How to build Okta dashboards in Metabase

Okta is an identity and access management platform that handles workforce single sign-on, multi-factor authentication, and user lifecycle management across your applications. Metabase is where you turn those security signals into shared, trustworthy dashboards. This guide covers two complementary paths: a lightweight MCP + CLI route that pulls live data with the Okta MCP Server and loads a CSV into Metabase with the Metabase CLI, and a durable pipeline route that syncs Okta findings into a database so you can build dashboards anyone can read.

How do you connect Okta to Metabase?

Most teams combine both routes: use MCP and CLI uploads for a fast first pass, then move recurring security reporting to a warehouse-backed model.

What can you analyze from Okta data in Metabase?

• Failed login rate by app — built from system log events and the related users, applications, groups data your sync exposes.
• MFA adoption by factor type — built from system log events and the related users, applications, groups data your sync exposes.
• App sign-in volume — built from system log events and the related users, applications, groups data your sync exposes.
• Deprovisioning lag for departures — built from system log events and the related users, applications, groups data your sync exposes.
• Admin activity audit — built from system log events and the related users, applications, groups data your sync exposes.

Which Okta dashboards should you build in Metabase?

How do you use the Okta MCP Server with the Metabase CLI?

Pair the Okta MCP Server with the Metabase CLI for fast, hands-on analysis. MCP is useful for scoped lookups and summarized exports; the Metabase CLI's upload command loads CSV data into Metabase and creates a ready-to-query table and model.

Example workflow

• Ask the MCP server for a daily summary of system log events by application and outcome.
• Export the result as CSV, keeping stable IDs, severities, statuses, owners, and timestamps.
• Run mb upload csv to load it into Metabase as a table and model, then build questions and dashboards on top.

Be honest about the limits

• MCP lookups are excellent for exploration, not scheduled reporting.
• A CSV upload is a snapshot; refresh it with mb upload replace or move to the pipeline for real history.
• Daily event rollups are required for failed-login and MFA-adoption trends.
• mb upload csv needs an uploads database configured under Admin → Settings → Uploads.

How do you set up Okta MCP and the Metabase CLI?

{
  "mcpServers": {
    "okta": {
      "command": "uvx",
      "args": ["okta-mcp-server"],
      "env": {
        "OKTA_ORG_URL": "https://your-org.okta.com",
        "OKTA_CLIENT_ID": "your-client-id",
        "OKTA_SCOPES": "okta.users.read okta.apps.read okta.logs.read"
      }
    }
  }
}

Grant read-only scopes only — the server can manage users and apps if you let it. Scope the OAuth app to *.read for analysis work.

# Install the Metabase CLI
npm install -g @metabase/cli

# Log in (opens your browser; requires Metabase v62+)
mb auth login --url https://your-metabase.example.com

# Load a system-log-events export — creates a table AND a model
mb upload csv --file okta-system-log-events.csv --collection root

# Refresh that same table later from a new export
mb upload replace <table-id> --file okta-system-log-events.csv

Can you generate a Okta dashboard with AI?

Yes. Use the prompt below with any assistant that can run the Okta MCP Server and the Metabase CLI. It works end to end: if Okta tables already exist in Metabase it analyzes those; otherwise it pulls scoped, summarized data over MCP, loads it with mb upload csv, then builds the dashboard and caveats any metric that needs missing history.

Create a polished Metabase dashboard for Okta identity security analytics.
Work end to end: get the data into Metabase if it isn't there yet, then build.

Goal: Help security and engineering leaders understand authentication health, failed-login signals, MFA adoption, and lifecycle hygiene from Okta data.

Step 1 — Find or load the data:
- First, check what already exists in Metabase (search for okta tables and
  models). If durable Okta data is already present — synced from a warehouse
  or uploaded earlier — use it and skip to Step 2.
- If nothing is there, pull a scoped, summarized export with the Okta MCP Server:
  system log events, plus users, applications, groups.
  Prefer aggregated or entity-grain views over raw events. Write each result to a
  CSV, then load it with the Metabase CLI — run "mb upload csv --file <export>.csv"
  so each upload creates a table and a ready-to-query model. Use "mb upload replace
  <table-id> --file <export>.csv" to refresh an existing table instead of creating
  duplicates.

