Okta's AI Agent Pipeline Is Record-Breaking — But Revenue Impact Remains Minimal for Now
Q1 Fiscal Year 2027 Earnings Call — May 28, 2026
Okta opened its fiscal first quarter with a set of results that beat expectations on the metrics that matter most to large-enterprise investors, while being unusually candid about the gap between the extraordinary pipeline enthusiasm around its AI agent identity products and their actual contribution to the income statement. That tension — between transformational positioning and still-immaterial near-term revenues — is the defining story of this quarter and will set the agenda for the rest of fiscal 2027.
The Numbers: Steady Acceleration Across Core Metrics
Revenue grew 12% year-over-year in Q1, with current RPO expanding 12% as well. The company guided Q2 for 9% total revenue growth and 11% cRPO growth, with full-year revenue growth guidance raised to a 9%-to-10% range. Non-GAAP operating margin guidance for the full year came in at 25%-to-26%, and free cash flow margin guidance was set at 27%-to-28%, though both figures carry roughly one percentage point of headwind each — the former from a deliberate shift of professional services revenues to global systems integrators, the latter from lower interest income tied to the $350 million convertible note settlement due next month and the ongoing share buyback program.
Net revenue retention inflected upward to 107%, a number management tied directly to the rising strategic importance customers are placing on Okta as the AI agent narrative elevates identity from a tactical IT function to a boardroom-level infrastructure decision. Customers with over $100,000 in annual contract value now represent 85% of total ACV, up from a figure management previously cited as 80%, reflecting years of deliberate investment in the Global 2000. Large customers with over $1 million in ACV also grew "quite nicely," according to CFO Brett Tighe, though specific figures were not disclosed.
New products — spanning Identity Governance and Administration, Privileged Access Management, and the nascent AI agent products — accounted for approximately 25% of Q1 bookings, a meaningful increase from Q1 a year ago. Deals that include new products carry a 40% ACV uplift compared to access management-only deals. Partner-sourced bookings experienced what management described as a "meaningful increase," including multiple seven-figure deals in the quarter, an early validation of the strategic decision to redirect professional services capacity toward GSI enablement.
AI Agents: Record Pipeline, Negligible Current Revenue — and That's the Point
The headline finding for investors is simultaneously bullish in its strategic framing and honest in its financial limitations. CEO Todd McKinnon was direct: "The AI agent products were not materially contributing to the business in Q1. In fact, we're still being prudent in our guide. They're not even — they're a little bit in the guide, but not significant in the guide, but it's going to be big."
McKinnon reported that after personally visiting approximately 75 of Okta's top 100 customers over the last six months, the pattern is consistent: enterprises are deploying agents in unsecured, ad hoc ways — static tokens in local developer environments, ungoverned connections to GitHub, Jira, Slack, and Snowflake — and are only now beginning to design the governance rails that will require a dedicated identity layer. "Everyone is deploying agents in some way, shape or form. But they're really just starting to think about and put in programs in place to lay out the rails of governed managed adoption."
The pipeline build around Okta for AI Agents (which reached general availability in April 2026) and Auth0 for AI Agents is, by McKinnon's account, unprecedented. "The pipeline is bigger than anything we've ever seen." He was careful to immediately add the caveat that "we don't get paid for pipeline," and that the work ahead is converting those conversations into contracted dollars. Okta for AI Agents targets enterprises managing internally deployed agents across multiple platforms, while Auth0 for AI Agents addresses developers building agent capabilities into their products. McKinnon noted the Okta pipeline is currently larger, reflecting the fact that enterprise internal governance programs are slightly further along than external product development use cases.
Tighe offered a data point that investors should note carefully: the average deal size for AI-specific line items — not the broader deal, just the AI product line itself — is "significantly larger than the average deal size for the rest of the company." McKinnon elaborated on why this dynamic is different from prior new product introductions: "Even governance four or five years ago, the initial deals were small. Then they got big, then we did more of them. So this one — they're already big. We can do more of them." The implication is that when conversion from pipeline to booked revenue does materialize, the per-deal economics could be more accretive than past product cycles.
