Okta (OKTA) Stock Q1 FY2021 Earnings Results Review

Okta released their Q1 (April end) FY2021 earnings report on May 28. They delivered a significant beat on both revenue and earnings for Q1 and slightly raised estimates for Q2 and remainder of the year. Management applied some conservatism to the forward estimates, in anticipation of possible customer spending slowdown in Q2 and Q3. Following the results, most analysts increased price targets and maintained buy ratings. Commentary on the earnings call was upbeat. In this post, I review Okta’s earnings results and the evolution of their platform offering. I also examine recent activity from competitors and the broader opportunity in the evolving identity space. As a refresher, please see my previous analysis of Okta for a full explanation of their products, addressable market and competitive positioning.

Headline Financial Results (EPS is Non-GAAP)

• Q1 FY2021 Revenue of $182.9M, up 46% year/year. This compares to the consensus estimate of $171.6M, representing growth of about 37%. Okta beat estimates by about 9% in annualized growth. Q4 FY2020 revenue growth was 44.9%.
• Q1 EPS was ($0.07) vs. ($0.17) expected, representing a beat of $0.10. This compares to ($0.19) in Q1 FY2020 and ($0.01) in Q4 FY2020.
• Q1 Non-GAAP operating loss was $12.3M, representing an operating margin of -6.7%. This compares to an operating loss of $24.9M in Q1 FY2020, representing an operating margin of -19.9%. Q4 operating margin was -3.3%.
• Q1 FCF was $29.8M, representing a FCF margin of 16.3%. Q4 FCF margin was 10.8% and in Q1 FY2020, it was 10.5%.
• Q2 FY2021 Revenue estimate of $185-187M, representing growth of 32.4% year/year at the midpoint. This compares to the consensus revenue estimate of $184.7M, or 31.4% growth. Slight raise.
• Q2 EPS estimate of ($0.02) to ($0.01) vs. ($0.09) expected, representing a raise of about $0.08.
• Q2 estimated Non-GAAP operating loss of $4M – $5M, for an operating margin of -2.4% at the midpoint.
• FY2021 Revenue estimate of $770-780M, representing growth of 32.2% at the midpoint. This compares to consensus revenue estimate of $772.2M. The company’s prior revenue guidance was unchanged.
• FY2021 EPS estimate of ($0.23) to ($0.18) vs. ($0.32), representing a raise of $0.12 at the midpoint. Prior company guidance for EPS was ($0.42) to ($0.37).
• FY2021 estimated Non-GAAP operating loss of $30M to $37M for an operating margin of -4.3% at the midpoint.
• Ended the quarter with cash, cash equivalents and marketable securities of $1.45B.

Other Performance Indicators

• Q1 Non-GAAP gross margin was 78% versus 76% in Q1 FY2020. Subscription gross margin is 82%, which has been fairly consistent over the past year.
• Q1 Subscription revenue was $173.8 million, representing an increase of 48% year/year. Subscription revenue makes up 95% of total revenue. The difference of about $9M is professional services, which was up only 8% year/year.
• The cost of revenue for professional services was $11.3M, meaning it generated a loss of about $2.3M. Professional services work should gradually get shifted to global SI’s, which provides them an incentive to proactively sell Okta into enterprises.
• Q1 Total RPO was $1.24B, representing an increase of 57% year/year. Current RPO, which is contracted subscription revenue expected to be recognized over the next 12 months, was $619M, up 49% compared to Q1 FY2020.
• Q1 Total calculated billings were $209.5 million, an increase of 42% year-over-year.
• DBNER was 121% at end of Q1, compared to 119% in Q1 FY2020 and 119% in Q4. DBNER has held a range of 117-121% for the past 2 years. The fact that this is on the high end of the 2 year range is a good sign. Most SaaS companies experience a gradual DBNER drop over time.

