Okta, Inc. (OKTA) Earnings Call Transcript & Summary

Good morning, everybody. Hopefully this mic is on. Good morning for day 2 of our Morgan Stanley TMT Conference. My name is Hamza Fodderwala, the U.S. cybersecurity analyst here at Morgan Stanley. With me today, I have the pleasure of having the Founder and CEO of Okta, Todd McKinnon. Thank you so much for joining us, Todd. Before I begin, for important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com/researchdisclosures.

So with that, we'll start off. Todd, thanks again for coming.

It's great to be here.

So let's just start off. I mean you just reported earnings, I think, a week ago. The year, I think, 2022 started off a little bit challenging, but you ended in a stronger note. Just give us a state of the union for Okta, some of the challenges that you still face, some of the things that you think you've overcome recently and what you're optimistic about going forward.

Yes. I'm super optimistic. And the foundation of that optimism is really the value we can add and the problems we're solving is -- just gets more impactful every day. And it's because of a couple of simple trends that we've talked about, a lot of -- we've talked a lot in this room, a lot of familiar faces. That is every organization is trying to figure out how to adopt cloud, and that inevitably means securing the environment in a way that can't be done by managing the old firewall as the perimeter. They have to get more granular about knowing who can go where, what they can do, what they can't do and getting strong about authentication and authorization. This is identity management for the workforce. Second big trend is they have equally amount of opportunity and risk on the customer-facing side. They have to make sure they build the best mobile app, the best website for their customers, existing customers, new customers. And that's a big pressing thing. And it has to all be done securely with all this technology and the proliferation technology. And the value it can generate, the risk is just as high with people trying to take advantage of all these flexible work environments and hack into identities and fish people and get customer accounts. And so those 3 trends, whether it's cloud, it's digital transformation and security, all of those can be helped or accentuated or accomplished, more importantly, with identity. And we're fortunate enough to be at the center of all these things. We've been -- in terms of the last year, we've been pretty aggressive the last several years actually about moving from our traditional strength, which was workforce identity, into this really emerging category, which is a massive category on its own, which is customer identity. And that's essentially -- think about customer identity as when a customer comes to your app or website, log them in securely, make it super simple, make the registration experience, the data about that digital user integrate with all your back-end systems and do that securely. This is a big opportunity. We think it's $30 billion in our TAM, and that's of our total TAM of $80 billion. So the last few years we've been aggressively moving into this space. We've -- we did something pretty bold and aggressive. We bought a company called Auth0 a couple of years ago, and we've been integrating that. And we're moving the business towards this 50-50 mix. It's about 60-40 today. 60% of revenue comes from workforce, 40% comes from customer identity. And we think they could both be 50-50 and growing both at a healthy pace. So we're making a lot of progress on that goal. And I think the last couple of earnings reports have showed that, and I'm super optimistic about the road ahead.

Got it. I think execution was a bit of a challenge midway through last year. You did have some increase in the sales force attrition, particularly on the Auth0 side. Talk about how that has been trending in the last couple of quarters. Has it been stabilizing? Is there more work to do?

During the integration of Auth0, I think we were pretty bold and aggressive. And it -- I think in retrospect, we would have -- in terms of integrating the sales teams, we've probably taken that a little more slowly, maybe waited a few more quarters. But the position we're in now, which is one integrated sales team, so one account representative -- a customer has one account representative, and they sell all the products because the strategy is that we want to be the -- we've established ourselves as the leader in this category of identity, by far the biggest independent and neutral leader. And for the customer, we want to make sure that as customers around all of these 3 trends I talked about, they see the value of identity rising in their technology strategy and their company strategy and their business strategy. There's a high-level relationship with the Okta salesperson that can bring the whole platform to them. So it makes sense to have one sales rep -- a customer have one sales rep. And that's where we are now. And in terms of when we went to that move, there was some -- like I mentioned -- like you mentioned, some execution challenges on training the reps, clarifying the positioning. We had a little bit higher than we expected attrition from the Auth0 side, but it's trending a lot better. We've had -- the last 4 quarters, we've been increasing the percent of reps that have done a customer identity cloud deal, which is great. And attrition -- we've had 2 really solid quarters of attrition. So yes, we're headed in the right direction. If you look at the business, the -- like I said, the main thing we look at is the growth rates of the 2 businesses. And during earnings, we reported 30% ACV growth rate for the workforce business, 35% ACV growth rate for the customer business. And then like I mentioned, the mix is 60-40, and we think it could be 50-50 and both growing very healthy.

