Skip to main content
CyberArk Identity is the workforce identity provider of the CyberArk Identity Security Platform. Connect your CyberArk Identity tenant to Oleria to see who holds which roles and administrative rights, and to lock users or change their role membership directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers the following from your CyberArk Identity tenant:
  • Users - every user in the tenant, from every directory source (CyberArk Cloud Directory, Active Directory, LDAP, and federated directories). Locked (Suspended) users show as disabled.
  • Roles - every role, including the built-in System Administrator and Everybody roles and dynamic (script) roles. Each role’s description lists its administrative rights.
  • Role membership - which users belong to each role, roles nested inside other roles, and directory groups that are members of a role.
  • Administrators - users in the System Administrator role, or in any role that holds an administrative right other than Admin Portal Login - directly, through a nested role, or through the Everybody role (whose rights every user holds).
  • Activity - identity events from the CyberArk Identity event log, including sign-ins, failed sign-ins, MFA challenges, app launches, impersonation, user changes, and role and administrative-right changes.
This integration covers CyberArk Identity. Privilege Cloud and Privileged Access Manager (safes and vault accounts) aren’t included.

​
Prerequisites

  • A CyberArk Identity administrator who can create users and roles in the Identity Administration portal.
  • Your Identity tenant URL - the address of your Identity Administration portal, for example https://abc1234.id.cyberark.cloud. Use the CyberArk-hosted address (ending in .id.cyberark.cloud, or .my.idaptive.app for older tenants), not a custom domain.
Create a dedicated service user for this integration rather than using an administrator’s personal account. Oleria never locks this service user or removes it from a role.

​
Create a service user in CyberArk Identity

1

Create the service user

In the Identity Administration portal, go to Core Services -> Users and select Add User. Enter a login name such as oleria-svc@<your suffix>, set a strong password, and select Is Service User and Is OAuth confidential client. Save the user.
2

Create a role for the service user

Go to Core Services -> Roles, select Add Role, and name it, for example, “Oleria Integration”. On the Members tab, add the service user.
3

Grant administrative rights

On the role’s Administrative Rights tab, add the rights for what you want Oleria to do:Save the role.

​
Connect CyberArk Identity to Oleria

1

Open the integration

Sign in to your Oleria workspace, navigate to Integrations, and select CyberArk Identity.
2

Complete the connection form

3

Authenticate

Select Authenticate to validate and save the integration. Oleria signs in as the service user and checks that it can read users and roles before saving. If the service user can’t read the event log, the integration still connects and syncs users and roles without activity.

​
Verify the integration

Confirm the CyberArk Identity instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, review the discovered users, roles, and activity in your Oleria workspace.

​
Remediation actions

With the User Management and Role Management rights, Oleria can take the following actions directly against CyberArk Identity:
Oleria can’t change membership of the Everybody role or of dynamic (script) roles, because CyberArk Identity computes their members. A user who belongs to a role only through a nested role or a directory group can’t be removed from it with Remove user from role.

​
Known limitations

  • MFA and SSO requirements aren’t shown per user. CyberArk Identity decides MFA per sign-in from authentication profiles and policies, so Oleria reports these as unavailable. MFA challenges still appear as activity.
  • Service users aren’t distinguished from people. CyberArk Identity doesn’t expose the Is Service User flag in the data Oleria reads, so service users appear as standard users.
  • Directory group membership isn’t synced. Oleria shows which Active Directory, LDAP, or federated groups are members of a role, but not who is in those groups. Connect the source directory to Oleria to see group membership. Administrators who get their rights only through a directory group aren’t flagged as administrators.
  • Applications and app assignments aren’t synced. This integration covers identities and roles. The apps assigned to roles, devices, and policies are out of scope.
  • Activity covers the last 90 days. The first sync reads up to 90 days of events.

​
Contact us

For questions about this integration, contact us at support@oleria.com.