• Breaking down Q1 expenses by category (taking GAAP expense and subtracting SBC for each), we see year/year reductions in relative percentage of revenue across all segments.
  • R&D = 20% (versus 22% in Q1 FY2020)
  • S&M = 51% (versus 60% in Q1 FY2020)
  • G&A = 14% (versus 16% in Q1 FY2020)
• Total customer count was 8,400 at end of Q1. This represents an increase of 28% over Q1 FY2020. Customers with ACV greater than $100k were 1,580 at end of quarter, adding 113 and representing year/year growth of 38%. Half of these were new customers, versus expansions.

• International revenue is only 16% of total, which has been consistent for the last 2 years. This represents a future growth opportunity.
• On the earnings call, the CEO mentioned “we did experience some projects getting more scrutiny, but believe, in most cases, the project implementation and/or purchase decisions have been pushed out to a later date rather than canceled. These delayed decisions were primarily within the industries most impacted by the pandemic.” He later implied that these were Customer Identity projects, which is understandable, as those are tied to the development of new applications and have longer lead times.
• Okta management team gave some examples of customer wins during the quarter:
  • State of Illinois. Utilizing both workforce and customer identity, they are applying these products to several use cases. The identity of Illinois citizens will be secured by Okta’s customer authentication solution, as they access government resources online. With workforce identity, state employees and contractors will be granted access to the business applications they use daily. Finally, Advanced Server Access will be used to control administrator access to the state’s on-prem and cloud-hosted servers.
  • Parson Corporation – a Global 2000 company. New customer for both workforce and customer identity. Okta will provide Universal Directory, SSO, Advanced Lifecycle Management, MFA and Okta Access Gateway for Parson’s 16,000 employees. They will also use Customer Identity to provide authentication/authorization for its customers to access their growing SaaS offerings.
  • T-Mobile. Following the merger with Sprint, T-Mobile is expanding its usage of Workforce Identity for an additional 30,000 employees. This will secure access to front-line applications used daily for customer care.
  • Zoom. Expanded their use of the Advanced Server Access product to control administrative login to thousands of servers across different environments.
  • Moody’s. Has been a smaller customer. Expanded both workforce identity and customer identity management. 
  • Okta also announced new and expanded partnerships with other customers in a separate press release about FedEx (details below), including Australian Red Cross, Mouvement Edouard Leclerc, Servus Credit Union and Workday.
• Management recapped some of the announcements from Oktane20.
  • Had nearly 20,000 registrations for the event, which is over 3 times what they had been expecting for an in-person event. 
  • Introduced Okta Platform Services, which formalizes the availability of individual, programmable services for developers to consume to incorporate customer identity into their apps. These same services are used internally to build Okta’s product offerings.
  • As part of the Platform Services roll-out, launched two new services. The first was Okta Workflows, which allows users to control the steps associated with authentication and authorization flows. Developers can inject custom scripts, called Hooks, to trigger tasks based on certain events in an authentication flow. The second was Okta Devices, which increases the granularity of access control down to the user’s devices. Each device is fingerprinted and then tracked for expected or nefarious behavior.
  • Okta FastPass was a new product launch. FastPass is built on top of the Devices service and allows users to skip the entry of a password to be authenticated into application access. This is enabled by the Okta Verify app. This app is available for multiple operating systems and devices – Windows, Mac, Android/Chrome, etc. With the Verify app installed on a device, it can synch with the device’s own user authentication system (PIN, password, biometric) and leverage that to verify the user’s identity. 
  • Announced new strategic partnerships with leading endpoint protection providers, including VMWare, Carbon Black, CrowdStrike and Tanium. These provide a broader set of device risk signals for the Identity Cloud.
• Announced that Charles Race, Okta’s President of Worldwide Field Operations, is planning to retire early next fiscal year. Charles will continue to lead the field organization, while they search for and on-board a replacement.
• On the earnings call, management talked about how Q1 outperformance in revenue may be offset by potential revenue headwinds in Q2 and Q3, before returning to normal in Q4. This explains keeping their annual revenue guidance the same for now.
• Management expects to remain free cash flow positive for the year, as they are lowering capital expenditures by about 50%. The decrease in CapEx is being attributed to reduced facilities needs as Okta accelerates their work from home initiative. This is likely a long term benefit.
• Talked about how different types of projects were timed by customers. Workforce Identity projects were pulled forward into Q1, due to the need for customers to rapidly transition to work from home. On the other hand, Customer Identity is used by software applications that are built by customers for their customers. These apps usually take a quarter or two to develop, so Okta leadership expects usage for CI solutions to start to ramp later in the year.
• The other tailwind for Customer Identity solutions is the rapid increase in e-commerce adoption in North America. Over the last couple of years, the percentage of e-commerce has been trending up slowly from 10-12% of all commerce. This percentage jumped to over 25% recently. That trend is not going away. All enterprises will need to find new and better ways to interact with their customers online. Okta will be ready to provide Customer Identity solutions for that.

