Directory Services

VeraID integrates with enterprise directory services to synchronize user and group data, enabling human-to-NHI relationship mapping, ownership tracking, and automated offboarding cascades. When an employee leaves your organization, VeraID can automatically suspend or revoke all NHIs they own or manage.

Okta

Capabilities

• User Sync — Import users from Okta with their profile attributes, group memberships, and status.
• Group Sync — Sync Okta groups to VeraID teams for role-based NHI ownership and access policies.
• Status Tracking — Monitor user status transitions across ACTIVE, SUSPENDED, and DEPROVISIONED states to trigger automated NHI governance actions.

Synced User Fields

Okta Field	VeraID Field	Description
id	externalId	Okta user ID
profile.login	email	User email address
profile.firstName	firstName	First name
profile.lastName	lastName	Last name
profile.department	department	Department for ownership mapping
profile.title	title	Job title
status	status	ACTIVE, SUSPENDED, or DEPROVISIONED
lastLogin	lastLoginAt	Last login timestamp

Status-Based Automation

When a user’s Okta status changes, VeraID can automatically trigger governance actions:

Okta Status	VeraID Action
ACTIVE	No action — NHIs remain active
SUSPENDED	Suspend all NHIs owned by this user; notify designated backup owners
DEPROVISIONED	Revoke all NHIs owned by this user; transfer ownership to manager or team lead

---

Azure Active Directory

Capabilities

• User Sync — Import users from Azure AD with their profile, group memberships, directory roles, and sign-in activity.
• App Registration Sync — Discover and import Azure AD app registrations as NHIs, including their client secrets, certificates, and API permissions.
• Service Principal Sync — Track service principals and their credential lifecycle, including expiring client secrets and certificates.
• Risk Assessment — Evaluate third-party app registrations based on permission scope, consent type, and publisher verification status.

App Registration Risk Factors

VeraID automatically assesses risk for Azure AD app registrations based on the following criteria:

Factor	Weight	Description
Unverified publisher	High	App is from an unverified publisher
Admin-consented permissions	High	App has permissions that required admin consent
Mail.ReadWrite or similar	High	App has broad data access permissions
Multi-tenant app	Medium	App is available to multiple tenants
No sign-in activity (90d)	Medium	App has not been used in 90 days
Client secret expiring	Low	Client secret expires within 30 days
Certificate-based auth	Low (positive)	Reduces risk compared to client secrets

Client Secret Monitoring

VeraID tracks all client secrets associated with Azure AD app registrations:

{
  "appRegistration": {
    "displayName": "Production API Service",
    "appId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "credentials": [
      {
        "type": "CLIENT_SECRET",
        "displayName": "Production Key",
        "expiresAt": "2026-06-15T00:00:00Z",
        "daysUntilExpiry": 88,
        "status": "ACTIVE"
      },
      {
        "type": "CERTIFICATE",
        "displayName": "mTLS Certificate",
        "expiresAt": "2027-01-01T00:00:00Z",
        "daysUntilExpiry": 288,
        "status": "ACTIVE"
      }
    ],
    "riskScore": 72,
    "riskFactors": ["admin-consented", "unverified-publisher"]
  }
}

---

Google Workspace

Capabilities

• User Sync — Import Google Workspace users with their profile, organizational unit, and admin status.
• Delegation Sync — Discover domain-wide delegation grants for service accounts, identifying which service accounts can impersonate which users.
• Group Sync — Sync Google Groups for ownership mapping and access policy assignment.

Domain-Wide Delegation Tracking

VeraID identifies GCP service accounts with domain-wide delegation and maps the scopes they have been granted:

{
  "serviceAccount": "analytics-pipeline@project.iam.gserviceaccount.com",
  "delegationGrants": [
    {
      "scopes": [
        "https://www.googleapis.com/auth/drive.readonly",
        "https://www.googleapis.com/auth/spreadsheets.readonly"
      ],
      "grantedBy": "admin@company.com",
      "grantedAt": "2025-08-15T10:30:00Z"
    }
  ],
  "riskLevel": "MEDIUM",
  "impersonatableUsers": 342
}

Caution

Domain-wide delegation grants are a high-risk attack vector. A compromised service account with domain-wide delegation can impersonate any user in your organization. VeraID flags these grants and recommends scope reduction where possible.

---

Setting Up a Directory Connection

1. Create a Directory Connection

curl -X POST https://app.veraid.io/api/v1/directory/connections \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Corporate Okta",
    "provider": "OKTA",
    "config": {
      "domain": "yourcompany.okta.com",
      "apiToken": "00abc123...",
      "syncUsers": true,
      "syncGroups": true,
      "syncInterval": "15m",
      "filters": {
        "includeGroups": ["Engineering", "Platform", "Security"],
        "excludeUsers": ["servicedesk@company.com"]
      }
    }
  }'

Note

Provider-specific configuration (the config object) is encrypted at rest using envelope encryption. API tokens and client secrets are never stored in plaintext.

2. Test the Connection

Before running a full sync, verify that VeraID can connect to your directory:

curl -X POST https://app.veraid.io/api/v1/directory/connections/{id}/test \
  -H "Authorization: Bearer kd_live_your_api_key"

Response:

{
  "status": "SUCCESS",
  "message": "Connected successfully",
  "details": {
    "usersFound": 1247,
    "groupsFound": 86,
    "latency": "230ms"
  }
}

3. Run Initial Sync

Trigger the first full synchronization:

curl -X POST https://app.veraid.io/api/v1/directory/connections/{id}/sync \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -d '{ "fullSync": true }'

The initial sync may take several minutes depending on the size of your directory. Subsequent incremental syncs only process changes since the last sync.

---

Sync Logs

Every sync operation produces a detailed log entry for auditing and troubleshooting:

{
  "syncId": "sync_abc123",
  "connectionId": "conn_xyz789",
  "provider": "OKTA",
  "status": "COMPLETED_WITH_ERRORS",
  "startedAt": "2026-03-19T10:00:00Z",
  "completedAt": "2026-03-19T10:02:34Z",
  "stats": {
    "usersCreated": 12,
    "usersUpdated": 45,
    "usersDeprovisioned": 3,
    "groupsCreated": 2,
    "groupsUpdated": 8,
    "errors": 1
  },
  "errors": [
    {
      "type": "USER_SYNC_FAILED",
      "externalId": "00u1234567",
      "message": "Failed to resolve manager reference: manager not found in directory",
      "severity": "WARNING",
      "retryable": true
    }
  ]
}

Field	Description
status	COMPLETED, COMPLETED_WITH_ERRORS, FAILED, IN_PROGRESS
stats	Breakdown of created, updated, and removed records
errors	Array of errors with type, message, severity, and retry status

Sync logs are retained for 90 days and can be queried via the API or viewed in the VeraID dashboard under Settings > Directory > Sync History.

Tip

Set up alert rules to notify your team when a directory sync fails or produces errors. Navigate to Settings > Alerts > Rules to create a rule for the directory.sync.failed event type.

Provider Configuration Reference

Provider	Required Fields	Optional Fields
Okta	domain, apiToken	syncUsers, syncGroups, syncInterval, filters
Azure AD	tenantId, clientId, clientSecret	syncUsers, syncGroups, syncAppRegistrations, syncServicePrincipals, syncInterval, filters
Google Workspace	domain, serviceAccountKey, adminEmail	syncUsers, syncGroups, syncDelegation, syncInterval, filters