← Course Home
Okta Certified Administrator · Part I

Identity and Access Management

36% of the exam — the single largest domain.

Identity & Access Management

Module 1: Active Directory Integration

6 sub-topics · this deck covers sub-topic 2 of 6

← Back to Sub 1: Delegated Authentication ↑ Module 1 Overview

The Exam Bullet

"Demonstrate understanding of Okta AD and LDAP agent architecture and best practices"

The Okta Agent is the piece of software that actually sits inside the customer's network and talks to Active Directory or LDAP on Okta's behalf. This sub-topic isn't about installing it once — it's about designing that bridge so it stays reliable, and knowing the exact network requirements it depends on.

The Mechanism

The agent acts as a bridge between Okta's cloud and the customer's real Active Directory. It imports users from AD into Okta, and it can push provisioning changes back the other direction, writing updates from Okta into AD.

A single agent can be registered to handle multiple domains at once, and AD can optionally be designated as the authoritative profile source for those users.

The Best Practice — High Availability

Install two or more agents per domain, and put them on separate physical servers — not consolidated onto one box. That's the actual minimum for failover protection, not just a nice-to-have.

This is the same fragility we already saw in Submodule 1: delegated authentication depends entirely on agent availability. Too few agents means the exact same queue-and-bottleneck problem, whether the login is a normal sign-in or a delegated-auth request.

The Best Practice — Health Monitoring

Admins don't have to guess whether an agent is working. In the Admin Console dashboard, a green circle next to the agent's name means it's connected and healthy right now.

That single visual check is the fast way to confirm the HA setup above is actually functioning, not just installed.

The Gotcha — DMZ Ports (Core Directory & Auth)

If the agent is deployed on a server sitting in the DMZ, it needs a specific set of ports opened to reach the domain controller. Miss one, and something in the AD integration quietly breaks.

DNS — 53 (TCP/UDP)
Kerberos — 88 (TCP/UDP)
NTP (time sync) — 123 (UDP)
LDAP — 389 (TCP/UDP)
LDAP over SSL — 636 (TCP)
LDAP Global Catalog — 3268 (TCP)
LDAP GC SSL — 3269 (TCP)

The Gotcha — DMZ Ports (RPC & SMB Range)

RPC Endpoint Mapper — 135 (TCP)
NetBIOS — 137-139 (UDP/TCP)
SMB — 445 (TCP)
Kerberos password change — 464 (TCP/UDP)
Dynamic RPC range — 49152-65535 (TCP)

This range is the part almost everyone misses. Port 135's Endpoint Mapper doesn't do the work itself — it just tells the RPC client which dynamic port was assigned for the actual conversation. If that high port range (49152-65535) isn't open, the agent can still reach 135 fine, but the real communication silently fails anyway.

The Exam Angle

Watch for scenario questions built around these exact traps:

→ "One agent is configured for the entire domain, no backup." = HA best-practice violation.

→ "Agent shows healthy, but user imports and provisioning fail from a DMZ deployment." = missing the dynamic RPC port range.

→ "How do you confirm an agent is actually working?" = the green circle in the dashboard.

One Line To Remember

The agent is the bridge: imports users, pushes provisioning back, can span multiple domains, and can be AD's profile-source. Run 2+ agents per domain on separate servers for HA — green circle means healthy. In a DMZ, open DNS/Kerberos/NTP/LDAP plus the full RPC+SMB set, especially the 49152-65535 dynamic range — that's the one everyone forgets.

Sources: help.okta.com — ad-agent-install-multiple.htm · ad-agent-manage-integration.htm · ad-agent-install-dmzports.htm