A feature that synchronizes users from on-premises AD to Okta. OUs can be synced, AD Security Groups are automatically synced to Okta Groups.

Set up a relay server (Okta AD Agent) for user synchronization between AD and Okta.

For details on prerequisites for building AD Agent, see below.

https://help.okta.com/en/prod/Content/Topics/Directory/ad-agent-prerequisites.htm

Although it is possible to run the Agent on the server where the Domain Controller service is running, for actual operations, we recommend preparing a separate server to minimize the impact on the Domain Controller service.

• Minimum hardware requirements:
• 1. 2 CPU, 8GB or more RAM
  2. Windows Server 2008 R2 or later
  3. Implements .NET 4.5.2 or later
  4. A server participating in the domain to which the AD user (AD user used on Okta) belongs
  5. Always on and always able to communicate with Okta over the internet

Also, register the following sites as trusted sites in IE on the server where AD Agent will be installed.

• https://*.okta.com/
• https://*.oktacdn.com/

Advance preparation

Preparation items for building AD Agent.

• Server running Okta AD Agent
  In order to perform coordination processing between Active Directory and Okta tenants, the Okta AD Agent must be constantly running on the Windows Server terminal participating in Active Directory, so please use a server that meets the requirements listed on the previous page. Please prepare.

• AD domain admins account or local administrator account on the host server
  Used when installing Okta AD Agent.
• 1. If you want the installer to create an Okta service account during the Okta AD Agent installation, an AD domain admins account is required.
  2. If you have already created an AD domain users account as an Okta service account and want to install Okta AD Agent, you will need local administrator privileges on the host server.

• AD service account
  A user created by the Okta AD Agent installation wizard. You may also create an account in advance.
  This is the user who starts and executes Okta AD Agent.
  The default account name is "OktaService".
  Belongs to the Domain Users group.

• Okta SuperAdmin account
  Super Admin account used by Okta AD Agent to connect to your Okta tenant.
  We recommend that you create an account separate from your personal SuperAdmin account. This is because if it is a personal account, Admin privileges may be removed or disabled.

• OU to import
  It is possible to restrict the import of user groups from Active Directory to Okta by OU. Decide in advance which OU's user group you want to target.

For details on prerequisites for building AD Agent, see below.

https://help.okta.com/en/prod/Content/Topics/Directory/ad-agent-prerequisites.htm