AWS Contact Center
Automate agent onboarding with Amazon Connect using Okta
The efficiency of agent onboarding directly impacts the success of today’s contact centers. With frequent staffing changes driven by business needs, seasonal variations, and specialized skill requirements, organizations must streamline and secure their onboarding processes. By automating manual tasks such as provisioning and deprovisioning, organizations can significantly reduce errors, improve security, and accelerate the onboarding process.
Enhancing security minimizes the risk of unauthorized access, ensures compliance with data protection regulations, and strengthens overall system integrity. Automated onboarding enforces role-based access controls, immediately revokes permissions for departing agents, and mitigates the risks associated with human oversight. Additionally, real-time monitoring and audit trails provide greater visibility into access changes, allowing organizations to proactively identify and address potential security threats.
In our previous post, we detailed how to set up single sign-on (SSO) for Amazon Connect using Okta. This integration allows organizations to use any SAML 2.0-compliant identity provider to securely authenticate agents into their Amazon Connect contact center.
In this post, we’ll explore how to streamline your agent provisioning process by integrating Okta Event Hooks with Amazon Connect. By configuring this integration, you can automatically add new agents to Amazon Connect as soon as they’re created in Okta. This minimizes the potential for errors, maximizes compliance, and improves the efficiency of the agent onboarding process.
Overview of the solution
Figure 1 – Solution architecture – agent provisioning from 1 through 4
The architecture (Figure 1) of the solution is shown above.
- An agent is added to the Amazon Connect agent group in Okta.
- Adding the agent to the Amazon Connect agents group in Okta triggers an Event Hook, which automatically sends the agent’s details to Amazon API Gateway.
- Amazon API Gateway triggers the AWS Lambda function to handle and process the request.
- The Lambda function uses the agent details to create the agent in Amazon Connect using CreateUser API.
Prerequisites
For this walkthrough, you should have the following prerequisites:
- An AWS account
- An Okta account
- An Amazon Connect Instance
- Configured single sign-on (SSO) integration between Amazon Connect and Okta
In addition, you should have basic knowledge and understanding of the following services and features:
- AWS Lambda
- Amazon API Gateway
- Basic understanding of Amazon Connect
- Basic knowledge of Amazon Connect APIs and AWS Cloud Development Kit v2 (AWS CDK)
- Basic knowledge of Okta
- Basic knowledge of Git
Deployment steps
- Install Git
- Install NodeJS (Long Term Support version v18.20.4 or higher)
- Install AWS CDK by running
npm install -g aws-cdk
Deploy Okta webhook API
For deploying the solution, execute the following steps in the same region where your Amazon Connect instance is deployed. Before you begin, make sure you have the following IDs on hand: Amazon Connect Instance ID, Security Profile ID, and Routing Profile ID.
- Instance ID – Find your Amazon Connect instance ID
- Security Profile ID – You can retrieve the Security Profile ID using the CLI by running
aws connect list-security-profiles --instance-id <you instance id>
command. Replace<Instance-ID>
with your Amazon Connect Instance ID. The output will include Security Profile ID and Name of each profile. Select Security Profile ID you would like to auto assign to your agents. (Figure 2)

Figure 2 – An example of list-security-profile output
- Routing Profile ID – You can retrieve the Routing Profile ID using the CLI by running
aws connect list-routing-profiles --instance-id <you instance id>
command. Replace<Instance-ID>
with your Amazon Connect Instance ID. The output will include Routing Profile ID and Name of each profile. Select Routing Profile ID you would like to auto assign to your agents. (Figure 3)

Figure 3 – An example of list-routing-profile output
- Using Git, clone the repository from GitHub
git clone https://github.com/aws-samples/amazon-connect-user-provision-with-okta.git
- In your terminal, move into the root directory
cd amazon-connect-user-provision-with-okta
- Set the environment variables with your AWS credentials
- Run the following commands to start CDK deployment
chmod a+x bootstrap.sh start.sh cleanup.sh
./bootstrap.sh
./start.sh
- Enter connect-security-profile-id, connect-routing-profile-id and connect-instance-id and confirm that parameters are correct. Press Y to confirm. (Figure 4)

