Identity / Access Management
Integration setup guides for identity providers and access management platforms.
Connect your identity and access management tools to Zaun for authentication monitoring, MFA visibility, and identity threat detection.
1Password
Category: Secrets & Identity Management | Auth: API Key
Required Credentials
| Field | Description |
|---|---|
| Access Token | From 1Password Connect Server setup |
| Connect Server URL | Your deployed Connect Server endpoint |
Setup Steps
- In 1Password.com > Developer > Infrastructure Secrets > Connect Servers.
- Create a Connect server. This generates credentials and an access token.
- Deploy the Connect server (Docker/K8s). Paste the Access Token and URL into Zaun.
Cisco Duo
Category: Multi-Factor Authentication | Auth: HMAC Auth
Required Credentials
| Field | Description |
|---|---|
| Integration Key (ikey) | API username |
| Secret Key (skey) | HMAC-SHA1 signing key |
| API Hostname | e.g. api-XXXXXXXX.duosecurity.com |
Required Permissions
| Permission | Purpose |
|---|---|
| Grant read information | Account utilization |
| Grant read resource | Users, devices, policies |
| Grant read log | Auth logs, admin logs, telephony logs |
Setup Steps
- In Duo Admin Panel (requires Owner role) > Applications > Application Catalog.
- Search Admin API, click Add.
- Record Integration Key, Secret Key, and API Hostname.
- Check the three read permission boxes above. Click Save.
- Paste into Zaun.
Google Workspace
Category: Email & Directory Security | Auth: OAuth2 / JWT
Required Credentials
| Field | Description |
|---|---|
| Service Account JSON Key | JSON key file from Google Cloud Console |
| Admin Email | Super admin email to impersonate |
Required Scopes (Domain-Wide Delegation)
| Scope | Purpose |
|---|---|
admin.directory.user.readonly | Read user profiles |
admin.directory.group.readonly | Read groups and membership |
admin.directory.device.chromeos.readonly | Chrome OS devices |
admin.directory.device.mobile.readonly | Mobile devices |
admin.reports.audit.readonly | Audit log events |
Setup Steps
- In Google Cloud Console, create a project, enable Admin SDK API & Reports API.
- Create a service account under IAM & Admin. Generate and download the JSON key.
- Copy the service account's Client ID from Advanced settings.
- In Google Admin Console > Security > API controls > Domain-wide Delegation > Add new.
- Paste the Client ID and enter the scopes above (comma-separated).
- Upload the JSON key and Admin Email into Zaun.
Domain-wide delegation changes can take up to 24 hours to propagate.
Microsoft Entra ID
Category: Identity & Directory via Microsoft Graph | Auth: OAuth2 Admin Consent
How It Works
Microsoft Graph uses an OAuth2 Admin Consent flow in the Zaun UI. No manual credential fields - you click a consent button that redirects to Microsoft's login page.
| Tier | License | Data Access |
|---|---|---|
| Business Standard | M365 Business Standard+ | Users, groups, sign-in & audit logs |
| Defender | M365 E3/E5 | Above + security alerts, incidents, advanced hunting |
Setup Steps
- On the Zaun connect page, find Microsoft Graph and select your permission tier.
- Click Grant Admin Consent. Sign in with a Global Administrator account.
- Review permissions and click Accept. You'll be redirected back to Zaun.
No manual credential entry required. Zaun handles token management automatically.
Okta
Category: Identity Provider | Auth: OAuth2 / Private Key JWT
Required Credentials
| Field | Description |
|---|---|
| Okta Domain | e.g. https://yourorg.okta.com |
| Client ID | Generated when creating the service app |
| Private Key | RSA key (JWK JSON or PEM format) |
Required OAuth2 Scopes
| Scope | Purpose |
|---|---|
okta.users.read | User profiles and attributes |
okta.groups.read | Group membership |
okta.logs.read | System Log events |
okta.apps.read | Application assignments |
okta.devices.read | Device inventory |
okta.policies.read | Auth policies |
Setup Steps
- In Okta Admin > Applications > Create App Integration > API Services.
- Name it (e.g.
Zaun MDR). Copy Client ID. - Under Client Credentials, select Public key / Private key. Generate or supply a key pair.
- Download/copy the private key.
- Go to Okta API Scopes tab, grant the scopes above.
- Paste Okta Domain, Client ID, and Private Key into Zaun.
PingOne
Category: Advanced Identity (PingIdentity) | Auth: OAuth2
Required Credentials
| Field | Description |
|---|---|
| Client ID | Worker application client ID |
| Client Secret | Worker application secret |
| Environment ID | PingOne environment identifier |
Setup Steps
- In PingOne admin > Applications > + > select Worker type.
- Ensure Client Credentials grant is checked.
- Assign minimal roles (e.g. Identity Data Admin for user/group access).
- Copy Client ID, Client Secret, and Environment ID. Paste into Zaun.