Okta (OKTA) research pages
- Okta Earnings and Financial History: Q2 FY2027 revenue of $805 million, subscription revenue, RPO and cRPO trends, GAAP and non-GAAP operating margins, and free cash flow history
- Okta History: From SSO Specialist to Identity Security Platform: 2009 founding by Todd McKinnon and Frederic Kerrest, the 2017 Nasdaq IPO, the 2021 Auth0 acquisition, security incidents in 2022 to 2023, and the shift toward GAAP profitability
- Okta Investment Analysis: Platform Moat, Microsoft Risk and AI Identity Opportunity: neutral platform moat, Microsoft Entra bundling threat, Auth0 customer identity economics, AI-agent identity as a new category, and bull/bear/base scenarios
- Okta Stock History and Valuation Framework: 2017 IPO at $17/share, hypergrowth and 2022 correction, profitability re-rating, and a valuation framework using cRPO growth, FCF margin, and diluted share count
Quick answer: what is Okta?
Direct answer: Okta is a cloud-native identity security company that provides the software layer controlling who can access what across enterprise IT environments. It is not a security firewall or endpoint tool: it is the system that verifies identity, enforces policies, and manages the lifecycle of digital credentials for both employees and customers. Okta is a component of the S&P MidCap 400 and trades on Nasdaq under the ticker OKTA.
Okta was founded in 2009 by Todd McKinnon and Frederic Kerrest, both former Salesforce engineers, with the thesis that identity management should be cloud-native from the start rather than adapted from on-premises software. The company went public on Nasdaq in April 2017 and expanded from its initial single sign-on and multi-factor authentication core into a broader identity security platform covering governance, privileged access management, and customer-facing identity through the 2021 acquisition of Auth0.
The company's fiscal year ends January 31, so its Q2 FY2027 refers to the quarter ended July 31, 2026. This offset matters when comparing Okta's financial calendar to calendar-year software peers.
Company at a glance
| Item | Detail |
|---|---|
| Company | Okta, Inc. |
| Ticker | OKTA |
| Exchange | Nasdaq |
| Index membership | S&P MidCap 400 |
| Sector | Information Technology |
| Industry | Identity security platform (cloud-native SaaS) |
| Fiscal year end | January 31 |
| Founded | 2009, San Francisco, CA |
| Primary products | Workforce Identity (SSO, MFA, lifecycle management, governance), Customer Identity (Auth0 platform) |
| Business model | Subscription SaaS: per-user for workforce, monthly active user for customer identity |
| Key investor metrics | cRPO growth, total RPO, subscription revenue growth, GAAP operating margin, free cash flow margin, large-customer count, SBC dilution |
| Primary competitor | Microsoft Entra (bundled), CyberArk, Ping Identity, cloud-provider identity services |
What Okta actually does
Identity is the security perimeter in a world where applications and data live across dozens of cloud services rather than inside a corporate data center. When an employee signs in to Salesforce, Workday, GitHub, AWS, and a dozen other tools, some system must verify who they are, check whether they are allowed in, and record what they did. Okta is that system for organizations that have chosen to make identity independent of their cloud vendors.
The Workforce Identity product set covers the employee and contractor population. Single sign-on gives users one set of credentials that works across all connected applications. Multi-factor authentication adds a second verification step. Lifecycle management automates provisioning and de-provisioning accounts when employees join, change roles, or leave. Identity governance adds controls and audit trails for who has access to what. Privileged access management (a newer expansion) addresses the more sensitive accounts used by administrators and automated systems.
The Customer Identity product set, delivered through the Auth0 platform acquired in 2021, is oriented toward software developers building authentication into customer-facing applications. A company building a consumer app or a B2B software product uses Auth0 to handle login flows, social login, password reset, and token management rather than building those capabilities from scratch. Auth0 is priced on a monthly active user basis, giving it different unit economics from the per-seat Workforce business.
Both products address the same underlying security problem: as workforces and customer bases grow and as the number of connected applications multiplies, managing who can access what becomes a mission-critical function. A compromised credential or a misconfigured access policy can expose sensitive data or allow an attacker to move laterally through an organization's systems. Identity has therefore shifted from an IT convenience tool to a board-level security control.
