Directory sync
Connect Microsoft Entra ID, Google Workspace, or Okta so AgentKeeper maps workstations to real people and groups.
Directory sync pulls users and groups from your identity provider, read-only. It never writes back. Once synced, Policy Profiles can target a group instead of a list of hostnames.
| Where | Settings → Access → Directory |
| Plan | Enterprise |
| Role | Owner or Admin |
| Direction | Read-only. AgentKeeper never modifies your provider. |
Before you start
Pick your provider and collect its credentials.
In the Azure portal, register an application, then grant it Microsoft Graph → Application permissions:
User.Read.AllGroup.Read.AllDirectory.Read.All
Click Grant admin consent, then create a client secret under Certificates & secrets. The secret value is shown once.
You need: Tenant ID, Client ID, Client secret.
Create a service account in Google Cloud, enable the Admin SDK API, and download its JSON key.
In Google Admin, under Security → API controls → Domain-wide delegation, authorize the service account's client ID for these scopes:
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly
You need: the JSON key file, a super-admin email to impersonate, and your primary domain.
In the Okta admin console, create an API token under Security → API → Tokens. Create it as an admin who can read users and groups.
Check that network zones or admin restrictions do not block API access from AgentKeeper.
You need: your Okta domain (acme.okta.com) and the API token.
Connect
Open the setup
Go to Settings → Access → Directory and pick your provider.
Enter the credentials
Paste the values you collected above.
Test the connection
AgentKeeper reads the directory and reports how many users and groups it found. If it reports 0 users, the credential is valid but the permissions or delegation scopes are not — go back and re-check them.
Choose the group sync scope
All groups syncs everything. Selected groups syncs only the groups you pick. Choose this before the first sync — narrowing it later leaves already-synced groups in place.
Verify
Open Settings → Access → Directory. You should see:
- A connection card with a recent sync time.
- A Directory accounts table listing synced users.
- A Groups table listing the groups in your chosen scope.
Then open Workstations — machines whose logged-in user matches a synced account now show that person instead of a bare hostname.
Using synced groups in policy
Create a Policy Profile and set its audience to a directory group. See Policy Profiles.
Group membership changes at your provider apply on the next sync. A user removed from a group loses that profile's rules; they fall back to the Base Policy.
Troubleshooting
| Symptom | Cause |
|---|---|
| Connected, 0 users | Permissions granted but admin consent not clicked (Entra), or domain-wide delegation missing (Google) |
| Connection failed | Wrong tenant/domain, expired secret, or Okta network zone blocking the request |
| A group is missing | Group sync scope is set to Selected groups and this one is not selected |
| Workstations still show hostnames | The workstation's OS user does not match any synced account email |