Eric Kelleher, President and COO, added a data point sourced from customer conversations: over 90% of enterprises already have AI agents in production, yet only 22% are confident those agents are governed. "That is a real problem. It's a measurable, quantifiable exposure customers have right now within their companies, and they need to invest to fix it."
Pricing Strategy: Attached to Users Today, Agent-Count Units Inevitable Later
McKinnon walked through Okta's current pricing philosophy for AI agent products with more specificity than has been publicly shared before. Today, pricing is structured as an uplift on named users or monthly active users, consistent with the company's existing pricing architecture. The rationale is twofold: customers prefer to consume the product this way at present, and the majority of current agent use cases are explicitly on behalf of a human user — a software developer, a support representative, an accounting professional. "It's very natural how they want to buy it and how they're actually being used."
He acknowledged the model will need to evolve as fully autonomous agents — those not tied to a specific user — proliferate. The industry has not yet resolved how to define an "agent" as a unit of measurement, given that 1,000 instances of the same agent and 1,000 distinct agents could look identical in a deal but represent very different economic exposures. "We're pricing for market share and reducing friction and how customers want to buy. And that's — we think that's the winning strategy."
On pricing structure, McKinnon clarified a market rumor directly: "There's no unlimited. If there is unlimited, it's time-bound." Some early deals have been structured as one-year pilots at flat rates, with the intention of resetting to a normalized pricing model after observed usage patterns clarify the right unit economics. This approach reflects appropriate caution for an early market but introduces some renewal risk at the end of those pilots if agent adoption ramps slower than anticipated.
The Neutrality Thesis: Why Okta Positions Itself Above the Ecosystem
McKinnon organized Okta's AI competitive positioning around three reinforcing advantages: distribution (20,000 enterprise customers already treating Okta as identity infrastructure), product breadth (the only vendor with solutions for both the enterprise governance and developer-facing sides of agent identity), and neutrality (an independent layer that federates with any agent platform, whether Amazon Bedrock Agent Core, OpenAI, Anthropic, Google, Salesforce Agentforce, ServiceNow, or open-source frameworks).
The neutrality argument is the most strategically differentiated. McKinnon described it as "a no-regrets move" for customers who are unwilling to bet their agent governance on a single hyperscaler or platform vendor. "They want flexibility and choice across multiple things." The partnerships announced this quarter — integrations with Amazon Bedrock Agent Core, Google's Agent Gateway, ServiceNow's AI Control Tower, and launch partner status on OpenAI's GPT 5.5 Trusted Access for Cyber — are designed to reinforce the position that Okta sits above the competitive fray rather than within it.
The ServiceNow partnership is worth examining specifically. McKinnon explained that ServiceNow approached Okta specifically for its ability to revoke agent access at the authorization layer — severing the logical connection between an agent and the backend resources it accesses, rather than attempting to terminate the running agent process itself. "The one thing we do really well and that they wanted from us is the ability to sever the connections, the access tokens, the actual logical connection at the authorization layer to the back-end resources, and we're really good at that."
On the broader question of whether model providers like Anthropic (whose Claude Mythos preview model Okta is testing through Project Glasswing) represent a competitive threat or a channel, McKinnon was measured. "I don't think it's — these partnerships have moved the needle yet in real customer conversations." The honest assessment is that Okta's near-term pipeline is being driven by its existing customer relationships and the clarity of its blueprint framework, not by co-sell momentum from model providers.
Go-to-Market Stabilization: The Benefit of Not Changing Things
One underappreciated positive in the quarter was the stability of the sales organization. A year ago, Okta completed a specialization of its go-to-market into two distinct motions — Okta sellers addressing IT and security buyers, and Auth0 sellers addressing developer buyers. Kelleher noted that with those teams now settled, fiscal 2027 began with "far less change" than recent years, translating into measurably improved sales productivity, lower account executive attrition, and stronger pipeline build. Okta added selling capacity in Q1 in response to this improved productivity signal, leaning into what appears to be a functioning model.
Partner-sourced bookings grew meaningfully, including multiple million-dollar-plus deals in the quarter. Tighe connected this explicitly to the decision to shift professional services to GSIs: "We see these early data points that are suggesting that it was the right decision." It is one data point, and management said as much, but the directionality is encouraging given that the GSI shift was a deliberate sacrifice of near-term professional services revenue in exchange for longer-term partner-sourced bookings scale.
