Agent SSO [What It Changes]

TL;DR

• Agent SSO is Okta's generally available product that registers a Cross App Access–capable AI agent as a first-class identity in Universal Directory and issues short-lived tokens instead of stored API keys.

• As of 24 August 2026, Okta's press release says Agent SSO is included in core Okta SSO plans at no additional cost for the more than 20,000 customers on that identity product.

• Independent comparison reporting on 25 August from THE DAILY BRIEF treats Agent SSO as Okta's product wrapping the ID-JAG / Cross App Access grant, against Entra Agent ID (issuer) and SailPoint Agentic Fabric (governor).

• A 2-truck HVAC shop, a 10-person agency, or a solo clinic should care when a booking bot or CRM helper currently sits on a shared API key: Agent SSO is the identity wrapper, not a guarantee those agents already speak Cross App Access.

Industry figures, not list prices.

Industry figures, not list prices.

Industry figures, not list prices.

According to NFIB, 44% of small businesses cite time-management. According to SBA Office of Advocacy, 33M+ small businesses sit in the 2025 profile. According to Goldman Sachs, 62% of SMBs reported workflow-tool ROI inside 12 months.

Key Takeaways

• This hub is the 24 August 2026 GA of Agent SSO inside Workforce SSO. It is not the 23 June Cross App Access partner wave and not Okta for AI Agents, which remains a separate subscription.

• According to Okta, Agent SSO applies only to agents that support Cross App Access; shadow agents and non-XAA tools need Okta for AI Agents, generally available since May 2026.

• Okta's AI Agents at Work 2026 survey (Apprize360, 292 executives and 492 knowledge workers, fielded March 2026) found only 34% of organizations apply the same security controls to AI agents as to humans.

• Microsoft publishes Agent 365 at $15 per user per month; Okta for AI Agents is quote-only on Okta's pricing page. Agent SSO itself is bundled in core SSO.

• Teams already routing CRM writes through US Tech Automations sales workflows will treat Agent SSO as an identity swap at the connector, not a rebuild of the form capture described in best form-to-CRM automation tools.

What Agent SSO is, in one sentence

Agent SSO is Okta's generally available feature that, when a Cross App Access–capable AI agent connects to an app, registers that agent in Universal Directory beside employees and issues short-lived, identity-governed tokens in place of stored credentials. That is the entity. It is not a new identity provider, not Entra Agent ID, and not a dashboard for agents that never speak Cross App Access.

A 2-truck HVAC shop already lives this failure: the after-hours booking bot uses the office manager's ServiceTitan or Jobber key, pasted into a config file, never rotated, still valid after the manager leaves. A 10-person marketing agency does the same with a HubSpot private app token in a Zap. A solo clinic does it with a Practice Fusion or EHR "integration password" on a sticky note. Agent SSO is Okta's answer for shops already on Okta Workforce: the agent gets a directory object and a short-lived token at connection time. If you are not on Okta, this SKU does not follow you. The reason to read the page is the mechanism — first-class agent identity at SSO — not the brand.

What shipped on 24 August 2026

Okta's newsroom post is dated 24 August 2026, San Francisco. Agent SSO is generally available and included in core Okta SSO at no additional cost. It brings the open Cross App Access standard into the identity product used by more than 20,000 customers.

The same release separates three questions: where are my agents, what can they connect to, what can they do. Agent SSO answers the Cross App Access slice of the first two. Okta for AI Agents, GA since May 2026, answers discovery of shadow agents, non-XAA connections, agent-to-agent links, certifications, and a kill switch.

According to THE DAILY BRIEF, checked 25 August 2026, Microsoft Agent 365 list price is $15/user/month on an annual commitment, while Okta for AI Agents remains "inquire for pricing."

According to Microsoft Agent 365, the add-on is $15.00 user/month paid yearly, and Microsoft 365 E7 is $99.00 user/month with Agent 365 included.

According to RFC 8693, token exchange has been a Standards Track RFC since January 2020 — the grant Agent SSO wraps rather than a new wire format.

The Cross App Access solution page, Workforce SSO product page, and MCP EMA spec are the three public maps of the same hop. RFC 7523 is the JWT bearer half, dated May 2015. Entra's agent-identity concept page is the Microsoft-side counterpart, last updated 15 June 2026 on the Learn stamp we fetched.

The June 23 wave is background, not this GA. Okta's Cross App Access partners release named 25-plus early adopters including Anthropic, Cursor, VS Code, Asana, Atlassian, Figma, Linear, Slack, and Supabase, with Workforce access from August 2026 and Auth0 early access from end of July 2026.

