Identity / Access Management
Integration setup guides for identity providers and access management platforms.
Connect your identity and access management tools to Zaun. Ember watches authentication, MFA, and identity threats; Reagent governs the OAuth grants your people hand to AI tools.
1Password
Category: Secrets & Identity Management | Auth: API Key
Required Credentials
| Field | Description |
|---|---|
| Access Token | From 1Password Connect Server setup |
| Connect Server URL | Your deployed Connect Server endpoint |
Setup Steps
- In 1Password.com > Developer > Infrastructure Secrets > Connect Servers.
- Create a Connect server. This generates credentials and an access token.
- Deploy the Connect server (Docker/K8s). Paste the Access Token and URL into Zaun.
Cisco Duo
Category: Multi-Factor Authentication | Auth: HMAC Auth
Required Credentials
| Field | Description |
|---|---|
| Integration Key (ikey) | API username |
| Secret Key (skey) | HMAC-SHA1 signing key |
| API Hostname | e.g. api-XXXXXXXX.duosecurity.com |
Required Permissions
| Permission | Purpose |
|---|---|
| Grant read information | Account utilization |
| Grant read resource | Users, devices, policies |
| Grant read log | Auth logs, admin logs, telephony logs |
Setup Steps
- In Duo Admin Panel (requires Owner role) > Applications > Application Catalog.
- Search Admin API, click Add.
- Record Integration Key, Secret Key, and API Hostname.
- Check the three read permission boxes above. Click Save.
- Paste into Zaun.
Google Workspace
Category: Email & Directory Security | Auth: OAuth2 / JWT
Required Credentials
| Field | Description |
|---|---|
| Service Account JSON Key | JSON key file from Google Cloud Console |
| Admin Email | Super admin email to impersonate |
Required Scopes (Domain-Wide Delegation)
| Scope | Purpose |
|---|---|
admin.directory.user.readonly | Read user profiles |
admin.directory.group.readonly | Read groups and membership |
admin.directory.device.chromeos.readonly | Chrome OS devices |
admin.directory.device.mobile.readonly | Mobile devices |
admin.reports.audit.readonly | Audit log events |
Setup Steps
- In Google Cloud Console, create a project, enable Admin SDK API & Reports API.
- Create a service account under IAM & Admin. Generate and download the JSON key.
- Copy the service account's Client ID from Advanced settings.
- In Google Admin Console > Security > API controls > Domain-wide Delegation > Add new.
- Paste the Client ID and enter the scopes above (comma-separated).
- Upload the JSON key and Admin Email into Zaun.
Domain-wide delegation changes can take up to 24 hours to propagate.
Microsoft Entra ID
Category: Identity & Directory via Microsoft Graph | Auth: OAuth2 Admin Consent
How It Works
Microsoft Graph uses an OAuth2 Admin Consent flow in the Zaun UI. No manual credential fields - you click a consent button that redirects to Microsoft's login page.
| Tier | License | Data Access |
|---|---|---|
| Business Standard | M365 Business Standard+ | Users, groups, sign-in & audit logs |
| Defender | M365 E3/E5 | Above + security alerts, incidents, advanced hunting |
Setup Steps
- On the Zaun connect page, find Microsoft Graph and select your permission tier.
- Click Grant Admin Consent. Sign in with a Global Administrator account.
- Review permissions and click Accept. You'll be redirected back to Zaun.
No manual credential entry required. Zaun handles token management automatically.
Okta
Category: Identity Provider | Auth: OAuth2 / Private Key JWT
Required Credentials
| Field | Description |
|---|---|
| Okta Domain | e.g. https://yourorg.okta.com |
| Client ID | Generated when creating the service app |
| Private Key | RSA key (JWK JSON or PEM format) |
Required OAuth2 Scopes
| Scope | Purpose |
|---|---|
okta.users.read | User profiles and attributes |
okta.groups.read | Group membership |
okta.logs.read | System Log events |
okta.apps.read | Application assignments |
okta.devices.read | Device inventory |
okta.policies.read | Auth policies |
Setup Steps
- In Okta Admin > Applications > Create App Integration > API Services.
- Name it (e.g.
Zaun Ember). Copy Client ID. - Under Client Credentials, select Public key / Private key. Generate or supply a key pair.
- Download/copy the private key.
- Go to Okta API Scopes tab, grant the scopes above.
- Paste Okta Domain, Client ID, and Private Key into Zaun.
PingOne
Category: Advanced Identity (PingIdentity) | Auth: OAuth2
Required Credentials
| Field | Description |
|---|---|
| Client ID | Worker application client ID |
| Client Secret | Worker application secret |
| Environment ID | PingOne environment identifier |
Setup Steps
- In PingOne admin > Applications > + > select Worker type.
- Ensure Client Credentials grant is checked.
- Assign minimal roles (e.g. Identity Data Admin for user/group access).
- Copy Client ID, Client Secret, and Environment ID. Paste into Zaun.