Directory Integration
Connect Okta or Microsoft Entra ID so Discover AI (Shadow AI) can attribute AI usage to departments, job titles and managers, and to stamp each record with the person's Okta user ID. The directory sync reads your directory. It never writes to it. The only change ANTS Platform can make in your directory is the optional access grant for approved AI tool requests.
Attribution and reporting only. The sync adds department, job title, manager and full name to people who are already enrolled in Discover AI, and keeps a read-only roster of your directory users. It does not enroll devices, create ANTS Platform members or assign roles. It changes access only through the optional group grant for approved AI tool requests.
What it is used for
Directory attributes appear in:
- The Department filter on Discover AI pages, with a No department option for people without one.
- The Departments section of AI Usage Intelligence, including each department's headcount from your directory.
- The Department column on Users, and the job title, department and manager on each user's page.
- The department tier of the AI Activity graph.
Without a directory, department and job title can still come from the device: the enrollment script reads them from the local directory where available.
Prerequisites
- An Enterprise plan.
- An organization role that can manage Discover AI configuration: Owner or Department Admin, or a custom role with Configure (policy, registry, keys, directory) set to write. Security & Compliance and Cost Analyst can view the integration but not change it. See Members & Roles.
- Admin access to your Okta or Entra ID tenant to create read-only credentials.
The integration belongs to the organization, not a project. Each organization can connect one Okta and one Entra ID directory. It lives under Organization Settings > Integrations, next to the Microsoft 365 Copilot and Microsoft Copilot Studio cards.
On-premises Active Directory is not supported directly. Sync it to Entra ID with Azure AD Connect, then connect Entra ID.
Connect Okta
Create an API token in Okta
In the Okta Admin Console, go to Security > API > Tokens and create a token. The token has the permissions of the admin who creates it, so create it as a read-only administrator. Copy the token value; Okta shows it once.
Open the Okta card
In ANTS Platform, open Organization Settings > Integrations. On the Okta card, click Configure.
Enter your details
| Field | Value |
|---|---|
| Tenant URL | https://your-org.okta.com. It must be an okta.com, oktapreview.com or okta-emea.com address. Custom Okta domains are not accepted. |
| API token | The token you created. |
| User filter (optional) | An Okta filter expression, for example status eq "ACTIVE". Only matching users are synced. |
Okta also offers Match by username when email is missing. It matches a device's OS username against the Okta login, for agents that do not report an email.
Test and save
Click Test connection. On success, click Save & sync. The first sync runs right away and reports how many users were synced and how many are not yet enrolled.
Connect Microsoft Entra ID
Register an application
In the Azure portal, go to Microsoft Entra ID > App registrations > New registration. Note the Directory (tenant) ID and the Application (client) ID from the Overview page.
Add application permissions
Go to API permissions > Add a permission > Microsoft Graph > Application permissions and add:
User.Read.AllDirectory.Read.All
Then click Grant admin consent for your tenant. Each permission's status must show as granted.
These must be Application permissions, not Delegated permissions. The integration signs in as the application with the client credentials flow.
Create a client secret
Go to Certificates & secrets > Client secrets > New client secret. Copy the secret Value (not the Secret ID). Azure shows it once.
Enter your details
In ANTS Platform, open Organization Settings > Integrations. On the Microsoft Entra ID card, click Configure and enter:
| Field | Value |
|---|---|
| Directory (tenant) ID | The tenant GUID or a verified domain. |
| Application (client) ID | From the app registration. |
| Client secret | The secret Value. |
Test and save
Click Test connection, then Save & sync.
What gets synced
| Attribute | Okta source | Entra ID source |
|---|---|---|
email, or login if there is no email | mail, or userPrincipalName if there is no mailbox | |
| Full name | displayName, or first and last name | displayName, or given name and surname |
| Department | department | department |
| Job title | title | jobTitle |
| Manager | managerEmail or manager, as stored | The manager's mail or userPrincipalName |
| Employee ID | employeeNumber (roster only) | employeeId (roster only) |
| Active status | Suspended or deprovisioned users are inactive | accountEnabled false is inactive |
The sync writes department, job title, manager and full name onto each matching enrolled person. It only writes a value the directory provides. It never blanks a value that is already there. Group membership is not synced.