How Okta makes money
Approximately 98% of Okta's revenue is subscription revenue. The remaining 2% comes from professional services. This mix means Okta's financial profile is highly recurring: once a customer signs a multi-year subscription and integrates Okta into their identity infrastructure, the probability of renewal is high because the cost and operational risk of switching is substantial.
Workforce Identity revenue mechanics
Workforce Identity is sold on a per-user-per-year basis. Larger organizations with more employees and more connected applications pay more. The revenue per customer tends to grow over time as customers expand their user count, add new products (governance, privileged access), and connect additional applications to the platform. This expansion dynamic, sometimes called net revenue retention, means that Okta's existing customer base can grow revenue even in a period of slower new customer acquisition.
Customer Identity revenue mechanics
Auth0 is typically priced on monthly active users with a tiered structure: free for small apps, paid tiers above certain user counts or feature requirements. Enterprise Auth0 deals are negotiated annually and include custom pricing. The customer identity business serves a different buyer (developers and product teams) and a different use case (external-facing applications) than the workforce business, giving Okta two distinct routes to market within the same identity theme.
Newer platform products
Okta has been expanding beyond its core SSO and MFA heritage into Identity Governance (automated access certifications, policy enforcement, audit reporting), Privileged Access Management (controls for administrator accounts and service accounts), and Identity Threat Protection (behavioral analytics that detect suspicious access patterns in real time). These newer products represent upsell opportunities into the existing customer base and are important because they expand Okta's addressable revenue per customer without requiring new customer acquisition.
What drives revenue growth
The main levers for Okta's revenue growth are: net new customer acquisition, expansion within existing accounts (adding users, products, or connected applications), and pricing. The most durable signal of forward revenue growth is the current remaining performance obligation (cRPO): the contracted revenue expected to be recognized in the next 12 months. In Q2 FY2027, cRPO was $2.585 billion, up 14% year over year, indicating solid forward visibility.
Why identity has become infrastructure
The shift of enterprise computing to cloud services created a structural change in how security works. In the on-premises era, the corporate network perimeter was the primary defense: if an attacker was outside the firewall, they were blocked. In a cloud-first world, there is no single perimeter. Employees access SaaS applications from home, coffee shops, and mobile devices. Contractors and partners need temporary access. Applications make automated API calls to other applications using service account credentials.
The result is that compromised credentials have become the most common initial attack vector. Ransomware groups, nation-state actors, and financially motivated criminals regularly use stolen passwords or session tokens to gain access to enterprise systems. Multi-factor authentication, conditional access policies, and anomaly detection on login behavior are now standard security requirements rather than optional enhancements. Identity management is no longer optional infrastructure for enterprises at any meaningful scale.
This structural shift explains why the identity security market has grown faster than enterprise software overall over the past decade and why identity has become a board-level security priority rather than an IT operations tool. Okta is positioned in the center of this shift, though it faces competition from vendors who have the same insight and different distribution advantages.
Financial snapshot: Q2 FY2027 (ended July 31, 2026)
| Metric | Q2 FY2027 | Notes |
|---|---|---|
| Total revenue | $805 million | +11% year over year |
| Subscription revenue | $793 million | +12% year over year; ~98% of total |
| GAAP operating income | $107 million | 13% GAAP operating margin, up from 6% prior year |
| Non-GAAP operating income | $226 million | 28% non-GAAP operating margin |
| Operating cash flow | $234 million | 29% margin |
| Free cash flow | $227 million | 28% FCF margin |
| Total RPO | $4.858 billion | +17% year over year |
| Current RPO (cRPO) | $2.585 billion | +14% year over year; next 12 months |
| Cash and investments | $2.299 billion | Net cash position after $350M convertible note settlement |
The FY2027 full-year guidance targets total revenue of $3.216 billion to $3.226 billion and non-GAAP free cash flow of $910 million to $930 million (28% to 29% FCF margin). These figures represent management's outlook, not guaranteed outcomes.
The GAAP versus non-GAAP gap at Okta is driven primarily by stock-based compensation, which is real economic dilution to shareholders even though it is excluded from non-GAAP reporting. Investors should examine both figures: GAAP operating income shows the economic profit after SBC, while non-GAAP shows cash profitability before SBC. The trajectory of GAAP operating margin is a critical signal because it shows whether the business is becoming a genuinely profitable enterprise or merely a cash-generating one while continually issuing equity.
