The Okta AD agent Management Utility also includes the option of adding the OktaService account to the Domain Admins group. Make sure the OktaService account has Read all permissions for all synchronized AD objects. To resolve issues with incremental imports, Okta recommends making one of the following changes:Īdd the OktaService account to the Pre-Windows 2000 Compatible Access group. Removing the Authenticated Users group from the Pre-Windows 2000 Compatible Access group can cause issues with incremental imports. By default, the Authenticated Users group is a member of the Pre-Windows 2000 Compatible Access group. OktaService is also considered to be a member of the Authenticated Users and Everyone special identity groups when the agent is running. The newly created OktaService account inherits the permissions of the Domain Users group. Before adjusting the permissions on your directory, make sure you understand how Active Directory (AD) permissions are set and plan how to manage permissions within your environment.īy default, the Okta AD agent installer creates a new Okta service account if you don't choose an existing account.

Active directory ou permissions report