Directory user roster
Every directory user is also kept in a roster under Organization Settings > Users (Directory Users), whether or not they are enrolled. The roster shows each person's status, department, title, manager, whether they have the agent (Enrolled or Not enrolled), the source directory and when they were last synced. Use it to find people who use your directory but have no Discover AI client.
Users who leave your directory are kept and marked Inactive, not deleted. This only happens after a complete sync with no errors. If you set a narrow Okta user filter, people outside it are also marked inactive.
How people are matched
By default, a directory user is matched to an enrolled person by email, ignoring case. This is right for most setups.
Turn on Identity mapping (advanced) only if your enrolled clients do not report an email. You then pick the field on each side:
- From your enrolled clients: Client ID, User email, User principal name, Employee ID, User full name, or OS username.
- From Okta: Okta ID,
profile.email,profile.login(local part), or name. - From Microsoft Entra ID:
displayName,mail, or given name and surname.
Avoid name fields. Two people can share a name, so a name match can enrich the wrong person. Prefer email, login, UPN or employee ID.
With advanced mapping on, Test mapping runs a dry run against a sample of up to 500 directory users. It reports how many enrolled clients would match, for example "X of Y enrolled clients with this field would match (P%)", with examples that did not match on each side. It writes nothing.
An explicit mapping has no fallback. For example, choosing mail for Entra ID
does not fall back to the user principal name when mail is empty. The
default email match does.
Okta user ID on records
With Okta connected, ANTS Platform stamps each Discover AI event and each trace with the person's Okta user ID as the record arrives. It looks up the record's email among the synced directory users, ignoring case, and stores the matching Okta ID on the record.
Investigations, HR cases and SIEM searches usually key on the Okta ID rather than the email. An email can change or be reused; the Okta ID does not. With the ID on every record, a person's history stays joined across an email change and lines up with your other security tools.
- The Okta ID shows on each person's page under Users.
- Exports of Discover AI and trace data include the Okta ID.
- A record whose email matches no synced Okta user carries no Okta ID.
- The ID is stamped as records arrive. Records stored before Okta was connected do not carry it.
Sync schedule
Set Sync every to 1 hour or 24 hours (default, recommended for large tenants). A background job checks every 15 minutes and syncs any directory whose interval has passed since its last sync. A manual sync resets that clock.
Large directories are read page by page. The sync retries on rate limits and temporary errors and slows down when your identity provider's rate limit is close.
Managing the integration
Once connected, the card's sheet shows the status (Connected, Paused or Sync failed), the last sync, and these controls:
- Sync now: runs a sync in the background. Refresh after a moment to see the result.
- Sync every: change the interval.
- Sync history: the last 50 runs, with users updated, skipped, added to the roster and deactivated, and whether each run was manual or scheduled.
- Pause / Resume: stops scheduled syncs. Sync now still works while paused.
- Disconnect: stops syncing and deletes the integration and its sync history. Department and title data already on users, and the roster, are kept.
Credentials, the user filter and identity mapping cannot be edited after you connect. To change them, disconnect and connect again.
Troubleshooting
Test connection or the sync fails with HTTP 401 or 403
The error shows the HTTP status from your identity provider.
- Okta: check that the token is valid and not expired, and that the Tenant URL is your Okta domain without a path.
- Entra ID: check the tenant ID, client ID and secret Value. A 403 means
the app is missing
User.Read.AllorDirectory.Read.Allas Application permissions, or admin consent was not granted.
Few or no people were enriched
- The directory user may have no enrolled client. Only enrolled people are enriched; check the roster's Not enrolled users.
- The email does not match. Compare a directory user's email with the email shown for that person on the Users page. For Entra ID users without a mailbox, the default match uses the user principal name.
- With advanced mapping on, re-run Test mapping to check the chosen fields.
"A sync is already in progress for this integration"
Wait for the running sync to finish, then try again.
The scheduled sync did not run
The sync runs only after its interval has passed since the last sync. On a 24-hour schedule the next run can be up to a day away. Use Sync now, or set Sync every to 1 hour.
Security
-
Credentials are encrypted at rest and are never shown again after saving.
-
The directory sync only reads your directory. The optional access grant for AI tool requests is the only write, and only adds approved people to the groups you map to tools.
-
Use a read-only Okta admin token, or only the two Entra ID application permissions above, unless you turn on access grants. See AI Tool Requests.
-
Rotate the token or client secret on your normal schedule. To apply a new one, disconnect and connect again.