Active Directory account rules

Early Access release

Active Directory (AD) account rules are designed to automate the management of AD accounts in Okta Privileged Access. They're used to automatically find AD accounts in specific OUs and bring those accounts under management. To stop managing an account with Okta Privileged Access, the account rule must be modified or removed to no longer include those specific OUs.

Types of account rules

There are two types of account rules:

Shared account rules: Used to manage accounts that multiple people use and that don't belong to a single user. These accounts are shared among a team, such as an admin account owned by the Active Directory team or a shipping account managed by the logistics team.

Individual account rules: Meant for accounts that belong to specific users. In an AD environment, there are typically separate dedicated accounts used by privileged users so that their daily accounts don't have privileged access. These admin accounts are intended solely for individual use and are named with a prefix or suffix that indicates they're admin accounts. For example, they may look like adm.Jane.Doe@ad.domain.net or clark.kent-admin@ad.dailyplanet.org. Before creating an individual account rule, it's necessary to configure the individual account settings first.

Individual account rule settings determine how Okta Privileged Access maps an individual account to its primary user. Okta Privileged Access supports several options for correlating these accounts with their respective owners. A policy rule then controls whether a user can access their own individual admin account and specifies the conditions applied to that access. A user can only view their own individual account.

Managing AD-only accounts and AD accounts linked to Okta users

An account rule brings Active Directory accounts under Okta Privileged Access management based on OU and any additional filters you configure, such as account name or Okta group. The same rule can bring both AD-only accounts and AD accounts linked to Okta users under management. The rule doesn't distinguish between them.

After an account matches a rule:

  • If the account has no corresponding Okta user, Okta Privileged Access manages the password directly.

  • If the account is already linked to an Okta user, Okta Privileged Access manages the password through that Okta user. The Okta user's status is never changed as a result.

There's no setting to configure this behavior. It happens automatically for every account rule.

Prioritizing and ordering rules for Active Directory OUs

Rule ordering is crucial for achieving the desired behavior, especially in complex environments with nested organizational units (OUs).

  • First Match Wins: Okta Privileged Access processes Active Directory (AD) account rules according to their priority order. The first rule that matches an account determines how that account is managed.

  • OU-Level prioritization: Precedence between rules is determined by the OU match and the rule priority order. Additional filters (Account Name and Okta Group) narrow which accounts a rule applies to, but they don't affect precedence between rules.