# Okta Inc. (OKTA) — InvestMoat Analysis

_Last analyzed: July 5, 2026_
_Asset class: equity · Canonical page: https://investmoat.com/stocks/okta_

## Scores

| Dimension | Score (0–100) |
| --- | --- |
| Moat durability | 78 |
| Growth trajectory | 66 |
| Valuation | 50 |
| **Composite** | **61** |
| **Recommendation** | **Speculative Buy** |

Scores are computed deterministically from this asset’s data by the InvestMoat formula (see https://investmoat.com/llms.txt for methodology). Scores are not directly comparable across asset classes.

## Key stats

- **Ticker:** OKTA
- **Market Cap:** ~$24.6B

## Moat

Okta is the authoritative identity system of record for 19,000+ enterprise customers, embedded in every authentication event and anchored by compliance requirements and an 8,200-integration ecosystem that competitors cannot replicate.

### The Identity System-of-Record Moat

Okta's moat is built on **Transaction Embedding, Regulatory Compliance, and System-of-Record Gravity**:

- **Transaction Embedding — Every Login Flows Through Okta:** Okta sits inline with every authentication event across an enterprise — every employee login, every app access, every API call. Removing it would break access to all 8,200+ integrated applications simultaneously, making it operationally irreplaceable in the short term. Okta for AI Agents, live since its April 30, 2026 GA, is already extending this embedding to non-human identities — new products drove ~25% of Q1 FY2027 bookings, with a ~40% ACV uplift on deals that attach them — multiplying the number of identity transactions per customer.
- **System of Record for Enterprise Identity:** Okta's Universal Directory is the authoritative truth for who can access what across the enterprise — a repository of provisioning rules, group memberships, HR integrations, and access policies accumulated over years. Migrating this to a competitor requires re-mapping every app integration, re-certifying access policies, and reconciling years of audit logs — a 12–24 month project with significant business risk.
- **Regulatory Lock-in and Compliance Inertia:** SOX, HIPAA, PCI-DSS, and FedRAMP audits depend on Okta's access logs and certification trails. FedRAMP High authorization locks in federal agency customers for the duration of their procurement cycle. Switching vendors mid-compliance cycle is not a practical option for regulated industries, creating a moat that renews with each compliance audit.

**Moat verdict:** Okta is a net beneficiary of AI adoption in the long run: the explosion of AI agents creates an entirely new identity surface that every organization must manage, and Okta's position as the universal identity directory (human and non-human) makes it the natural registry. Transaction embedding and system-of-record are the strongest AI-era moats — AI agents amplify the number of transactions flowing through Okta rather than threatening them. The primary AI-era risk is that Microsoft uses AI-accelerated Copilot/Entra development to close Okta's feature gap faster than Okta can differentiate, pressuring the bundling and learned-interface moats in Microsoft-centric enterprises. On balance, Okta's identity infrastructure is AI-resilient: more agents mean more identities, more policies, and more Okta revenue.

## Growth

Q1 FY2027 (quarter ended April 30, 2026) revenue reached $765M (+11% YoY), ahead of the deceleration-driven fears that followed the 9% FY2027 opening guide. RPO climbed to $4.72B (+16% YoY) and cRPO to $2.50B (+12% YoY), while NRR inflected up to 107% from 106% — the first uptick in several quarters. Non-GAAP operating margin compressed 180bps YoY to 25% and FCF was $271M (35% margin) as Okta leans into AI agent identity R&D and go-to-market spend. Management raised full-year FY2027 guidance to $3.185–3.205B revenue (9–10% growth) and $855–885M FCF (27–28% margin). Okta for AI Agents (GA April 30, 2026) is already monetizing — new products drove ~25% of Q1 bookings with a ~40% ACV uplift when attached — and IGA continues to take governance share from SailPoint. The stock has re-rated sharply (+86% since April, +67% YTD) on this beat-and-raise plus the NRR inflection, but full-year growth is still decelerating versus FY2026's 12% print, so the deceleration narrative is bottoming, not reversed.

- **Revenue CAGR estimate:** 9–12%
- **Primary type:** both
- **Margin trend:** compressing
- **Key risk (moderate):** If Microsoft Entra ID captures 10%+ of net new workforce identity ARR from Okta's SMB and mid-market customers by end of FY2028 (evidenced by NRR reversing below 105% for two consecutive quarters, undoing the Q1 FY2027 inflection to 107%), revenue growth stalls at 4–6% and the AI agent identity narrative fails to offset core attrition
- **Drivers:**
  - Workforce Identity Cloud (Core) — +11% YoY (Q1 FY2027); RPO $4.72B (+16% YoY); cRPO $2.50B (+12% YoY) (stable)
  - AI Agent Identity + IGA — Okta for AI Agents GA April 30, live; ~25% of Q1 bookings; TAM $29B→$56B by 2029 (IDC) (accelerating)
  - Customer Identity Cloud (Auth0) — Auth0 for AI Agents GA Oct 2025; developer-first CIAM embedded in 8,200+ integrations (stable)
- **Score derivation:** Base 74 (9–12% blended CAGR, baseFromCagr formula) + 1.3 trajectory (1 of 3 drivers accelerating: Okta for AI Agents ~25% of Q1 bookings; Core and IGA stable) − 4 compressing margins (non-GAAP op margin −180bps YoY on AI investment) + 4 both TAM/share − 5 moderate keyRisk severity = 70

