Configure Your Identity Provider (IdP)

Connect your IdP to SpyCloud Identity Guardian to revoke sessions for users with exposed sessions and reduce the risk of session hijacking and unauthorized account access.

Identity Guardian supports the following identity providers:

• Microsoft Entra ID
• Okta Workforce

Choose your identity provider

Select your IdP to view the setup instructions, required permissions, and credential requirements.

---

Getting Started

To connect Microsoft Entra ID or Okta to SpyCloud Identity Guardian, you'll need to generate credentials and grant the permissions required to identify users and revoke exposed sessions.

Microsoft Entra ID

You'll need three values: Directory (tenant) ID, Application (client) ID, and a client secret.

1. Sign in to the Microsoft Entra admin center.
2. Go to Identity > Applications > App registrations > New registration.
3. Name the application SpyCloud Identity Guardian, select Single tenant, leave Redirect URI empty, and select Register.
4. On the Overview page, copy the Application (client) ID and Directory (tenant) ID.
5. Go to API permissions > Add a permission > Microsoft Graph > Application permissions. Add:
   • User.Read.All – Finds exposed users by User Principal Name (UPN).
   • User.RevokeSessions.All – Revokes users' refresh tokens and session cookies.
6. Select Grant admin consent for your tenant. Confirm both permissions show Granted.
7. Go to Certificates & secrets > Client secrets > New client secret. Choose an expiration period and copy the secret Value (not the Secret ID).

Notes:

• Granting admin consent requires Global Administrator or Privileged Role Administrator access.
• Both permissions must be Application permissions, not Delegated.
• Client secrets expire. Save the expiration date and rotate the secret before it expires.
• Identity Guardian validates User.RevokeSessions.All when saving, but not User.Read.All. Both are required for remediation.

Okta Workforce

You'll need two values: your Okta org host and an Okta Admin API token.

1. Sign in to the Okta Admin Console as a Super Administrator.
2. Create a dedicated admin user for Identity Guardian (recommended), such as [email protected]. API tokens inherit the creating user's permissions.
3. Go to Security > Administrators > Roles > Create new role. Add:
   • View users and their details (okta.users.read) – Finds exposed users by login or email.
   • Clear users' sessions (okta.users.manage.sessions) – Ends Okta sessions and revokes OAuth refresh tokens.
4. Assign the role to the dedicated user with a resource set covering all users you want to protect.
5. Sign in as the dedicated user and go to Security > API > Tokens > Create token.
6. Name the token SpyCloud Identity Guardian and copy its value.
7. Note your Okta org host without https:// or -admin (for example, yourcompany.okta.com).

Notes:

• Okta displays API tokens only once.
• Tokens become inactive after 30 days without use or when the creating user is deactivated.
• Optional: Universal Logout requires Okta Identity Threat Protection and supported applications. See Okta Universal Logout documentation.