Just on the macro front, it seemed like in your earnings call that January at the very least was stable relative to what you saw in -- the January quarter being stable relative to the October quarter from an overall macro standpoint. Am I reading that correctly? And how are you feeling about the macro, let's say, for the rest of the year?

We're cautious about the macro. And our forward-looking thinking and guidance, we're assuming it does get worse before it gets better. I think that's -- given everything that's going on, it's the prudent thing to assume. The quarter-over-quarter in Q3 to Q4, our January year-end -- so our Q4 just finished about 5 weeks ago. The difference I would say is that we saw a similar impact in our SMB segment. So SMB is slow in terms of what we've seen in the past. On the other side, larger deals and large enterprise was relatively strong. So it's an interesting phenomenon. You're seeing macro hit the SMB, but less impacted at least what we're seeing to the larger deals. The big difference -- or not a big difference, but a difference in Q4 was that we saw the business tilt a little more toward upsells than in Q3. So the mix was more weighted toward upsells in Q3, which kind of makes sense if people have more scrutiny on budgets and purchases. It's more -- it's easier to do a deal with an existing vendor with established relationships, and I think you saw our customers doing that. And then if you flip that around, if you're a sales rep ramping on products and you have this broad portfolio and maybe some of the products you're learning, it might be a little easier to close a deal with an existing customer versus going out in the economy and finding a new customer. So we're watching that closely. But again, the results were, in terms of the growth and the profitability of the -- results, were healthy. And I think we have a prudent outlook for the year ahead. And we're -- I'm very optimistic about making a ton of progress this year.

Maybe I could just follow up on that on the upsell portion. So I mean, to some degree, at least on the workforce side, Okta's business is tied to growth in seats, and there's been a lot of layoffs and just slow down hiring, and particularly in tech. How do you maintain strong upsell rates against that backdrop?

Just in terms of the other thing that is -- the foundations of our business are -- I mentioned the trends that are driving our business. The fundamentals of the business, when we look at them, in terms of performance, the foundation is kind of the customer success and the retention rate of the customers. And the metric on that is our dollar-based net revenue retention, and that number has been 120% or positive the last several quarters. And the foundation of that is gross retention. And the gross retention has been stable and healthy, in the mid-90s consistently for several quarters. So that's kind of the foundation. And then as you mentioned, the -- or just to level set on how we license the products, on the workforce business, it's a named seat license per user per month. And on the customer identity business, it's monthly active users. So it's how many users use the service front. Both of them are sold on subscriptions. And so it's all recurring subscription revenue. The minimum -- the average contract length is over 2.5 years. There's some self-service credit card business, a pretty small amount like starter deals, but most of the business is 1 year minimum. So in terms of downsizing employees or downsizing customer -- active users on the customer, there's this contract duration that insulates us from that effect. All things being equal, though, if people have less seats, they're going to pay less for Okta, all things being equal. But the one thing that we can do is we have a pretty wide product portfolio, both inside the workforce business and in the customer business. So you can buy -- you can start with single sign-on. You can buy our workflows product, that's an upsell. You can buy our life cycle management product. You can buy our advanced authentication product. And that's all in workforce. We have a new product called identity governance that's out. So these are all -- you could see a scenario where someone has a fewer number of seats in terms of employees, but then the contract stays flat or goes up when it comes for renewal just because they buy more modules. That's a common thing we see. And on the customer identity side, it's similar. You can buy advanced security pack. You can buy more capabilities in terms of integrations with other systems. So there's lots of upsells even if the seat growth moderates.

Got it. Maybe shifting to, like, a high-level question. So most -- every CISO I talk to will say identity security is a top 3 priority for them, right, especially as you're moving more to the cloud and identity becoming a new perimeter. Okta was a pioneer in that market, particularly as more companies were using SaaS applications around authentication, right, single sign-on, MFA. Is that problem, in some ways, getting easier as different application providers start to standardize on the same identity protocols?

