Active Directory Integration

📘 OCA Study Notes: Configure the Active Directory Integration

1. Why Integrate Active Directory With Okta?

Your company likely uses:

• AD to authenticate and authorize users for email, file shares, and on-prem apps.

• Okta to provide cloud SSO and lifecycle automation.

Integrating AD with Okta provides:

• Centralized identity management

• Delegated authentication (AD verifies credentials)

• Importing or Just-In-Time (JIT) user creation

• Provisioning users and groups to AD

• Password sync, attribute sync, lifecycle automation

• Unified profile mapping with UD

2. How AD Integrates with Okta

Integration relies on the Okta AD Agent:

• Installed on a Windows Server on-prem

• Lightweight

• Communicates outbound to Okta (no inbound firewall ports needed)

• Runs as a service account

• Provides:

  • User import

  • Profile mastering

  • Delegated authentication

  • Password sync (optional)

  • Provisioning to AD

  • Group management

3. Active Directory Integration Prerequisites

A. Okta Admin Account Requirements

The account used to install/manage the AD agent must have:

• Manage application directory integration

• Manage agents

• Register agents

Best practice → Create custom admin roles with JUST these permissions.

Separate roles example:

1. Integration role: Manage integration + agents

2. Registration role: Register agents only (used during installation)

Use Resource Sets to constrain permissions to only the AD app.

B. AD Admin Account To Install the AD Agent

Installer offers:

• Create the Okta service account automatically
  → Requires Domain Admin

• Use existing account
  → Requires:

  • Domain User

  • Local Administrator on the host server

  • Read access to required OUs

C. AD Domain User To Run the AD Agent Service

This becomes the Okta service account.

Requirements:

• Member of Domain Users

• Password never expires

• Dedicated to Okta agent and nothing else

4. Installing the Okta AD Agent

Steps:

1. Download agent from Okta (Directory → Directory Integrations → AD).

2. Install on Windows server(s).

3. Provide service account credentials.

4. Register the agent with Okta.

5. Agent appears in the Okta Admin Console under Agents.

Use Okta AD Agent Manager (Windows tray app) to:

• Start/stop agent

• Register additional domains

• Modify proxy settings

• (Not recommended) Add service account to Domain Admins

5. High Availability & Best Practices

• Install at least TWO AD agents per domain.

• Install each on separate host servers → no single point of failure.

• Keep agents up to date.

• If agents run mixed versions → the oldest version restricts functionality.

6. Managing Agents in Okta

In Admin Console → Directory → Directory Integrations → Active Directory:

Add agent

Download + install more agents.

Update agents

Auto-update removes old agent and installs new version.

Actions

Deactivate or delete agent.

Manage auto-updates

• Requires minimum two operational agents.

• Schedule when agents will update.

7. Active Directory Profile in Universal Directory

Once integrated, Okta creates an AD User Profile with:

• Default AD attributes

• Custom attributes if added

• Okta auto-maps many fields

Admins can adjust mappings in the Profile Editor.

8. Provisioning Direction Scenarios

Scenario 1 — AD is the Profile Source

Used when AD is the system of record.

You can configure:

• Scheduled imports (regular sync)

• JIT provisioning (user created on first login)

• Matching rules for user imports

• Allow AD to master Okta users (default)

• Protect against mass deletes/unassignments

Scenario 2 — HR System is Profile Source (HR-as-a-Master)

Example: Workday or BambooHR master profiles.

Okta → AD provisioning supports:

• Create or link users in AD when assigned to AD app

• Update attributes in AD when Okta profile changes

• Deactivate AD accounts when user deactivated/unassigned

• Create AD passwords and push to AD during provisioning

Service account permissions in AD are required for each object type (users, groups, OUs).

9. Most Testable OCA Exam Topics

Expect questions on:

✔ AD vs HR system as source of truth

✔ Agent installation requirements

✔ Service account permissions

✔ Auto-update constraints

✔ Provisioning direction and attribute mastering

✔ Delegated authentication behavior

✔ JIT vs scheduled import

✔ Profile mapping and AD profile structure

✔ High availability agent requirements

✔ Preventing mass deletion in imports

✅ OCA Exam Notes: Okta AD Agent Installation (Video Summary)

This is everything the video includes, reduced down to what is testable.

1. Downloading the AD Agent

You install the AD Agent from:

Admin Console → Directory → Directory Integrations → Add Directory → Active Directory → Download Agent

The installer is Windows-only.

2. Installation Requirements (re-stated in the video)

During installation, you're prompted for:

✔ A local Windows Admin account

To install the service.

✔ AD Domain Admin account OR an existing dedicated service account

Depending on whether you allow the installer to automatically create the Okta service account.

✔ Register the Agent with Okta

The installer opens a browser window for you to log into your Okta org with an account that has:

• Manage application directory integration

• Manage agents

• Register agents

3. Installation Steps (as shown in video)

1. Run the agent installer (.msi)

2. Accept EULA

3. Choose whether the installer should create Okta service account or use an existing one

4. Enter domain and credentials

5. Installer registers the agent with Okta

6. Agent appears in Okta under:
   Directory Integrations → Active Directory → Agents

7. Okta AD Agent Manager appears in Windows tray area

4. AD Agent Manager (video UI walkthrough)

From the Okta AD Agent Manager, you can:

• Start/stop the service

• Modify proxy settings

• Register additional domains

• View agent status

You should not use the optional feature to add the service account to Domain Admins.

5. Video Best Practices Confirmed

The video reinforces:

✔ Install at least two agents per domain

✔ Use different host servers to avoid single points of failure

✔ Keep agents updated (auto-update recommended)

🎯 So… Do you need the video for the exam?

Not really.

Everything testable from the video is already in your notes.
The OCA exam does not test step-by-step installation details—it tests:

• Permissions

• Prerequisites

• Behavior of the agent

• High availability requirements

• What AD Agent Manager is used for

• When to use JIT vs import

• What delegated authentication does

So yes — you already have everything needed.

But for flashcards, I'll produce the installation portion next.