Use when an app uses Okta as its identity provider and needs tests for org config, sign-in policies or Identity Engine flows: per-PR or shared orgs, MFA enforcement, factor enrollment, recovery, SCIM provisioning and least-privilege API tokens.