Connecting CyberArk to Drata allows personnel to be synchronized into Drata and to provision accounts for each. This is one of the first connection/integration that should be completed as it will allow for the compliance monitoring of your company's personnel.
BEFORE DIVING IN
The email domain of the account connecting the IdP must match each of the personnel’s email domains that you would like to sync. Personnel with different domains or multiple domains are not synced.
If you need to sync multiple email domains, please reach out to our Technical Support team.
For individuals who has SSO configured:
If your Drata tenant has previously connected to CyberArk using our Enterprise Single Sign-On (SSO) connection, you can maintain that connection.
For individuals who are using Privileged Access Manager:
Drata can monitor who has enabled Multi-Factor Authentication MFA and also automate Test 86 (MFA on Identity Provider test).
Initial setup and connection details
Note: There is a delay between the initial connection and the first import of accounts. At the longest, this should take no more than one hour for individuals who are syncing hundreds of accounts.
There are three parts to the CyberArk integration:
Connect CyberArk as an Identity Provider: Sync personnel into Drata by opening the Drata connection drawer and entering the necessary connection details
Connect CyberArk as an Enterprise SSO Provider: Allow personnel to use single sign-on (SSO) to access Drata.
Limit the Scope for Drata (Optional): Limit the synchronization to a specific subset of personnel.
Connect CyberArk as an Identity Provider
Select Connections from the left-side navigation menu.
Select the Available connections tab and then search for CyberArk. Then, select the connect button.
Follow the instructions in the connection drawer carefully.
Enable the permission level Read all users in the modal. Paste the required values in each field as indicated.
Connect CyberArk as an Enterprise SSO Provider
If you did not connect the Enterprise Single Sign-on connection, after connecting CyberArk, the following banner is displayed:
If Enterprise SSO connection is not connected, only administrators will be able to log in to Drata with magic link functionality.
To connect Enterprise SSO, on the Connections page navigate to Enterprise Single Sign-On connection filter.
Limit the Scope for Drata (Optional)
Note: Drata does not support nested groups. We will sync members in the top level of the specified group, but not individual members in second-level or further groups.
After establishing the connection, you can optionally limit the synchronization to a specific group of individuals by following these steps:
Select the small edit icon to the far right of Setup details.
Designate a CyberArk Role to sync with. Make sure this group includes the Drata administrator as well. You may want to navigate to the CyberArk role page, which will have a URL of the form:
{domain}.id.cyberark.cloud/admin#/RoleList/RoleDetails
Note for Designate a CyberArk Role to sync with:
If an extra character is typed when specifying a CyberArk group, the sync will not match the group name to a CyberArk Group and will default to synchronizing all users for that account.
If the Administrator makes an edit to the connection (to fix the typo), the next sync will change the personnel list based on the new group. This will designate any personnel not in that group as a Former Employee to show they are now out of scope.