Well, one thing I -- one thought experiment I'd like to do is it's tempting to think about these things just -- like you talk to vendors and you look at the product reviews and you just think about, oh, is that getting harder? Is that getting easier? The other way to look at it is just talk to people that use the products. And so how many people at work never see a log-in screen, and it's all passwordless, and they never have to do a password reset and never get fished and all, I mean how many people in the room, right? So okay. One, right, are you an Okta customer? Thank you for your business. Yes. No, seriously, I mean, it's because even these things that are simple -- are -- when it comes to actually doing it in a highly diverse application ecosystem like every company has with different devices, I look around the room, I see a lot of different devices, some MACs, some PCs and Android and so forth. And so it becomes quite complex. So it seems like it's simple in theory. But in practice, it's pretty complex. So we're really focused on this heterogeneity and solving it across the board. Every employer, every partner, every contractor and both from the end user experience, totally passwordless, no passer resets, get me into everything and flip it around, which is the other part of the reason why it's hard is because it's an adversary relationship, meaning every time there's a seeming advancement in authentication, the bad actors are trying to attack you and steal that credential and take your device and get the session token of the device. So the technology has to keep iterating to keep up with these threats. So I think the authentication business is a good business to be in. I think a lot of the things you talked about, the standards and people doing new things, I think I welcome them. I think they're great. I mean when we started Okta, they really -- when we started Okta, there were identity companies, and they were really largely capabilities or small vendors that got bought by big platform companies or they were technologies that were built as part of big platform companies. When we were going around raising money many years ago, people always told us, they said, why are you -- you can't build a big identity company. It's not going to be -- it's not a big enough market. The best you can hope for is to get purchased by CA. And I said, no, I think we can do -- I think we can build something bigger. And it's because of these trends and this complexity and this moving outside the perimeter that led to this opportunity. And we did a lot of these things to promulgate some of these standards and make the applications talk to each other better. And it continues to go, whether you look at something like on the consumer side, when you look at something like pass keys and how the authentication technologies on the consumer and the operating systems are starting to have these new standards that can help eliminate password on the consumer side. Of course, we love that. We have a customer identity business where we can hook into that and power that. So I think it's a fertile ground for a long, long time.

Got it. Got it. So yes, identity is a big market. So you're solving for the authentication piece, and now you're moving deeper into the authorization piece of it with governance. Talk a little bit about that. What's the pipeline looking there? And what is your expectation for that business for 2023?

You mentioned -- it's like identity management 101. I can educate everyone on identity management 101. You've come to the right guys. Okay. So it's like checking the password. Authentication, just checking -- you say you get you into the app, service data, whatever, that's authentication. Authorization is actually the -- once we know it's you, it's making the decision on what resources you can access. You can go to this application. You can place this trade. You can look at this client, piece of information authorized, whatever you are authorized to do. And on the workforce side and on the customer side, this is collective access management. And it's like authentication and authorization. And this business called identity governance is -- think about it as the -- it's the after-the-fact reporting and a testing to who can go where. So you have the access management system that makes these real-time decisions about this person is logging in. And once I prove the -- once I believe they are who they say they are, then I decide if they can go to these systems and what they can do in these systems. Now governance is like after-the-fact running a report to check the act. That is actually the case and prove to the auditors that there's people that no one got in that they shouldn't have been able to get in and the people that got in should have been able to get in. So I believe that the reason why this is such a natural synergy for us is because I think it shouldn't be 2 separate systems. The system that is controlling the access, if it's done right and it's comprehensive, and it's connected to everything, like we believe Okta is, it should be the one generating the reports for the auditors and testing is the term -- the industry uses the testing that the authorization was correct. So we're really excited about this. So we've been working on this product for couple of years. It's called Okta Identity Governance, and it basically lets you do all these workflows around identity governance in a way that's very integrated to the system that's actually enforcing the policy on the access management side. So we -- the product was generally available in December, and it's off to a really solid start. And we're seeing great customer success in broader customer segments than we expected, big companies, small companies. Some of them, very -- a very high amount of success very quickly. So it's pretty exciting.

I think you mentioned 2 6-figure deals this last quarter already.

Yes. We called out on the call the diversity of companies that we called out on the earnings call, Notion, which is a relatively -- it's a great innovative company, relatively small versus that's an OIG customer. And then a company called NOV, which is an oil and -- big oil and gas, Fortune -- I believe Fortune 500 company that's in Texas. NOV, it's a great customer as well. So it's a big diversity of size of companies and types of companies that are using that product.

On the workforce identity market in general, I mean, this has been growing pretty durably for Okta. I think in contrast, a lot of people's expectations -- you mentioned last quarter, the ACV growth for the workforce portion was 30%, and it's over $1 billion business for you. What's driving that because every enterprise is using workforce access management to some degree, right?