Sources: Okta Agent SSO; Beri, 25 Aug 2026; Microsoft Agent 365; Okta pricing.

How Agent SSO works, in plain language

When an agent that supports Cross App Access connects to an enterprise application, Okta registers it in Universal Directory and issues short-lived tokens. Administrators assign and update policy in the same console they use for employees. The press release's example: if the org deploys Anthropic's Claude, security teams govern its access natively, and employees stop sharing static credentials or clicking repeated consent prompts.

Cross App Access is the open protocol. Okta says it initially led the design, that it extends OAuth, and that it is the official Enterprise-Managed Authorization extension for the Model Context Protocol. The IETF draft behind the grant is draft-ietf-oauth-identity-assertion-authz-grant-04 (ID-JAG), dated 21 May 2026, not a ratified RFC.

The two-step chain is RFC 8693 token exchange plus RFC 7523 JWT bearer grant: the agent takes an IdP token, exchanges it for a short-lived assertion scoped to one API, then redeems that assertion at the API's own authorization server. The IdP brokers; the resource server still issues its own access tokens.

Okta Developer documents the requesting-app / resource-app pattern (Agent0 calling Todo0) and notes that Admin Console steps moved toward Directory > AI Agents. Keycard announced ID-JAG support as early access, treating Okta XAA as one IdP implementation among others.

The GA post's comparison table is the cleanest vendor diagram. Agent SSO registers Cross App Access agents in Universal Directory and issues identity-governed tokens for agent-to-app connections. Okta for AI Agents registers all agents, including shadow discovery through browser, endpoint, and network detection; extends to non-XAA agents, agent-to-agent connections, and runtime enforcement; and adds certification reviews, advanced authorization, and a kill switch. Agent SSO's "what can they do" cell is N/A. That is not a missing row. It is Okta saying the bundled SKU does not include end-to-end governance.

Okta's own "Agent Identity Gap" section is the why: most agents reach data through static API keys, one-off OAuth grants, and custom integrations. They operate as anonymous traffic with no owner, no policy, and no audit trail. The problem compounds across three populations: agents the company built, agents embedded in software it bought, and agents employees deployed without approval.

Honest limits: Agent SSO does not govern agents that never speak Cross App Access. Availability is Okta Workforce. Auth0 is a separate early-access track. The Okta Integration Network list in the GA post includes Anthropic, Archestra.AI, Asana, Atlassian, Canva, Datadog, Figma, Glean, Granola, Linear, MintMCP, Notion, Slack, and Supabase — not every SaaS tool a clinic uses.

Ric Smith, President of Products and Technology at Okta, is quoted in the GA release: granting agents access to enterprise systems should not require trading away security or visibility, and bundling the capability into core SSO is how Okta wants that first step to ship. Treat the quote as positioning, not as a measured outcome.

Microsoft Learn defines agent identities as accounts in Entra ID that request access tokens for web services, with autonomous and delegated modes. That is the competing issuer. Agent SSO does not replace it. The two products meet only if you run both stacks.

Why now: the constraint that broke

Static API keys and per-user consent screens do not scale when agents spawn agents. According to Okta's AI Agents at Work 2026, 58% of executives reported an AI-related security incident or close call in the past year, and 52% of employees admitted using AI tools without approval.

The same survey: 92% of executives said autonomous AI agents are in widespread (58%) or moderate (35%) use; 64% of knowledge workers use an AI tool at least daily. Policies that exist on paper are not the policies workers can find: 65% of executives called policies "very clear" while 57% of knowledge workers disagreed.

That is the constraint Agent SSO is aimed at: move agent authorization from each app's consent screen to the identity provider you already pay for. It only works if both the agent and the target app implement the grant.

Survey figures worth putting in a table

Source: Okta, AI Agents at Work 2026, published 27 May 2026.

USTA analysis: 501st-agent invoice under published list prices

USTA analysis. Inputs from Beri (25 August 2026) and Microsoft's pricing page: Agent 365 is $15 per human user per month, licensed per human who interacts with, owns, manages, or sponsors agents — not per agent. Okta Agent SSO is $0 extra on core SSO. Okta Workforce Starter is $6 per user per month and Essentials $17, both billed annually, with a $1,500 annual contract minimum per Okta pricing.

Take Beri's worked example of 2,000 employees and 500 agents. If 300 humans need Agent 365: 300 × $15 × 12 = $54,000/year. If all 2,000 are licensed: 2,000 × $15 × 12 = $360,000/year. The 501st agent costs $0 on Microsoft's published unit. Agent SSO's published unit for the XAA connection itself is also $0 on core SSO; Okta for AI Agents, which covers the rest of the estate, is unpublished.