Special Announcements

Along with the earnings release, Okta made two special announcements that each warranted a press release.

• FedEx Deployment. FedEx had intended to roll out the Okta Identity Cloud in a phased approach over time. However, as the COVID-19 situation evolved, FedEx decided to accelerate the deployment. With Okta’s help, they migrated all 85,000 team members the Identity Cloud over a couple of days. This allowed all employees to access the cloud-based productivity applications they use every day in a secure matter, including Office 365, ServiceNow, Zoom, Salesforce and 250 other applications. As part of the roll-out, FedEx is using Okta’s SSO, Adaptive MFA and Universal Directory products.
• Amazon SSO Native Integration. Enabled a deep integration between the Okta Identity Cloud and the AWS SSO service. Many enterprises manage their cloud infrastructure on AWS. Most of the configuration is handled through the AWS management console or programmatically through the CLI (command line interface). Previously, an enterprise might have a set of accounts/credentials for internal users to manage their AWS installation, that was separate from centralized SSO accounts for all other business apps on Okta. This resulted in a lot of duplicate accounts for users to track and management overhead. This new integration allows central user identities on Okta to be extended to sign-on to corresponding accounts on AWS. The accounts on AWS are kept in synch with source accounts on Okta, along with all resource permissions granted. Users wishing to access the AWS management console can simply start with their Okta user portal and select the AWS SSO app. They authenticate with their Okta SSO credentials and are then redirected to the AWS console. Similarly, for CLI access, the user is prompted to authenticate with their Okta SSO credentials. This is a big win for Okta, as it further establishes them as the centralized identity source. Investors should note that the integration is presented largely one-way, meaning that the assumption is most enterprises will use Okta as their Universal Directory and then want to extend that to AWS SSO (versus the other way around). This is further reinforced by Amazon’s own blog post announcing the integration. For investors concerned that identity solutions from cloud vendors might supplant Okta’s position as a central identity authority, you should read this post.

Analyst Reactions

Following Okta’s Q1 earnings on May 28th, seven sell-side analysts provided updated coverage reports. Of these, 6 out of 7 raised their price targets. Five rated the stock at a buy equivalent and two gave a neutral rating. The average price target for these updates is about $192, representing a 1.8% reduction from the closing price on May 29th of $195.58.

Date	Analyst	Rating	Price Target
6/1	Guggenheim	Buy	Raised from $145 to $200
5/29	DA Davidson	Buy	Raised from $140 to $210
5/29	JP Morgan	Overweight	Raised from $154 to $192
5/29	BMO	Outperform	Lowered from $210 to $205
5/29	Oppenheimer	Outperform	Raised from $130 to $185
5/29	Mizuho	Neutral	Raised from $165 to $178
5/29	Morgan Stanley	Equal Weight	Raised from $131 to $173

Following the earnings results, DA Davidson set the highest price target, raising by 50% from $140 to $210. Analyst Andrew Nowinski provided the following commentary.

DA Davidson analyst Andrew Nowinski raised the firm’s price target on Okta to $210 from $140 and keeps a Buy rating on the shares. The company delivered “solid” Q1 results, and while activity slowed in the SMB sector, the management views its pipeline as “very strong”, the analyst tells investors in a research note. Okta is benefiting directly from the accelerating shift to the cloud and should continue to deliver strong results going forward, Nowinski adds.

TheFly.com, May 29, 2020

Morgan Stanley maintained an Equal Weight rating, raising their price target from $131 to $173. Analyst Melissa Franchi provided the following commentary.

