ForgeRock → Okta migration playbook
Migrate from ForgeRock to Okta — common since ForgeRock joined Ping under Thoma Bravo (2023). Many ForgeRock customers re-evaluated their long-term identity vendor.
TL;DR
Post-acquisition, many ForgeRock customers explored alternative IdPs. Okta is a common destination because of the broader integration catalog + SaaS-first delivery. Migration complexity depends heavily on how customized the ForgeRock deployment was — vanilla AM/IDM is straightforward; deeply customized deployments take longer.
ForgeRock (self-managed or Identity Cloud)
Okta Workforce Identity Cloud / Customer Identity Cloud
Typical timeline
9-18 months for complex ForgeRock deployments
Why teams move
- ForgeRock + Ping consolidation under Thoma Bravo created roadmap uncertainty
- SaaS-first preference vs ForgeRock's heavy self-managed legacy
- Broader Okta integration catalog
- Lower operational burden post-migration
The migration in 4 phases.
1. Phase 1 — Discovery
8-12 weeks
- AM / IDM / DS / IG configuration inventory
- Custom scripts + journeys inventory (ForgeRock has many)
- App catalog + protocol mapping
2. Phase 2 — Okta foundation
4-8 weeks
- Okta tenant + AD/HRIS source + MFA
- Okta Access Gateway for legacy apps
3. Phase 3 — Cohort migration
6-12 months
- Apps + journeys re-federated to Okta
4. Phase 4 — Decommission ForgeRock
2-3 months
- ForgeRock infrastructure retired
What lives where.
| Capability | Source (ForgeRock) | Target (Okta) |
|---|---|---|
| IdP / SAML / OIDC | ForgeRock AM | Okta |
| Identity governance | ForgeRock IDM | Okta Lifecycle Management + Workflows |
| Directory services | ForgeRock DS | Source from AD or HRIS |
| Reverse proxy | ForgeRock IG | Okta Access Gateway |
| Custom journeys | AM authentication trees | Okta Sign-in Widget + Workflows |
What moves, what doesn’t.
Users
Re-source from authoritative HRIS / AD.
Authentication journeys
ForgeRock's journey/tree concept doesn't have a direct Okta equivalent. Rebuild using Okta's policy engine + Workflows + Sign-in Widget customization.
Custom scripts
Groovy scripts in AM/IDM need to be re-implemented as Okta Workflows or sign-in widget customization. Heavy lift for deeply scripted deployments.
The 7-step cutover.
- 01Per-app cohort migration
- 02Custom journey re-implementation per app
- 03Coexistence window with both IdPs valid
- 04ForgeRock decommission after cutover
What teams find out the hard way.
Customization depth
ForgeRock deployments tend to be deeply customized. The closer to vanilla, the smoother the migration. Heavily-scripted deployments easily double the timeline.
DS to AD/HRIS
ForgeRock Directory Services may be the authoritative store. Re-establishing AD or HRIS as the source is a precondition.
Questions we get on this migration.
Why move from ForgeRock?
Roadmap uncertainty post-acquisition + operational burden of self-managed ForgeRock + Okta's broader integration ecosystem.
We’ve led this migration. More than once.
Engagement starts with a 90-minute discovery call — we tell you what we’d actually do, with timeline + risk register. No commitment.