The independent-platform advantage
Okta's most important strategic claim is that it is the neutral, independent identity layer. Most large enterprises run a heterogeneous cloud environment: Microsoft 365 for productivity, Salesforce for CRM, Workday for HR, AWS or Google Cloud for infrastructure, dozens of SaaS point solutions for various functions. No single vendor's bundled identity product works well across all of these because each vendor's native identity tools are optimized for their own ecosystem.
Okta's neutrality means it integrates with all of them. The company has built over 7,000 pre-built application connectors, meaning that connecting a new SaaS application to Okta typically takes minutes rather than requiring custom development. This integration breadth is a genuine competitive moat: building and maintaining 7,000 integrations requires years of engineering investment and ongoing maintenance as application APIs change. A new competitor cannot replicate this overnight.
The neutrality argument is most compelling in organizations that have deliberately built a multi-vendor cloud strategy and want to avoid adding Microsoft as an identity dependency on top of their existing Microsoft productivity dependency. It is weakest in organizations that are predominantly Microsoft shops, where Microsoft Entra's native integration with the Microsoft stack creates genuine convenience advantages that Okta cannot easily match.
AI agents and non-human identity: the emerging opportunity
Enterprises deploying AI agents and automated systems face a new identity problem: non-human identities. An AI agent that can browse the web, call APIs, read files, and write code needs credentials, and those credentials need to be governed. If an AI agent's access token is compromised, an attacker could use it to access anything the agent is authorized to reach. The scope of damage from a compromised non-human identity can be larger than a compromised human credential because AI agents may have broad, automated access by design.
Okta management has highlighted non-human identity governance as a strategic opportunity. The company is developing capabilities to provision, govern, and monitor AI agent identities using the same platform infrastructure it uses for human identities. This is a logical extension of the Okta platform into a new and growing use case.
Investors should treat this as an emerging opportunity rather than a proven revenue driver. The key questions are: when will enterprises begin purchasing dedicated non-human identity governance tools at scale, what is the pricing model, and how does Okta's offering compare to solutions from security vendors who might also enter this space? The opportunity is real, but the revenue timeline is uncertain.
Competitive landscape
Identity is a competitive market with several distinct threat vectors for Okta.
Microsoft Entra
Microsoft Entra (formerly Azure Active Directory) is the most significant competitive threat because it is bundled into Microsoft 365 and Azure subscriptions that most enterprises already own. Microsoft customers can extend their existing identity infrastructure at no incremental cost by using Entra. Microsoft's distribution reach and bundling economics are difficult for a pure-play vendor to compete with on price. Okta's defense is that Entra is weaker outside the Microsoft stack and that multi-cloud environments need a neutral layer. Investors should watch Okta's net retention rates in Microsoft-heavy verticals as the primary evidence signal for whether this defense is holding.
Ping Identity
Ping Identity serves large enterprises with on-premises and hybrid identity deployments and has traditionally been stronger in banking, insurance, and other regulated industries with complex on-premises legacy environments. Ping is less of a direct cloud-native competitor and more of a legacy alternative that Okta frequently displaces in cloud migration projects.
CyberArk
CyberArk leads in privileged access management, controlling the high-privilege administrator accounts most attractive to attackers. As Okta has expanded into PAM, it has moved into overlap with CyberArk. Both companies benefit from the same secular trend toward stronger identity controls, but they compete for budget and sometimes for deals where a customer wants a unified identity and PAM platform.
Cloud-provider identity services
AWS Identity and Access Management, Google Cloud Identity, and Azure Entra each provide identity services native to their respective platforms. For workloads that are predominantly on one cloud, these native tools may be sufficient. For multi-cloud architectures, they create complexity that benefits Okta's neutral positioning.