Morgan Stanley analyst Melissa Franchi raised the firm’s price target on Okta to $173 from $131 following the company’s “solid” Q1, which she thinks likely met, but didn’t exceed, high expectations around tailwinds from the “work-from-home” trend. The growing WFH trend will drive security architectures towards a “Zero Trust” approach, with identity – where Okta is the best positioned – being a critical component, Franchi said. However, she keeps an Equal Weight rating on Okta shares as she thinks this is fully reflected in investor expectations.

Thefly.com, May 29, 2020

Identity Market Activity

In order to get a broader view of the identity market and Okta’s position in it, we should take a look at the progress of competitors. In my initial analysis of Okta in early May, I identified Ping and Microsoft as the two meaningful competitors for consideration. This is based on their position as Leaders in the latest Gartner Magic Quadrant (along with Okta, who is in the highest position) and relative growth of their product lines.

Ping Identity (PING)

Like Okta, Ping Identity offers both a Customer Identity and Workforce Identity product line. They support three deployment postures for their products – cloud, on-premise and hybrid. Ping was founded in 2000 and started with an on-premise, installed software package. As the cloud emerged, they evolved to adding a cloud-served solution. The feature set for the cloud offerings is not as complete as on-premise, but this gap is closing over time.

Ping Identity went public in September 2019. While they are growing at about half the rate of Okta, they do have an impressive enterprise customer list. This includes over 60% of Fortune 100. Ping also has an extensive partnership with Microsoft, where Ping’s products are offered as part of the Azure AD Premium package. Ping enables a number of integrations between third-party applications and Azure AD.

Ping announced their most recent quarterly results (Q1 2020) on May 6. They beat expectations for Q1 on both earnings and revenue. However, they significantly reduced Q2 revenue guidance. The market pushed the stock down by about 3% the next day. Let’s take a brief look at the results and major announcements (earnings are Non-GAAP).

• Q1 Revenue of $61.4M, up 21.8% year/year. This compares to consensus estimate of $60.3M.
• Q1 EPS of $0.06 versus consensus estimate of $0.03.
• Q2 Revenue estimate of $49-53M, compared to consensus estimate of $63.2M. Q2 2019 revenue was $62.5M, so this target would represent year/year growth of -18%.
• Management withdrew full year 2020 guidance.
• Q1 gross profit margin of 82%, compared to 83% in the prior year.
• ARR at end of Q1 was $230M, representing a 21% increase over the prior year. Management prefers investors to examine ARR growth, versus revenue. For Q2, they are projecting $231.5M – $234.5M in total ARR.
• Q1 Subscription revenue was $56.8M, growing at 19% year/year. Subscription revenue now represents 93% of total revenue.
• Q1 Free Cash Flow was $9.6M, representing a FCF margin of 15.6%. For Q2, they are projecting FCF of $0.0M to $2.0M.
• Breaking down Q1 expenses by category (taking GAAP expense and subtracting SBC for each), we see the following.
  • R&D = 18% (versus 22% in Q1 FY2020)
  • S&M = 35% (versus 34% in Q1 FY2020)
  • G&A = 17% (versus 13% in Q1 FY2020)
• DBNER of 114% at end of Q1.
• Ended Q1 with 240 customers over $250,000 in ARR, representing a 15% year/year growth rate.
• Closed a 7-figure deal with one of the world’s largest providers of financial market data to secure all customer identities using Ping Cloud.
• Made its cloud MFA offering available to customers on the AWS marketplace.

To help investors evaluate the progress of Okta relative to Ping Identity, we can compare financial performance from the latest quarter for each. Earnings metrics are Non-GAAP.

Metric	OKTA	PING
Total Revenue	$183M	$61M
Revenue Growth	46%	22%
Gross Margin	78%	82%
Op Margin	-7%	12%
R&D	20%	18%
S&M	51%	35%
G&A	14%	17%
FCF Margin	16%	16%
DBNER	121%	114%
Market Cap	$24.9B	$2.5B
P/S Ratio	37.2	9.2

As we can see, Okta generates 3x more revenue than Ping Identity and is growing twice as fast. While Ping has better operating income, this is largely due to Okta’s significant spend on Sales and Marketing. Okta will likely continue to increase the gap in market size relative to Ping Identity. I don’t see a scenario where PING is able to catch up to OKTA at this point.