IGA and PAM: Durable Contributors That Risk Being Overlooked
In the noise around AI agents, Okta's Identity Governance and Administration and Privileged Access Management products continued to post steady progress. Governance was again the leading contributor among new products in Q1. Kelleher noted that IGA has matured from a pure cross-sell motion into a genuine land product — customers are displacing incumbent governance systems with Okta IGA as the starting point of a broader identity consolidation. Fortune 100 customers are consolidating all identity use cases, including governance and privileged access, onto a single Okta platform.
Privileged Access remains less mature, having come to market later and been supplemented by the Axis acquisition in Q3 of last fiscal year. Kelleher acknowledged it is still earlier on the maturity curve than IGA but described continued heavy investment in the product.
Balance Sheet and Capital Return
Okta ended Q1 with approximately $2.6 billion in cash, cash equivalents, and short-term investments. The company repurchased just over 3 million shares for $241 million during the quarter, with $680 million remaining under the $1 billion buyback program launched in January. The $350 million convertible note matures next month and will be settled in cash, which along with the buyback will reduce interest income and create the approximately one-point headwind to free cash flow margin guidance for the full year. Management described the buyback as opportunistic, reflecting a belief that shares are "undervalued" at current levels.
What to Watch
The core question for investors over the next two to three quarters is whether the record AI agent pipeline converts into booked revenue at a pace that justifies Okta's growing R&D and go-to-market investment in these products. McKinnon was explicit that the current focus is on doing more deals, not larger ones — the deal sizes are already large. The conversion rate from pipeline to closed business will be the most important leading indicator to track. If Q2 guidance's modest AI contribution begins to grow materially by Q3 and Q4, the multiple expansion story becomes substantially more concrete. If the pipeline proves slow to convert, the gap between the AI narrative and the financial results will become harder to bridge.
Okta, Inc. Deep Dive
Business Model and Monetization
Okta operates a software-as-a-service business model, generating revenue primarily through multi-year subscription contracts for its cloud-based identity and access management solutions. The company goes to market with two distinct platforms: the Workforce Identity Cloud, which secures employee access to corporate applications, and the Customer Identity Cloud, powered by its strategic acquisition of Auth0, which allows developers to embed secure identity verification into consumer-facing applications. Okta monetizes these platforms on a per-user, per-month basis, with pricing scaling alongside the number of users and the adoption of advanced modules. The company leverages a land-and-expand strategy, bringing in new customers with foundational single sign-on or multi-factor authentication products, and subsequently upselling them into adjacent capabilities such as advanced lifecycle management or directory services. This model yields highly recurring revenue and robust economics, reflected in a dollar-based net retention rate that currently hovers around 107%. As customers adopt more modules, they become deeply integrated into Okta's ecosystem, creating a sticky revenue base characterized by high gross margins and increasingly robust free cash flow generation. Okta relies on both direct sales and an extensive partner network, deploying capital effectively to target large enterprise deployments where the annual contract value easily eclipses the $1 million mark.
Customers, Competitors, and Suppliers
Okta serves a vast and diverse customer base of over 19,000 organizations, ranging from mid-market firms to massive global enterprises and government agencies. Increasingly, the company is pivoting its focus toward large enterprises, which now account for roughly 85% of its annual contract value. The platform is mission-critical for clients looking to manage internal workforce identities or external consumer logins seamlessly. In the competitive arena, Okta faces intense pressure from several angles. Its most formidable adversary is Microsoft, which bundles its Entra ID platform within the broader Microsoft 365 and Azure ecosystems. This creates a challenging dynamic where Okta must convince enterprise buyers to pay a premium for a standalone identity solution rather than using the default tools included in their existing Microsoft enterprise agreements. Beyond Microsoft, Okta competes with legacy and specialized vendors. In the privileged access management space, it contends with the incumbent market leader CyberArk, while in the identity governance and administration arena, it battles SailPoint. In the customer identity space, Ping Identity remains a persistent rival, particularly following its integration with ForgeRock. On the supplier side, Okta relies on major public cloud infrastructure providers such as Amazon Web Services to host its platform. While switching cloud providers would be complex and costly, Okta's multi-tenant architecture minimizes severe dependency risks on any single infrastructure supplier.
