Okta Workflows is Okta's automation layer — a no-code flow builder that triggers on identity events (user provisioned, sign-in, MFA failure, group membership change) and can execute actions across connected applications.
Two of those actions are the Slack connector and the Microsoft Teams connector. Both are available in the Okta Workflows connector library. Both allow Okta Workflows to post messages to messaging channels when identity events occur.
They are independent connector instances. Sending one Okta event to both Slack and Teams requires either two separate connector action cards in the same workflow, or two parallel workflow branches — each authenticating with its own bot token, each configured with its own channel mappings.
Why This Matters for Security Operations
Security events don't respect platform boundaries. A suspicious sign-in alert needs to reach the on-call security engineer — who may be in Slack — and the IT manager on call — who may be in Teams — simultaneously.
With native Okta Workflows connectors, achieving this requires:
- Building two action cards or two parallel branches in the workflow (Slack and Teams)
- Authenticating two separate connector instances (Slack bot token, Teams bot token)
- Maintaining two separate channel configurations
- Updating both when the policy changes (new team, new channel, new severity threshold)
Each additional platform adds to the connector maintenance surface for every security workflow. There is no SyncRivo shortcut around this: SyncRivo does not accept Okta Event Hooks or Workflows HTTP calls, does not route identity events, and does not relay messages posted by bots or apps.
Okta Event Hooks: The Path Without a Workflows License
Okta Event Hooks (Admin Console → Workflow → Event Hooks) fire real-time HTTP POST requests to any HTTPS endpoint when identity events occur. No Okta Workflows subscription required — Event Hooks are available on all Okta plans.
If you go this route, the endpoint has to be something that posts into the destination platforms: a Teams Workflows or incoming-webhook flow for Teams, a Slack incoming webhook for Slack, or a small relay you host that verifies the hook, applies your policy, and posts to both. Select the events: user.session.start (for risk-based sign-in monitoring), user.mfa.attempt_bypass, user.lifecycle.deactivate, group.user_membership.add for privileged groups.
Per-Event Audiences for Identity Signals
Not all Okta events warrant the same audience across platforms. A common security operations model, implemented in your Workflows branches or your relay:
- Suspicious sign-in (high risk score): Slack #security-ops (immediate investigation) and Teams Security Engineering channel (parallel awareness)
- MFA bypass attempt: Slack #security-ops on-call and Teams IT Operations channel (active threat, both platforms)
- User deprovisioned: Slack #it-ops (access revocation confirmation) and Teams HR channel (headcount update)
- Privileged group membership added: Slack #security (audit log) and business owner Teams channel (approval confirmation)
Okta Workflows with Conditional Logic
For event handling that requires conditional logic — escalate only if the user is in a privileged group, or only if the sign-in is from an unfamiliar country — build the condition in an Okta Workflow, then add the Slack and Teams connector cards (or one HTTP card to your relay) as the final action steps. The policy lives in Okta; the posting is done by Okta's connectors.
Where SyncRivo Fits (and Where It Doesn't)
What SyncRivo bridges is the human conversation between the security engineers on Slack and the IT and HR people on Teams. Connect Slack #security-ops to the Teams IT Operations channel, and the response to an MFA bypass attempt — "Locking the account", "Is this the contractor who started Monday?", "Reset done, re-enrolling" — is visible on both platforms, in both directions, with threads, edits, files, and @mentions kept in sync. The Okta alert itself still arrives through Okta's own connectors or your Event Hook relay; SyncRivo does not copy it across.
For the Okta Event Hook and Workflows connector setup reference, see the Okta Security Alerts in Slack & Teams integration guide.
Ready to connect your messaging platforms?