Microsoft (MSFT)

Microsoft offers cloud-based identity management solutions through their Azure Active Directory (Azure AD) and Azure AD B2C products. These solutions are SaaS-based and multi-tenant. Azure AD is the workforce solution and comes with a large catalog of SaaS application integrations. 

Microsoft recently updated the licensing program for Azure AD. It is offered in four editions – Basic, Office 365 Apps, Premium P1 and Premium P2. The Basic edition is bundled with a subscription to a commercial online service, like Microsoft Azure, Dynamics 365, Intune, and Power Platform. The Office 365 edition is available for free to Office 365 subscribers. Customers can also upgrade to P1 for $6/user/month and P2 for $9/user/month. The P1 and P2 editions provide advanced features like group access management, conditional access and identity protection.

The main benefit of the Basic and Office 365 editions are that they enable unlimited SSO and MFA for all apps with an integration to Azure AD. This includes not just Microsoft apps, but also many popular third-party apps, like Slack, Salesforce, Docusign, Zoom, etc. Previously, the free versions of Azure AD were limited to 10 apps for SSO, including Microsoft apps in that count. On April 30th, Microsoft removed this restriction and made the number of apps unlimited. This represents a major change, as paid upgrades to P1 or P2 were required for enterprises to use Azure AD for workforce identity more broadly.

Azure AD B2C is the product available for developers wishing to build custom apps using APIs for identity and access management. They provide a developer site with common use cases and sample code in several languanges. There is a fairly complete set of APIs available through Microsoft Graph for Azure AD. Pricing of the Azure AD B2C solution is determined based on MAUs. 

On April 29, Microsoft announced Q3 FY2020 results. They also provided a separate list of product updates and enhancements. Here is a list of highlights from the quarter, specific to the AD offering:

• Mentioned on the earnings call that the Active Directory products had served over 300M users in the quarter.
• The Azure Active Directory Apps Marketplace lists 3,149 results. This represents a 10% increase from the 2,800 referenced previously. They highlight new integrations periodically on the Azure AD blog.
• Announced the launch of an updated Azure AD My Apps portal. This gives users a simplified experience to discover and launch apps, across SaaS, on-prem and custom built.
• Introduced Azure AD security defaults. This provides a set of secure default settings, managed by Microsoft, to protect customer accounts from common attacks like password spray and phishing. This does require use of MFA and risk-based adaptive access policies.
• The Azure Active Directory Identity Blog is fairly active, with several posts a week on average. These provide tips, feature announcements and use cases. There are several customer highlights, including Zscaler and Imprivata.

At a high-level, it is clear that Microsoft intends to continue competing with Okta for the Workforce Identity market through their bundling of Azure AD with other Microsoft product subscriptions. The removal of the app limit on the Basic subscription is a significant change, which may help adoption of Azure AD as the primary workforce identity solution for enterprises that are already heavy users of Microsoft products. At the same time, Okta’s neutrality, and breadth of supported integrations and devices, are important distinctions for decision makers to consider.

My Take-aways

• Revenue and RPO growth continue to be strong. Revenue growth ticked up about 2% from Q4. Management didn’t substantially raise forward guidance for the remainder of the year to allow for possible headwinds in Q2-Q3. This is likely being conservative considering the improving macro outlook. Putting aside near term disruption, I think average revenue growth of 40% is sustainable for several years.
• FCF margins and profitability measures are improving. Q1 represented the best Non-GAAP operating margin compared to the first quarters of past years. I could see Okta reaching Non-GAAP EPS break-even by year’s end. FCF margin of 16.3% was the highest yet, fueled by a reduction in CapEx spend. The CapEx spending decrease was attributed to needing less support for office space. Given Okta’s transition to a longer-term work from home policy, this is unlikely to change.