Key risks
| Risk | Why it matters | What to monitor |
|---|---|---|
| Microsoft Entra bundling | Microsoft's included identity tools may displace Okta in Microsoft-centric enterprises with no incremental spend | Net revenue retention rates, large-enterprise customer count growth, win/loss data in Microsoft accounts |
| Security trust incidents | An identity provider's value depends on customers trusting it to protect their credentials; a breach can create customer attrition and sales cycle elongation | Customer retention disclosures, management commentary on incident impact, new customer addition rates after incidents |
| IT budget sensitivity | Enterprise software spending is discretionary in a downturn; longer sales cycles or deal compression reduces near-term growth | cRPO growth rate, average contract value trends, pipeline commentary |
| Stock-based compensation dilution | Okta's SBC is a real cost even if excluded from non-GAAP metrics; persistently high SBC while share count grows erodes per-share value | Diluted share count trend, SBC as a percent of revenue, whether buybacks offset new issuance |
| Auth0 integration complexity | Integrating two distinct engineering organizations and product architectures is operationally difficult; slow progress on a unified platform may disadvantage Okta in competitive evaluations | Management commentary on platform unification, cross-sell metrics between Workforce and Customer Identity |
| AI-agent identity monetization lag | The opportunity is real, but enterprises may be slow to purchase dedicated non-human identity governance tools, delaying the revenue ramp | New product revenue disclosures, case studies of enterprise AI agent deployments using Okta governance |
Bull, base, and bear framework
Bull case
Multi-cloud architectures become the durable norm and enterprises increasingly value a neutral identity layer, sustaining Okta's competitive differentiation against Microsoft Entra. cRPO growth re-accelerates above 15% as new platform products (governance, PAM, AI-agent identity) drive meaningful upsell in the existing customer base. GAAP operating margin continues expanding toward 20%+ as SBC moderates and revenue scales. Auth0 and Workforce Identity platforms are unified in a way that enables competitive wins in combined deals. AI-agent identity creates a new revenue category that investors begin to price into forward estimates.
Base case
Okta sustains mid-teens subscription revenue growth and cRPO growth in the 12% to 15% range. GAAP operating margin improves gradually from the current 13% level. Microsoft Entra competes effectively in Microsoft-centric accounts but Okta retains and grows its base in multi-cloud environments. FCF margin holds at 28% to 30%. New platform products contribute incremental growth but not a step-change acceleration. Diluted share count grows slowly as SBC moderates.
Bear case
Microsoft Entra continues to improve its non-Microsoft integrations, making it a more credible neutral platform and shrinking Okta's differentiation argument. Net revenue retention rates compress below 110%, indicating that expansion within existing accounts is slowing. A new security incident erodes customer trust and extends sales cycles. IT budget pressure causes deal compression and pushes cRPO growth below 10%. Auth0 fails to unify with the Workforce platform, creating a competitive disadvantage in evaluations requiring both products.
What to monitor each quarter
| Metric | What to look for | Why it matters |
|---|---|---|
| cRPO growth (year over year) | Acceleration above 14% or deceleration below 10% | Best leading indicator of near-term revenue growth; reflects signed contracts |
| Total RPO growth | Higher growth than cRPO suggests multi-year contract wins; lower suggests shortening deal terms | Longer-dated demand signal and contract duration health |
| Subscription revenue growth | Current trend is 12%; watch for inflection in either direction | Core recurring revenue health |
| GAAP operating margin | Trend from current 13% level; is it expanding, stable, or compressing? | Shows whether the business is becoming genuinely profitable or masking SBC costs |
| Free cash flow margin | Current guidance is 28% to 29%; is FCF quality improving or is working capital masking weaker economics? | Cash generation relative to stated non-GAAP margins |
| Large-customer additions | Customers above $100K and $1M annual contract value thresholds | Enterprise penetration and average deal size trajectory |
| Diluted share count | Is the count growing, flat, or declining? | SBC dilution destroys per-share value unless offset by repurchases |
| Management commentary on Microsoft | Any changes in competitive win rates or displacement stories | Primary competitive risk signal |
Investor checklist
Before forming a view on OKTA, investors should be able to answer the following questions based on current evidence rather than assumptions:
- Is cRPO growth accelerating, stable, or decelerating, and what is the management explanation?
- What is Okta's GAAP operating margin trajectory, and is SBC declining as a percentage of revenue?
- Is net revenue retention above or below 110%, and is the trend improving or deteriorating?
- How is Okta winning or losing in accounts where Microsoft Entra is already deployed?
- What is the current revenue contribution from Identity Governance, PAM, and AI-agent identity products, and is it material?
- Is the diluted share count growing, flat, or shrinking quarter over quarter?
