renews all lower ones). The handbook says the 24-month rule applies until further notice.
| Maintenance exam (code) | Questions or format | Time |
|---|---|---|
| Professional (OKPROM1) | 12 questions | 45 minutes |
| Administrator (OKADMM1) | 24 questions | 60 minutes |
| Consultant (OKCONM1) | 36 questions | 75 minutes |
| Okta Developer (OKDEVM1) | 24 questions | 60 minutes |
| Auth0 Developer (ADEVM1) | 23 questions | 60 minutes |
| Workflows Specialty (OKWFM1) | One hands-on use case with configuration tasks | 90 minutes |
The cheapest renewal path is often to climb: passing Administrator renews Professional, and passing Consultant renews both. Okta's pages read did not say how early you can renew or what happens on expiry, so check the Certification Credential Manager. For how renewal compares across the industry, see the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
| Your situation | Suggested route | Why |
|---|---|---|
| New to identity, joining a team that runs Okta | Professional | Covers the daily tasks and the policy model without a prerequisite |
| Sole Okta owner in a small or mid-sized organisation | Professional, then Administrator | Administrator adds directory integration, lifecycle and Workflows, which a sole owner must run |
| Partner or in-house implementation engineer | Through to Consultant | Migrations, inbound federation and device trust are implementation work |
| Developer integrating workforce apps | Okta Developer | Tests OIDC, OAuth, Hooks and API Access Management directly |
| Developer building customer login | Auth0 Certified Developer | Tests Universal Login, Actions, M2M applications and the Management API |
| Architect for a large, multi-org estate | Consultant and Developer, then Technical Architect | The only route Okta publishes to its top credential |
Large versus small organisations: in a small team one administrator usually needs Professional and Administrator; in a large enterprise, split credentials by role so that engineers who build integrations hold Developer and those who run policy hold Administrator or Consultant.
The non-human identity angle: the exam topics include API Access Management, OAuth 2.0, M2M applications and Hooks, which is where machine credentials live in Okta: API tokens, service apps and OAuth clients. Passing an exam does not make those identities safe; pair the credential with hands-on work such as an audit of tokens and service apps. See How to audit Okta API tokens and service apps and the Okta Security Hardening Guide.
The 2023 compromise of Okta's support case system, where credentials for a service account saved in a personal Google profile led to the exposure of 134 customers, is a useful reminder of why administrators should understand how admin sessions and service accounts are governed. See the Okta Support System Breach 2023.
Mapping exam content to control frameworks
The table shows where exam content overlaps control areas auditors ask about. Holding a credential does not satisfy a control; it supports evidence of training for staff in specialised roles (NIST CSF 2.0 PR.AT-02).
| Exam content | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Users, groups, lifecycle and offboarding | PR.AA-01 | AC-2 Account Management |
| Admin roles, custom roles and resource sets | PR.AA-05 | AC-6 Least Privilege |
| Authenticators, MFA and authentication policies | PR.AA-01 | IA-2, IA-5 |
| System Log review and troubleshooting | DE.CM-03 | AU-2, AU-6 |
Practitioner checklist
- Open the live exam page on certification.okta.com and confirm code, format and duration on the day you book.
- Check that any prerequisite certification is active and will still be active on exam day.
- Download the study guide and map every use case to a feature you have configured in a practice tenant.
- For Professional, put at least a third of practice into authenticator, session, authentication and recovery policies.
- Take the free practice exam, then decide whether the paid premier practice exam is worth it.
- Book at least 24 hours ahead, test the ProctorU set-up and keep Okta Verify updated on your phone.
- Diarise renewal at 20 months and decide whether a maintenance exam or the next credential is the better renewal.
- Pair the credential with a documented project, such as an audit of API tokens and service apps, to show applied skill.
Standards and references
- Okta: Okta Certification Program Handbook
- Okta: Okta Certified Professional Performance Exam (OKPRO1)
- Okta: Professional Performance Exam Study Guide
- Okta: Okta Certified Administrator Hands-On Configuration Exam (OKADM1H)
- Okta: Okta Certified Consultant Hands-On Configuration Exam (OKCON1)
- Okta: Okta Developer Certification Exam (OKDEV1)
- Okta: Okta Certified Technical Architect Overview
- Okta: Keep Your Okta Certification Current
Related NHI Mgmt Group resources: Identity Certifications Guide · Okta Security Hardening Guide · Okta System Log Detection Guide · Auth0 Hardening Guide · Certification Renewal and CPE Requirements Guide