Market Share Dynamics
The global identity and access management market represents a massive opportunity, currently valued at approximately $25 billion and projected to grow at a double-digit compound annual growth rate over the next decade. Within this expansive total addressable market, Okta has carved out a position as the definitive leader in the independent, platform-neutral identity space. Generating over $3 billion in annualized recurring revenue, Okta commands a substantial share of the pure-play identity market. However, assessing true market share requires acknowledging the structural divergence between independent vendors and ecosystem providers. Microsoft Entra ID dominates organizations deeply entrenched in the Windows and Azure environments, leveraging its zero-cost baseline inclusion to capture overwhelming volume. Okta, by contrast, wins in heterogeneous IT environments where organizations deploy a wide mix of software-as-a-service applications across different cloud providers. In these complex deployments, Okta's market share is exceptionally strong among cloud-first organizations and developers who prize flexibility. The broader industry trend of cloud migration and the global adoption of zero-trust security architectures serve as powerful tailwinds, ensuring that both Microsoft and Okta can continue to expand their respective footprints without necessarily engaging in a zero-sum battle for every deployment.
Competitive Advantages
Okta's most profound competitive advantage is its uncompromising technological neutrality. Because Okta does not sell cloud infrastructure, productivity suites, or enterprise resource planning software, it can act as an impartial identity broker across thousands of disparate applications. This neutrality is structurally embedded in the Okta Integration Network, an ecosystem of over 7,000 pre-built integrations that allows organizations to connect virtually any software application out of the box. This network effect constitutes a deep economic moat, as the sheer breadth of maintained integrations is nearly impossible for a new entrant to replicate quickly. Furthermore, the strategic acquisition of Auth0 provided Okta with unparalleled developer mindshare. Developers inherently dislike building authentication protocols from scratch, and Auth0's developer-centric, API-first architecture has made it the default identity building block for modern application development. Finally, identity serves as the foundational control plane for enterprise security. Once integrated into an organization's human resources systems and core applications, the operational risk and engineering friction required to rip and replace Okta is prohibitively high. This immense switching cost is vividly illustrated by Okta's financial profile, showcasing consistent revenue growth, non-GAAP operating margins expanding to 26%, and robust free cash flow margins reaching 35% in the first quarter of fiscal 2027.
Opportunities and Threats
The evolution of enterprise architecture presents Okta with substantial opportunities for platform consolidation. Historically, organizations purchased single sign-on from one vendor, privileged access management from another, and identity governance from a third. By expanding its portfolio to encompass all these capabilities, Okta can capture a larger share of wallet from chief information security officers looking to reduce vendor sprawl and unify their identity management under a single pane of glass. Additionally, the shift toward phishing-resistant, passwordless authentication and continuous identity threat protection provides a natural upgrade cycle for Okta's existing base. Conversely, Okta faces severe threats, most notably the persistent execution of Microsoft's bundling strategy. When enterprise IT budgets tighten, the financial incentive to consolidate onto Microsoft Entra ID becomes highly compelling, putting immense pressure on Okta to continuously prove its premium value. Furthermore, Okta's reputation has been tested by a series of high-profile security incidents. The late 2023 breach of its customer support system, which ultimately exposed data for all 18,400 customers who had interacted with the portal, severely strained trust. In the identity security market, trust is the absolute currency. Any further security lapses could trigger a mass exodus of enterprise clients, permanently impairing the company's brand equity and long-term growth trajectory.
New Products and Growth Drivers
Okta has aggressively expanded its product suite beyond core access management, transitioning into a comprehensive identity platform. The company's recent entry into Identity Governance and Administration and Privileged Access Management unlocks new, highly lucrative total addressable markets. These products are already gaining traction, with the new product portfolio accounting for roughly 25% of recent quarterly bookings. Furthermore, Okta is actively positioning itself for the next frontier of computing with its Okta for AI Agents offering. As enterprises rapidly deploy autonomous artificial intelligence agents, these non-human entities require strict identity verification, access controls, and governance. Okta is moving to treat AI agents as first-class identities within its universal directory, aiming to secure the machine-to-machine communication layer. Additionally, the rollout of Identity Threat Protection shifts the paradigm from static authentication at the login screen to continuous risk evaluation throughout a user's session. If a user's risk profile suddenly changes mid-session, Okta can automatically revoke access across all applications in near real-time. Through Auth0, the company is also driving adoption of Fine Grained Authorization, allowing developers to build complex, highly specific permission architectures into custom applications. While management notes that AI-specific revenues are not yet materially contributing to the top line, the average deal sizes for AI-driven identity contracts are significantly larger, indicating a potent future growth driver.
