Connecting Okta Active Directory (AD) Agents to Okta requires specific permissions to avoid activation failures. Creating a custom role and resource set provides the necessary privileges without assigning Super Administrator rights. Without these permissions, Okta may generate the following errors during the AD Agent configuration:

Device not activated

Your device cannot be activated because of an internal error

Failed to poll for a registration token: User is not assigned to the client application

.        

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD) Agent
• Okta Administrator Roles
• Okta Administrator Resource Set

Connecting an Okta AD Agent previously required Super Administrator permissions. Recent updates to administrator roles and resource sets allow this configuration using limited permissions. Errors occur when the administrator account lacks the specific custom role and resource set required to register and manage the AD Agent.

How does an administrator create custom roles and resource sets for Active Directory integrations?

Follow these steps to create a custom role and resource set for the administrator account:

1. In the Okta Admin Console, navigate to Security > Administrators and select Roles.
2. Select Create new role.
3. Enter a role name and an optional description.

4. Select the following permissions:
   • Agents
     • Manage Agents
     • Register Agents
   • Directories
     • Manage application directory integration

5. Select Save role.
6. Select Resources, and then select Create new resource set.

7. Enter a name and description for the new resource set.
8. In the dropdown menu, select Applications, and then choose Select Applications.

9. Search for and select All Active Directory applications.

10. Select Save selection.
11. Select Create.

12. Go to Security > Administrators > Admins, and select Add administrator.

13. In the Select admin field, select the user who requires the custom role.

14. Select the newly created custom role and resource set.
15. Select Save Changes to complete the administrator assignment.