Figure 4 – CDK deployment
- Copy the OktaConnectorStack.ApiUrl value from the final output after the execution completes, you will need this URL for later use. This URL will act as the endpoint for your Okta event hook. (Figure 5)
Figure 5 – Okta webhook API URL
Configure Okta group and application assignment
- Sign in to the Okta Admin Console – Access your Okta Admin Console dashboard using your admin credentials.
- Navigate to the Groups Menu. Go to the Directory section and Click on the Groups menu.
- Create a New Group. Click the Add Group button, in the form that appears: Enter a Name: Amazon Connect Agents. Optionally, add a Description: This group contains Amazon Connect agents. (Figure 6)

Figure 6 – Add new group
You can extend this solution to configure multiple groups tailored to your business needs. These groups could represent job roles (such as agents, supervisors, and admins) or different lines of business.
- Click Save to create the group.
- Navigate to Groups and click on the newly created Amazon Connect Agents group.
- Assign the Amazon Connect Application. Click the Assign Applications button, from the list of available applications, select Amazon Connect.
- During assignment, select the Okta_Role option. Click Save and Go Back to complete the process. (Figure 7)

Figure 7 – Assign role
Configure Okta webhook
- Navigate to the Setting Menu. Go to the Features Menu and enable Event Hook Filtering.(Figure 8)
Figure 8 – Enable Event Hook Filtering
- Navigate to the Workflow Menu. Go to the Event Hooks section and Click Create Event Hook. (Figure 9)

Figure 9 – Create event hook
- Complete required fields:
- Endpoint URL: Enter the endpoint URL (OktaConnectorStack.ApiUrl output that was provided during CDK deployment)
- Event Hook name: Enter a unique name for the event hook.
- Description: Enter the purpose and a description of the event hook.
- Subscribe Events: Select User added to group option form dropdown menu.
- Click Save & Continue.
- For our use case, we only want to process events exclusively when an agent is added to the Amazon Connect Agents group, which we configured in the previous steps. In the filters tab select the Apply Filter option, then click on the Use Okta Expression Language (Advanced) link.
- Paste the following expression language into the provided field:
event.target.?[type eq 'UserGroup' && displayName eq 'Amazon Connect Agents'].size()> 0
(Figure 10) - Click Save.

Figure 10 – Enable event filtering
- To activate the hook, verify endpoint ownership by clicking the Verify button. You should receive successful verification message. (Figure 11)

Figure 11 – Successful verification message
Before sending an event request to your endpoint, Okta performs a one-time GET verification request. During this process, Okta provides a verification value that your service must return, confirming your ownership and control of the endpoint. To understand how endpoint verification works, refer to One-Time Verification Request and Verifying your endpoint.
Test the solution
- Sign in to the Okta Admin Console – Access your Okta Admin Console dashboard using your admin credentials.
- Navigate to the People Menu. Go to the Directory section and Click on the People menu.
- Click the Add Person button, complete the Add Person form, and then click Save. (Figure 12)

Figure 12 – Add new agent
- Navigate to the Groups Menu. Go to the Directory section and click on the Groups menu.
- Select Amazon Connect Agents group and click on Assign people button. Select agent you just created by clicking on the + sign. (Figure 13)
Figure 13 – Assign agent to the group
- Sign in to your Amazon Connect instance.
- In the left-hand navigation pane, go to Users and select User Management. You should now see that the agent created in Okta has been automatically provisioned in Amazon Connect. (Figure 14)
Figure 14 – Amazon Connect agents
Cleaning up
To avoid incurring future charges, delete the resources using following steps:
- In your terminal, move into the root directory
cd amazon-connect-user-provision-with-okta
- Run
./cleanup.sh
command - Optionally, remove Web Hook from Okta
Conclusion
In this post, we demonstrated how automating user provisioning for Amazon Connect agents with Okta can significantly enhance contact center opperations. By streamlining agent onboarding, organizations can improve operational efficiency by up to 95%, reducing administrative overhead and saving valuable time.
When new agents are added to an Okta group, they are automatically granted the necessary permissions in Amazon Connect, eliminating manual steps. This automation reduces errors, simplifies access management, and ensures a seamless onboarding experience.
Integrating Okta with Amazon Connect empowers contact centers to enhance efficiency, strengthen compliance, and boost overall productivity.