## Valuation

At $141.42, OKTA trades 41% above the base case ($100) and is within ~9% of the bull case ($155), after rallying ~86% since April 2026 (~67% YTD) on a Q1 FY2027 beat-and-raise, the NRR inflection to 107%, and accelerating adoption of Okta for AI Agents. Market cap of ~$24.6B compares to trailing-twelve-month FCF of ~$896M (~3.6% FCF yield) and RPO of $4.72B. Forward non-GAAP P/E has re-rated from ~20× in April to ~30× today, closing most of the discount to the 30–35× enterprise security SaaS sector median even though FY2027 guidance of 9–10% growth remains below faster peers like CrowdStrike and Zscaler. The re-rating prices in continued execution on the AI agent identity opportunity and a durable NRR recovery, leaving materially less margin of safety than three months ago.

| Multiple | Value | Note |
| --- | --- | --- |
| Trailing P/E (GAAP) | ~87× | TTM GAAP EPS ~$1.63 |
| Forward P/E (NTM, non-GAAP) | ~30× | consensus NTM EPS ~$4.71 |
| PEG Ratio | ~1.2× | fwd P/E ÷ ~25% EPS growth |
| Price / Sales (NTM) | ~7.7× | $3.19B FY2027 guided revenue |
| Price / FCF | ~27× | $896M FCF (TTM) |

At ~30× forward non-GAAP P/E, Okta has closed most of its prior discount to the 30–35× enterprise security SaaS sector median, despite FY2027 guidance of only 9–10% growth versus 20–30%+ at faster-growing peers like CrowdStrike and Zscaler. The PEG of ~1.2× looks reasonable on consensus EPS growth but assumes the AI agent identity ramp and NRR recovery (107%, up from 106%) both continue uninterrupted. The wide gap between trailing GAAP P/E (~87×) and forward non-GAAP (~30×) remains largely structural — GAAP still carries $500M+ in annual stock-based compensation — but the multiple expansion since April means the P/FCF of ~27× (versus ~15× three months ago) now reflects a business priced for continued execution rather than one trading below its intrinsic earnings power. _(as of July 2026)_

## Price scenarios

### Bear — $48

Microsoft Entra's free bundling captures material SMB/mid-market share, NRR falls below 100%, and the AI agent identity opportunity fails to monetize at scale — triggering multiple compression to ~10× FCF.

- Microsoft Entra ID expansion into Okta's mid-market base drives NRR below 100% by mid-FY2028, confirmed by two consecutive quarters of net customer ARR contraction
- Okta for AI Agents generates less than $50M incremental ARR in its first 18 months — insufficient to offset core workforce identity attrition
- FY2028 revenue growth decelerates to 4–6% and non-GAAP operating margin compresses back toward 20% as Okta increases discounting to defend renewals
- Multiple compresses to 10× FCF on ~$820M FCF → ~$8.2B market cap → ~$48/share

### Base — $100

Okta executes FY2027 guidance, NRR stabilizes at 105–107%, AI agent identity adds $150M+ incremental ARR by FY2028, and FCF expands to $900M+ — rewarded with a 20× forward FCF multiple.

- FY2027 revenue lands at $3.18B (+9%), with NRR stabilizing at 105–107% as COVID-era contract bloat fully cycles off
- Okta for AI Agents reaches 1,000+ paying enterprise deployments by end of FY2027, contributing $75–150M in incremental ARR
- IGA module grows 30%+ YoY as enterprises consolidate SailPoint/Saviynt governance onto the Okta platform
- FY2028 FCF crosses $900M; multiple expands to 20× FCF on $900M → ~$18B market cap → ~$100/share

### Bull — $155

AI agent identity becomes a $500M+ platform by FY2029, NRR re-accelerates to 112%+ as agents multiply per customer, and Okta re-rates to 25× FCF as growth returns to 15%+.

- Each enterprise customer deploys hundreds–thousands of AI agents, each requiring Okta-managed identity — average ARR per customer expands 30%+ by FY2029 as agent identity monetizes at per-agent pricing
- NRR re-accelerates to 112%+ by FY2028 as AI agent identity drives net-new expansion ARR without displacing existing workforce identity revenue
- IGA + PAM convergence positions Okta as the end-to-end identity governance platform, displacing SailPoint/CyberArk in a subset of Fortune 1000 accounts
- FY2029 FCF reaches $1.1B+ at expanding margins; multiple of 25× FCF → ~$27.5B market cap → ~$155/share

---

InvestMoat is an open-source research and education framework. Nothing here is financial advice. Past performance does not guarantee future results.