The arithmetic does not say Okta is cheaper. It says the 501st XAA-speaking agent is free on both published SKUs, and the bill you can actually quote is the human-seat layer (Okta SSO suites or Agent 365), not a per-bot line item. If your HVAC booking bot never speaks Cross App Access, Agent SSO's $0 does not apply and you are still on keys or a quoted add-on.

Who this is for in an SMB shop

If you already run Okta Workforce for staff SSO, Agent SSO is a checkbox on agents that appear in the Integration Network, not a new IdP project. Start with the one agent that currently holds a long-lived CRM or scheduling key.

If you run Microsoft 365 only, Entra Agent ID is the issuer that mints in-tenant agent identities; Agent SSO will not follow those agents into Graph. Beri's disqualifier stands: do not buy Okta for AI Agents if the entire estate lives in one Microsoft tenant.

If you have no IdP, Agent SSO is not an SMB starter kit. Fix SSO for humans first. Executive-assistant automation still depends on who is allowed to hold the calendar credential.

The operational test for a 10-person shop is narrow. Pick the one agent that books, files, or writes to a system of record. If that agent is Claude, Cursor, or another name on the OIN XAA list, Agent SSO is how the connection should look after an admin assignment, not after a shared password in a password manager. If that agent is a vendor chatbot with a static key, Agent SSO will not wrap it. Write the key's owner and rotation date on the same page you use for staff joiner-mover-leaver. The state of small-business automation pattern still applies: a repeatable credential step beats a new dashboard.

Okta Workforce Starter at $6 per user per month and Essentials at $17, billed annually, remain the human SSO layer this feature rides on. Professional and Enterprise are inquire-only. None of those published suite prices is the agent add-on. Do not tell a clinic that "SSO is free for bots" without saying "only if the bot speaks Cross App Access and you already bought SSO for people."

Shops already connecting apps through US Tech Automations agentic workflows should map each connector to "human SSO," "XAA agent," or "static key," then retire the keys that have an XAA path.

Signal vs Speculation

Demonstrated fact (sourced). Agent SSO is GA as of 24 August 2026, bundled in core Okta SSO, limited to Cross App Access agents, with a named OIN roster. Okta for AI Agents is a separate subscription, GA since May 2026. Cross App Access launched with 25-plus partners on 23 June 2026. ID-JAG is an IETF Internet-Draft at revision 04, not an RFC. Microsoft publishes $15/user/month for Agent 365. Okta's survey numbers are Okta-commissioned.

Our read: over 12–36 months, SMB shops on Okta will get Agent SSO "for free" and still keep API keys for the booking tools that never implement ID-JAG. The protocol, not the SKU, is what retires standing privilege. If ID-JAG stalls as a draft, Agent SSO remains a nice directory object on top of keys. If MCP Enterprise-Managed Authorization keeps adding resource apps, the clinic's "shared EHR password" becomes the exception queue, not the default. Do not forecast a 34% control-parity jump from this GA alone; that survey figure is a baseline, not a target Okta promised to hit.

FAQ

What is Agent SSO?

Agent SSO is Okta's generally available feature that registers Cross App Access–capable AI agents as first-class identities in Universal Directory and issues short-lived tokens instead of stored API keys, included in core Okta SSO at no extra seat fee as of 24 August 2026.

Does Agent SSO cover every AI tool in the company?

No. The 24 August GA post limits it to agents that support Cross App Access; discovering shadow agents and governing non-XAA tools is Okta for AI Agents.

How is this different from ID-JAG?

ID-JAG is the IETF grant (draft-04). Cross App Access is Okta's branded implementation. Agent SSO is the Workforce product that turns that grant into a directory identity at connection time.

What does Microsoft charge per agent?

Nothing per agent on the published page. Microsoft Agent 365 is $15 per user per month for humans who interact with or sponsor agents.

Should a 10-person agency turn this on?

If the agency already pays for Okta SSO and uses a listed XAA agent (Claude, a supported SaaS MCP server), yes as a first-class identity for that connection. If the agency lives in Microsoft 365 Copilot only, Entra Agent ID is the closer issuer.

What to do this week

List every agent and integration that holds a long-lived key. Ask your IdP in writing whether it issues ID-JAG assertions today and to which resource servers. Date the answer. If you are on Okta Workforce, confirm Agent SSO is on and that the target app is in the Integration Network.

Homepage context sits at ustechautomations.com. When the connector is the bottleneck, open the agentic workflow builder and replace the stored key with the identity the IdP already issues.