Yes. I think it's -- I mean -- the reason I pause is because I already gave my high-level comments about the cloud and security and so forth. I think there's -- if you look at an average, medium to large-sized company, there's still a lot of -- everyone is still making -- maturing their identity management posture. And largely, what that means is normalizing it and standardizing it across many disparate systems. A lot of times, they're on-premise systems, legacy systems. Maybe there was an acquisition and there's -- they have a little bit of Oracle. They have a little bit of like paying identity or maybe they just still use on-premise active directory. And it's pretty disparate. And you're seeing -- one of the reasons why we have such strong upsells on the workforce side is these -- the evolution to standardization on Okta happens in phases. They'll get Okta for some cloud applications, and then they'll bring more -- maybe they bought a company, and they'll move that off of the old stuff and move it on to Okta. Maybe they'll upsell -- hey, we want to really integrate it to the HR system and manage the workflow of all the user life cycle. And it's basically standardizing on this modern strategic identity platform that is -- the downside is it takes time sometimes. These are complex things that are wired into business processes, especially when you start talking about integrations to HR systems or other types of systems that manage the onboarding and off-boarding of contractors or partners, these are complex things that can take a while to get deployed and get rolled out. But the good side is that it's -- we can keep adding value year after year after year. And also, the company has become very reliant on it from a -- just a business process perspective, and it generates a lot of value, and they feel like they're getting a fair deal. And I think that's why you see the retention strong. One more point on that. It's -- I'm -- I work with -- I try to stay really close to customers. And inevitably, I end up working with some of the larger customers. And it's -- a common pattern I see is that Okta was brought in as part of companies they bought. And then the -- maybe some of the people that were relying on the old types of system in the corporate parent aren't used to making a change or aren't inclined to make a change to a modern system like Okta. But there's so much success of identity in these companies they buy that inevitably, they buy a couple of companies, and all of a sudden, it's like, wait a minute, why aren't we doing like these companies we bought? Let's standardize at the parent. And that might take -- we have big -- some of our biggest customers now at over -- we're talking like 8 figures of ACV. The -- they started 10 years ago in a company that was bought by another company, and there are more applications, and now the parent is finally upgrading everything. So it takes a while, but the value we're generating -- or the value we're contributing to those companies is profound, and it's great to work with them.

Yes. I guess it also speaks to the stickiness of the product, just the replacement cycles. On the CIAM piece, so you talked about how you want that to be -- or you see that being a 50-50 business over time. That portion of the business did slow quite a bit. Some of that has been due to the execution challenges. I think it was like 47% and then 35% this most recent quarter. Where do you see that growth rate stabilizing? Do you expect that to grow faster than the workforce piece going forward?

Well, I think we want to get the revenue mix of the business to more 50-50. So since it's 60-40 now, we think that, at least in the medium term, that customer identity can grow faster, but we think both businesses can go fast. We don't think it's -- we don't think -- I think the people have underestimated the workforce business for a while. And that is our foundation, and we're building off that, and I'm very bullish about that as well. But I think we have to see what happens with a little bit of the macro situation for the next few quarters and being prudent about the go-forward guidance. But we're still -- we're definitely are showing more cash flow, more profitability, but we're still a growth company. We're still making sure we make the bets that are -- have a high likelihood of paying off over the medium and long term, and that's still how we're running the company.

On the CIAM business, how much of the business is old economy companies who are building out digital channels, so like a Morgan Stanley with our Wealth Management, for example, versus digitally native companies like Coinbase?

The way we think about it is it serves primarily -- customer identity serves primarily 2 use cases. There's the consumer identity. So the -- any -- whether it's an old-school company or a modern digital upstart that serves consumers, that's one market. And the other distinction we make is on companies that are SaaS companies and the differentiation there is that the technology in the platform does -- on the SaaS application side does more to model that B2B relationship. So there's a concept in the product that models SaaS companies, organizations that they're selling to. . So we don't really break it down by old school or new school. We think about how do we have a platform that delivers for our customers the best consumer experiences. And then for this, really, what is becoming quite a large ecosystem of SaaS applications for the companies building these SaaS applications, how do we deliver the identity platform that helps them deliver their products to their customers more effectively? And it's -- one of the really exciting and cool things is that, especially with the SaaS company use case -- so if you're a company that uses Okta customer at any cloud to power the logins to your SaaS application, a lot of those logins are actually coming from your customers that use Okta for their workforce identity. So you have Okta the company mediating the exchange between millions of employees going to all of these SaaS applications, and that puts us in a very powerful position to provide more value to both of them by maybe doing more than just single sign-on. We could do more communications about deeper authorization between the workforce identity system and the SaaS application or exchanging more security information so you can help a company that is using mini SaaS applications, the tech threats that are attacking various applications in their ecosystem. So the potentials in that business are pretty exciting for us.

