Skip to main content

Identity Threat Detection & Response requirements for OneView

Updated: 

Before configuring Identity Threat Detection & Response (ITDR), review the requirements below to ensure your environment is ready.

ThreatDown Subscription

The ITDR add-on must be enabled on each site you want to monitor.

OneView User Requirements

The OneView Global or Site Admin role is required to access and configure ITDR.

Endpoint Requirements

ITDR requires the Endpoint Agent to be deployed across all endpoints with Endpoint Detection and Response (EDR) enabled. This allows it to capture Active Directory telemetry, identity hooks, and security events from your environment. 

Supported Identity Sources

At least one cloud identity source is required.

Identity Source Requirements
Microsoft Entra ID
  • An Azure Global Administrator or Cloud App Role Administrator account to authorize the following:
    • Read-Write API for MS Graph
    • Read-only API for O365
  • Audit logs enabled in Microsoft Entra ID
Okta

An Okta Super Administrator account to create a dedicated service account and generate an API token. The service account must be assigned the following roles:

  • Read-Only Administrator: Grants access to OKTA System Log and Event Hook data.
  • Organization Administrator: Enables response actions like suspend and forcing MFA enablement.

Back to ITDR Guide

Still have questions?

Support is available via chat, phone or by creating a ticket. You can also use our virtual assistant for guided assistance.

Learn more