- What evidence exists that Auth0 and Workforce Identity are being sold together in competitive situations?
- What is the state of the company's security posture since the 2022 to 2023 incidents, and has management provided current evidence of improved controls?
Frequently asked questions
What is Okta?
Okta is a cloud-native identity security platform founded in 2009 and headquartered in San Francisco. It provides authentication, authorization, and identity lifecycle management for both employees (Workforce Identity) and customer-facing applications (Customer Identity, via the Auth0 platform). Okta trades on Nasdaq under the ticker OKTA and is a component of the S&P MidCap 400 index.
How does Okta make money?
Okta earns revenue almost entirely from subscription contracts for its identity platform. Workforce Identity customers pay per-user annual or multi-year subscriptions for products including single sign-on, multi-factor authentication, lifecycle management, and identity governance. Customer Identity customers pay primarily on a monthly active user basis for the Auth0 platform. A small portion of revenue comes from professional services.
What is Okta's biggest competitive advantage?
Okta's primary competitive advantage is its position as a neutral, independent identity layer that works across heterogeneous cloud environments regardless of which vendors a company uses. This independence is especially valuable to enterprises that deploy a mix of Microsoft, Google, AWS, and other cloud services and do not want to be locked into a single vendor's identity stack. Okta reinforces this with over 7,000 pre-built application integrations, a large installed base that creates switching costs, and the Auth0 developer platform that extends reach into customer-facing applications.
What is the biggest risk for OKTA investors?
The biggest risk is Microsoft Entra bundling. Microsoft includes identity capabilities in Microsoft 365 and Azure Active Directory at no incremental cost for its large installed base of enterprise customers. Customers who are predominantly Microsoft shops may conclude that the bundled identity product is sufficient, displacing or narrowing Okta's opportunity. This risk is structural rather than cyclical and requires investors to monitor whether Okta's customer growth and net retention rates are holding in Microsoft-heavy accounts.
What financial metrics matter most for Okta?
The most important metrics for Okta investors are: current remaining performance obligations (cRPO), which represents contracted revenue to be recognized in the next 12 months and is the best leading indicator of near-term revenue growth; total RPO for a longer-dated demand signal; subscription revenue growth; GAAP operating margin trajectory (the company achieved positive GAAP operating income in recent quarters); and free cash flow margin. Stock-based compensation and diluted share count growth are important for per-share economics.
What is cRPO and why does it matter for Okta?
cRPO stands for current remaining performance obligations, meaning the portion of Okta's total contracted but unrecognized subscription revenue that is expected to be recognized in the next 12 months. It is the most reliable leading indicator of near-term revenue growth because it reflects signed contracts, not just bookings intentions. When cRPO growth accelerates, future revenue growth tends to follow. When it decelerates, revenue growth usually slows 1 to 2 quarters later. Investors watch the year-over-year change in cRPO as a primary health signal for Okta's demand pipeline.
How does Microsoft Entra threaten Okta?
Microsoft Entra (formerly Azure Active Directory) is included with Microsoft 365 and Azure subscriptions that most enterprises already pay for. It provides single sign-on, multi-factor authentication, and conditional access policies for Microsoft-centric environments. The threat is that CIOs managing budget pressure may decide the bundled Microsoft identity capability is good enough, eliminating the incremental spend on Okta. Okta's defense is that multi-cloud environments genuinely need a neutral identity layer, and that Entra is weaker outside the Microsoft ecosystem. The question investors must answer is whether that differentiation is durable as Microsoft continues to improve Entra's non-Microsoft integrations.
Related Swoopr research
- Microsoft (MSFT) Investor Overview: the operator of Microsoft Entra, Okta's primary competitive threat
- Salesforce (CRM) Investor Overview: a major SaaS platform where Okta's founders built their careers and which is a key Okta integration partner
- Fundamental Analysis: how to read financial statements and evaluate a software company's unit economics
- How to Analyze a Stock: a multi-method decision framework combining fundamentals, technical context, and position sizing
- S&P MidCap 400: the index that includes OKTA and other mid-cap U.S. companies
References
- Okta Investor Relations: official earnings releases, SEC filings, and financial data
- SEC EDGAR: Okta 10-K Annual Reports: audited financial statements and risk factor disclosures