ZTCA Configuration: Restrict Okta access to trusted IPs using native controls and Entra Conditional Access

This guide explains how to restrict Okta access by IP address, covering two main scenarios: Part A for environments where Okta is the primary identity provider (use Okta Network Zones, Global Session Policy, Admin Console and App Sign-On policies) and Part B for environments where Microsoft Entra ID is the primary IdP and Okta is an External Authentication Method (use Entra Named Locations and Conditional Access). It includes detailed, step-by-step configuration steps, prerequisites, testing guidance, FAQs, and recommendations such as maintaining a break-glass account and validating policies in report-only mode.