> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CyberArk Identity

> Connect your CyberArk Identity tenant to Oleria to continuously discover users, roles, administrative rights, and identity events, and take remediation actions directly from Oleria.

CyberArk Identity is the workforce identity provider of the CyberArk Identity Security Platform. Connect your CyberArk Identity tenant to Oleria to see who holds which roles and administrative rights, and to lock users or change their role membership directly from Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers the following from your CyberArk Identity tenant:

* **Users** - every user in the tenant, from every directory source (CyberArk Cloud Directory, Active Directory, LDAP, and federated directories). Locked (Suspended) users show as disabled.
* **Roles** - every role, including the built-in **System Administrator** and **Everybody** roles and dynamic (script) roles. Each role's description lists its administrative rights.
* **Role membership** - which users belong to each role, roles nested inside other roles, and directory groups that are members of a role.
* **Administrators** - users in the **System Administrator** role, or in any role that holds an administrative right other than **Admin Portal Login** - directly, through a nested role, or through the **Everybody** role (whose rights every user holds).
* **Activity** - identity events from the CyberArk Identity event log, including sign-ins, failed sign-ins, MFA challenges, app launches, impersonation, user changes, and role and administrative-right changes.

<Note>
  This integration covers CyberArk Identity. Privilege Cloud and Privileged Access Manager (safes and vault accounts) aren't included.
</Note>

## Prerequisites

* A CyberArk Identity administrator who can create users and roles in the **Identity Administration** portal.
* Your Identity tenant URL - the address of your Identity Administration portal, for example `https://abc1234.id.cyberark.cloud`. Use the CyberArk-hosted address (ending in `.id.cyberark.cloud`, or `.my.idaptive.app` for older tenants), not a custom domain.

<Note>
  Create a dedicated service user for this integration rather than using an administrator's personal account. Oleria never locks this service user or removes it from a role.
</Note>

## Create a service user in CyberArk Identity

<Steps>
  <Step title="Create the service user">
    In the **Identity Administration** portal, go to **Core Services** -> **Users** and select **Add User**. Enter a login name such as `oleria-svc@<your suffix>`, set a strong password, and select **Is Service User** and **Is OAuth confidential client**. Save the user.
  </Step>

  <Step title="Create a role for the service user">
    Go to **Core Services** -> **Roles**, select **Add Role**, and name it, for example, "Oleria Integration". On the **Members** tab, add the service user.
  </Step>

  <Step title="Grant administrative rights">
    On the role's **Administrative Rights** tab, add the rights for what you want Oleria to do:

    | Administrative right | Needed for |
    | :- | :- |
    | Read Only System Administrator | Discovery: users, roles, role membership, administrative rights, and events. Required. |
    | User Management | Locking and unlocking users. |
    | Role Management | Adding users to and removing users from roles. |

    Save the role.
  </Step>
</Steps>

## Connect CyberArk Identity to Oleria

<Steps>
  <Step title="Open the integration">
    Sign in to your Oleria workspace, navigate to **Integrations**, and select **CyberArk Identity**.
  </Step>

  <Step title="Complete the connection form">
    | Field | Notes |
    | :- | :- |
    | Identity tenant URL | Required. Your CyberArk-hosted Identity Administration portal address, for example `https://abc1234.id.cyberark.cloud`. Custom domains aren't accepted. |
    | Service user login name | Required. The login name of the service user, for example `oleria-svc@cyberark.cloud.1234`. |
    | Service user password | Required. The service user's password. When you edit the integration later, leave it blank to keep the stored password. |
  </Step>

  <Step title="Authenticate">
    Select **Authenticate** to validate and save the integration. Oleria signs in as the service user and checks that it can read users and roles before saving. If the service user can't read the event log, the integration still connects and syncs users and roles without activity.
  </Step>
</Steps>

## Verify the integration

Confirm the CyberArk Identity instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, review the discovered users, roles, and activity in your Oleria workspace.

## Remediation actions

With the **User Management** and **Role Management** rights, Oleria can take the following actions directly against CyberArk Identity:

| Action | What it does | Revert |
| :- | :- | :- |
| Disable user | Locks the user's account. A locked user can't sign in to CyberArk Identity or to any app that signs in through it. The user's roles are kept. | Supported - unlocks the account. |
| Enable user | Unlocks a locked account. | Supported - locks the account again. |
| Add user to role | Adds the user to a role as a direct member. | Supported - removes the user from the role. |
| Remove user from role | Removes the user's direct membership of a role. | Supported - adds the user back to the role. |

<Note>
  Oleria can't change membership of the **Everybody** role or of dynamic (script) roles, because CyberArk Identity computes their members. A user who belongs to a role only through a nested role or a directory group can't be removed from it with **Remove user from role**.
</Note>

## Known limitations

* **MFA and SSO requirements aren't shown per user.** CyberArk Identity decides MFA per sign-in from authentication profiles and policies, so Oleria reports these as unavailable. MFA challenges still appear as activity.
* **Service users aren't distinguished from people.** CyberArk Identity doesn't expose the **Is Service User** flag in the data Oleria reads, so service users appear as standard users.
* **Directory group membership isn't synced.** Oleria shows which Active Directory, LDAP, or federated groups are members of a role, but not who is in those groups. Connect the source directory to Oleria to see group membership. Administrators who get their rights only through a directory group aren't flagged as administrators.
* **Applications and app assignments aren't synced.** This integration covers identities and roles. The apps assigned to roles, devices, and policies are out of scope.
* **Activity covers the last 90 days.** The first sync reads up to 90 days of events.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.