• Another factor that should help the revenue growth story is Customer Identity. This represents approximately half of Okta’s TAM and is tied to application development projects. As part of the earnings release, Okta management reinforced their TAM projection of $55B, consisting of $30B from Workforce Identity and $25B from Customer Identity. Activity in workforce identity would have been accelerated by COVID-19, as enterprises scrambled to move employees to work from home and to secure access to all enterprise apps. Customer Identity growth probably slowed, while enterprises paused new development projects. However, this project work should pick up for the rest of year, due to the rapid shift of business online. I don’t think that this effective doubling of the TAM has been fully accounted for, as this was just introduced as part of the April 1 Investor Day event. The release of Okta Platform Services at Oktane20 Live provides developers with the tools to address customer identity use cases for their apps.

• Okta continues to widen their competitive moat through network effects. Not only is the technology platform expanding to new use cases, but they are expanding all the touchpoints that provide data inputs to refine the effectiveness of their identity solution. First, the launch of the Devices service and the Okta Verify app extend Okta’s visibility to the individual user device level. Second, the continued growth of integrations with third-party applications and services allows Okta to monitor identity usage across a broader set of use cases. The AWS SSO integration represents a good example here. This is doubly beneficial, since it relates to IaaS operations. Having a window into AWS activity by system administrators would provide further input for the Advanced Server Access product. Finally, Okta’s expanding customer footprint adds more user identities to the ecosystem.

• From a product marketing perspective, the Amazon SSO integration is significant. It is clear from the messaging of this and even Amazon’s own blog post announcing it, that Amazon has recognized Okta as the central identity authority, versus the other way around. If you examine the AWS SSO product, it appears that at one point, Amazon had hoped their SSO solution might be adopted more broadly, like Azure AD. This is evidenced by the effort made to create integrations with other popular business apps, like Slack, Office 365, Salesforce, G Suite. I think this announcement further reinforces Okta’s advantage as an independent identity provider, separate from the cloud vendors. For investors considering other independent software stack companies competing with look-alike cloud vendor solutions, this provides more food for thought.
• Okta continues to be in a favorable competitive position. Its closest pure-play competitor, Ping Identity, is growing at half the revenue rate and generates one third of Okta’s revenue. Microsoft is in a better position competitively due to their size and new bundling of Azure AD with other commercial software subscriptions. Gartner’s recent Magic Quadrant for the Identity space put Okta much further into the top-right position than either of these competitors. Breadth of features and capabilities will matter, even when a competing product is free.

Risks and Items to Watch

• Microsoft is clearly making a play to provide a centralized identity service with their Azure AD product. With the expansion of the Basic edition to cover unlimited apps for SSO, they are going beyond using Azure AD to simply authenticate access to Microsoft products. With Microsoft’s high penetration in mainstream enterprises, this will be something to watch and could encroach on Okta’s growth.
• Customer Identity is a relatively new product space for Okta and penetration of the TAM may take a while to materialize. There will still be engineering shops that will consider free authentication plug-ins that come with their development frameworks to be good enough for now.
• DBNER has ticked up in the past quarter to 121%. This is good, but not as high as some other software stack companies. We will want to monitor this metric as an indicator of Okta’s ability to continue to upsell landed customers.

Investment Plan

Okta is still the leading provider of cloud-based Identity solutions. Given their rapid growth, independence from cloud vendors, increasing network effects and top position in Gartner’s Magic Quadrant, they are far ahead of competitors and maintain a deep moat. With the combination of Workforce and Customer Identity solutions, Okta estimates a huge available TAM that is largely untapped. With the acceleration of remote work and the movement of customer experiences online, reliable identity services will have high demand for many years to come. As investors consider the necessary components of a modern software stack, user identity is a key category with many future product extensions.

For these reasons, I think Okta remains a favorable investment to capitalize on the evolving identity space. I will continue to recommend the name for long term investment. In early May, I initiated coverage of Okta at a price of $148.55 and set a five year target of $330. I think this is easily achievable. I would like to see how the remainder of 2020 shapes up before updating my original price target. In the meantime, I think investors will continue to benefit from owning this name.