Step 2 — Inspect before querying:
Do not assume exact table or column names. Inspect available fields, severities,
statuses, timestamps, and whether snapshots or history exist before creating
duration or trend cards.

Important:
- Build on whatever data is present; don't claim Metabase connects natively to
  Okta — it reads a database or CLI-uploaded tables.
- Never try to load raw security telemetry or event firehoses into Metabase; use
  findings, detections, entities, and daily rollups.
- Only compute durations (time to remediate, time to triage, time to detect)
  when the required timestamps exist.
- Exclude test environments and suppressed or accepted-risk items from headline
  cards, and keep them visible in a labeled register instead.
- A single CSV is a point-in-time snapshot: only build trend cards if there is a
  usable date column or multiple periods have been uploaded.

Dashboard title: Okta Identity Security Overview

Sections:
1. Executive summary: Logins last 7 days; Failed-login rate; MFA adoption;
   Accounts without MFA; Deprovisioning lag.
2. Authentication: Logins by day and outcome; failure rate by app.
3. Threat signals: Failures by source; spray patterns; new-geo logins.
4. MFA: Adoption by factor type; weak-factor share; enrollment trend.
5. Lifecycle: Departures vs. deactivations; dormant accounts; admin changes.

Filters: Date range, Severity, Status, Team or owner, Environment or asset group.

Output: Build the dashboard if you have permission; otherwise provide the exact
questions, SQL, model definitions, and layout. Include caveats for any metric
that cannot be calculated from the available data.

How do you sync Okta data into a database or warehouse?

For dashboards that need history and reliability, land Okta findings and metadata in a database first, then connect Metabase to that database.

Connector options

• Managed ETL — use a connector when one covers the objects you need.
• Custom pipeline — use the Okta System Log API for control over fields, snapshot cadence, and refresh schedule.
• MCP + CSV — use this for quick exploration and one-off slices.

Sync users, groups, apps, and system log events with the Airbyte or Fivetran Okta connectors, or stream auth events continuously with Okta Log Streaming to AWS EventBridge or S3. Roll raw events up to daily grain before dashboarding.

Notes

• Decide the snapshot cadence first (daily is the norm for security data) — posture trends only exist if you build the history.
• Land raw entity tables first, then build clean Metabase models on top.
• Normalize application, outcome, factor-type, event-date, and user-status fields.

How should you model Okta data in Metabase?

Core tables

Modeling advice

• Build a clean auth_events_daily model with common columns across tools, so multi-source dashboards don't fork definitions.
• Separate entity tables (assets, users, controls) from findings, events, and daily snapshot tables.
• Exclude test environments and suppressed or accepted-risk items from headline metrics; keep them in a labeled register instead.
• Use stable IDs for asset, user, and finding joins; display names change.

Which Okta metrics should you track in Metabase?

What SQL powers Okta dashboards in Metabase?

These assume a cleaned analytical model in a warehouse (PostgreSQL dialect). Adjust table and column names to match your pipeline.

SELECT
  event_date,
  COALESCE(SUM(event_count) FILTER (WHERE outcome = 'failure'), 0)
    AS failed_logins,
  SUM(event_count) AS total_attempts,
  ROUND(
    100.0 * COALESCE(SUM(event_count) FILTER (WHERE outcome = 'failure'), 0)
    / NULLIF(SUM(event_count), 0), 2
  ) AS failed_login_rate_pct
FROM auth_events_daily
GROUP BY event_date
ORDER BY event_date;

SELECT
  strongest_factor,
  COUNT(*) AS users,
  ROUND(100.0 * COUNT(*) / SUM(COUNT(*)) OVER (), 1) AS share_pct
FROM users
WHERE status = 'active'
  AND NOT is_service_account
GROUP BY strongest_factor
ORDER BY users DESC;

SELECT
  u.id,
  u.department,
  h.departed_at,
  u.deactivated_at,
  EXTRACT(EPOCH FROM (u.deactivated_at - h.departed_at)) / 86400
    AS deprovision_lag_days
FROM users u
JOIN hr_departures h ON h.person_id = u.id
WHERE h.departed_at >= CURRENT_DATE - INTERVAL '90 days'
ORDER BY deprovision_lag_days DESC NULLS FIRST;

What are common mistakes when analyzing Okta in Metabase?

Related

Related analytics

Related dashboards

Related integrations

FAQ