Disruptive Technologies and New Entrants
The identity and access management landscape is currently facing a wave of disruption driven by the explosion of machine identities and agentic artificial intelligence. Traditional identity systems were fundamentally built around human lifecycles, operating on the assumption that a physical person was behind a keyboard. The proliferation of ephemeral, dynamic AI agents has created a structural gap in legacy architectures. This has given rise to specialized non-human identity startups such as Astrix, Apono, and Britive, which purpose-built platforms specifically to govern API keys, service accounts, and autonomous AI agents. These nimble entrants represent a credible threat, as they offer highly granular visibility into machine-to-machine vulnerabilities that legacy platforms historically overlooked. In the developer authentication arena, aggressive startups like Stytch and WorkOS are challenging Auth0 by offering highly competitive, usage-based pricing models and streamlined enterprise single sign-on integrations tailored for emerging software-as-a-service companies. Additionally, governance upstarts like Multiplier are disrupting traditional identity governance by embedding access workflows entirely within existing systems like Jira, appealing to engineering teams that refuse to log into standalone governance consoles. While Okta possesses the scale and capital to build counter-measures, these new entrants are forcing the company to innovate rapidly to defend its market dominance against specialized, agile competitors.
Management Track Record
Under the leadership of Chief Executive Officer and Co-Founder Todd McKinnon, Okta has achieved extraordinary scale, pioneering the cloud identity category and growing into a multi-billion-dollar enterprise. McKinnon's strategic foresight to acquire Auth0 in 2021 was a masterstroke, cementing Okta's dominance in the developer ecosystem despite initial sales integration challenges that temporarily disrupted growth. Chief Financial Officer Brett Tighe has successfully navigated the company through a challenging macroeconomic environment, executing a painful but necessary pivot from growth-at-all-costs to disciplined profitability. This transition involved multiple rounds of workforce reductions between 2023 and early fiscal 2026, but the results are evident in the company's record free cash flow generation and operating margin expansion to 26%. However, management's track record is significantly marred by its handling of security breaches. The response to the late 2023 support system breach was widely criticized for being delayed and initially downplaying the severity, moving from an estimated 134 impacted users to eventually acknowledging that the entire support customer base of 18,400 was exposed. To his credit, McKinnon responded by halting new feature development to initiate a 90-day company-wide security sprint, resulting in major internal architectural hardening and a commitment to the Secure by Design pledge. While this aggressive remediation mitigated the immediate fallout and stabilized customer retention, management's credibility suffered a severe blow, leaving zero margin for error in future security operations.
The Scorecard
Okta's structural positioning as the premier neutral identity platform remains exceptionally strong, buoyed by the industry-wide shift toward zero-trust architectures and complex multi-cloud deployments. The company's massive integration network and high switching costs provide a deep economic moat, shielding it against both specialized upstarts and the bundling gravity of Microsoft Entra ID. The financial pivot executed over the last two years has transformed Okta into a highly cash-generative enterprise, with 35% free cash flow margins proving the inherent leverage in its business model. Furthermore, early traction in identity governance, privileged access, and agentic AI security demonstrates a viable path to reaccelerate top-line growth through expanding wallet share within its base of over 19,000 customers.
However, the investment thesis is counterbalanced by intense competitive pressures and self-inflicted reputational wounds. Microsoft's presence is a perpetual ceiling on Okta's pricing power, particularly among budget-constrained enterprises looking to consolidate IT spending. Moreover, the historical mishandling of security incidents has exhausted the market's goodwill, demanding flawless execution from management moving forward. If Okta can maintain its hardened security posture and successfully monetize the non-human identity wave, it stands to compound capital efficiently over the next decade. Failure to do so will relegate it to fighting a brutal war of attrition against bundled giants and agile innovators.