Just upvoting to emphasize that Okta, SSO and MDM services in general are an extremely major single point of failure. From the point of view of a non-expert in security, it would seem like segmenting the authentication services of companies should be a security requirement.
Trusting an SSO system, or anything with security sensitive data on the public internet presents an attack surface with untenable risk when your adversary is thousands of people with LLM tools.
It’s going to take a lot of this before people realise using someone else’s computer is a pretty fucking stupid idea.
I mean Entra and Okta got popped. That should have been the point companies looked at this risk and went nope.
