Optimize the AD integration

What is a requirement for installing an Okta AD Agent?

You must install an Okta AD Agent in every domain that contains users you want to import.

What should never be done when installing Okta AD agents?

Never install agents on domain controllers.

What is the preferred installation type for Okta AD agents?

Server Core installation is preferred due to minimal attack surface.

How many concurrent requests can the PollingThreads setting control?

The PollingThreads setting can control the number of concurrent requests between Okta and the agent, with a valid range of 1–10.

What should you verify after modifying the PollingThreads value?

Open Logs/Agent.log to verify the new thread count.

What are the requirements for the Okta service account?

Member of Domain Users, Password never expires, Should not exist in Okta, Should not be used by any other service, Deny interactive login, Least privilege principle applies.

What security consideration is important for host server hardening?

Remove unnecessary services and restrict network access.

What is the health detection metric for the Okta AD agent?

Agent is marked unavailable after 120 seconds of missed heartbeat.

What principle should be applied to Okta service accounts?

Least privilege principle applies.

What is one best practice for agent performance?

Install the Okta AD agent on multiple host servers per domain.

optimize_ad_integration_deck = """

What is required if users exist in multiple AD domains?

Install an Okta AD Agent in each domain.

Does the AD agent support multiple forests?

No the agent cannot communicate across forests.

Why install multiple AD agents per domain?

To ensure high availability.

Should the AD agent be installed on a domain controller?

No install on a separate host server.

Does placing agents near users geographically increase performance?

No agent location has no effect on performance.

When is an AD agent marked unavailable?

After 120 seconds with no heartbeat.

Recommended agents for <30k users?

Two agents.

Recommended agents for >30k users?

At least three agents.

When user count exceeds 100k what should you do?

Work with Okta for optimal sizing.

Where do you configure AD agent performance settings?

In the OktaAgentService.exe.config file.

What does PollingThreads control?

Number of concurrent polling requests between Okta and the agent.

Valid range for PollingThreads?

1 through 10.

Default PollingThreads value?

2.

What must you do after modifying PollingThreads?

Restart the AD Agent service.

Where do you verify new PollingThreads value?

In Logs/Agent.log.

What account runs the Okta AD agent service?

An AD domain user service account.

Should the Okta service account exist in Okta?

No.

What group should the service account belong to?

Domain Users.

What must be set on the service account password?

Password never expires.

Should the Okta service account have interactive login rights?

No disable interactive logon.

Is using the AD administrator account as the Okta service account recommended?

No never use the AD admin account.

For delegated authentication and JIT what permissions are needed?

Read-only permissions.

For provisioning from Okta to AD what permissions are needed?

Write permissions to specific AD objects.

Should the service account be added to Domain Admins?

No it violates least-privilege.

Best practice for host server hardening?

Remove unnecessary services.

What authentication protocols should host servers reject?

LM NTLM and NTLMv2.

What network access restrictions should be applied to agent servers?

Allow only DCs jump host and Okta Privileged Access.

What MFA type should admins use on agent servers?

Phishing-resistant second factor.

Should AD agent servers be included in patch management?

Yes required.

""".strip()