[somefries]

Users get provisioned the first time they click the tile (in Okta). Depending on how it is set up, it will provision basic or licensed accounts when new users click. You can make it so different security groups on AD/Okta get provisioned with different account types.

[Mertax]

This seems like it only works if Okta knows how to integrate with your app (How do you create an app Okta knows about that doesn't force customers to use Okta or AD). Also, my understanding is it only works for Okta's paying "Workforce Identity" customers and not app developers using the "Customer Identity" product? Okta creates the provisions to integrate with large market/widely used products (Office 365/Microsoft apps/Atlassian/HR apps-workday etc) but I don't know that they have a way for me as a no-name developer to create the integrations and I don't want to force my customers to also have to be Okta customers. But maybe I'm not understanding?

[chayesfss]

Look at developer.okta.com/pricing, great free tier. Also you can connect your app via oidc or saml easily. They also include a cloud directory called ud.