One more and then I want to open up to the audience. So today, obviously, there's a lot of scrutiny on budgets. I'm a CISO, and I'm evaluating different identity management tools. I might get something, let's say, from Microsoft within my E5 bundle. To what extent is that at the very least slowing down the sales cycle for Okta as they start to evaluate those alternatives more closely?

It's a really interesting conversation and topic. What we do see in the data we have is that our win rates remain very healthy and have been that way for a long time. But the question is still valid because I think we want to make sure that we're seeing all the deals. And there's -- sometimes your own win rates are only giving you part of the story, right? You want to see every deal. You want to get more reach. So we're definitely focused on that. I think on the -- so our strategy is -- we believe that identity is really critical and can deliver a lot of value to every organization in the world. And we also believe -- and that was controversial 10 years ago, but it's not so controversial anymore. So we also believe -- this is the thing that is more important for everyone to understand now is that an independent and neutral company that focuses on identity is the best way to do it because, inevitably, we are going to offer customers choice to connect to and authenticate with and authorize to and find and discover any application or any platform, not certain applications. Whether they are our collaboration applications or our cloud infrastructure, we're going to give customers choice. And that's the right strategic way to prosecute the market, both from the vendor perspective and from the customer perspective. So we've just fundamentally believe that in all our product investments, and our marketing positioning is set around that. Now the reality is that every big cloud platform, and Microsoft is probably the most focused on this now, is going to try to take what they have in their platform, whether it's cloud infrastructure or whether it's collaboration. And they're going to try to take the identity management in there and use that to be a broader identity play and pull more people into their ecosystem. So Microsoft is doing that now. And I think honest answer is for some companies, it does appeal to them. It's like, yes, I don't see this identity stuff. Is that strategic? It's like kind of cheaper. I'll buy it off from one vendor, and it does appeal to some people. But it also turns equally in a visceral way many people off. I can think of one deal from Q4 where it was quite a sizable deal in Europe where it was -- I was working with the team. And this is a -- it's a ton of Microsoft technology in the shop. And it was quite a sizable deal for us. And I said, well, why are we going to win this? And they said, well, because they just -- they don't want to go to E5, and they don't want to get locked in. And they know that 3 years down the road, 5 years down the road, they're going to pay more for it. So I think the fact that this -- the bundling and the economic pitch appeals to some people is misinterpreted, like it doesn't turn many people off as well. So that's the dynamic. And then the last thing on this is I went back to like identity is important. We're the independent neutral leader. I talked about our sales structure, where we have one customer has one sales rep. We're selling more value to that customer at a higher level in the customer. We want to make sure that they think of identity as a strategic platform for all their use cases, whether it's workforce, whether it's customer. And when they start to see the value of identity, but also the value of being neutral and giving them choice across all those use cases, it's very valuable to them, and it's very consistent with our strategy, which is to be this one-stop shop for identity. And everything we do is focused around that as well.

I think we can probably screen one question from the audience. If anybody has anything pressing. Maybe I'll just sneak in one last question. I don't see any hands up. Just around growth and profitability, you guided to I think much better than expected margins. I think on the Q3 call, you said low single-digit operating margin was the preliminary guide, and then you guided to 6%, 7%. What was the thought process there? And where do you see margins going over the next [ few ] years?

Well, I think we're -- there's -- in our business, the sales and marketing spend is a big driver of both growth and profitability. So as you see growth moderate and us pull back on investment in sales and marketing because of some of the economic -- macroeconomic uncertainty, you see a natural increase in our profitability in the business. I think that's one part of it. And the other part of it is that I think like a lot of companies, and maybe it's just a phase of the company in terms of growth, it's the, I think, just a healthy inspection, everyone is doing on spending. We've done the same thing. So we've said, hey, we can be efficient in certain areas. We can do things better. We can be more -- make sure we focus our investments on the things that are going to pay off medium and long term versus things that might be more speculative. That being said, we're also investing more this year to actually automate more things and actually be scalable in terms of a cost perspective longer term. So we're able to deliver this increased profitability, while at the same time, not only investing and still investing in growth, to some degree, but also investing in some of these longer-term internal automation initiatives and things that will help us do more with fewer -- with less manual work and more profitable long into the future.

All right. Well, a little bit over. Thank you so much, Todd, for your time, and thank you, everybody, for coming.

Thanks, everyone.