Identity Provider Integrations

Identity-based attacks — phishing, credential stuffing, MFA fatigue, session hijacking — are the leading initial access vectors in cloud breaches. Identity logs from Okta, Entra ID, and similar systems are often the first signal of a compromise, sometimes hours before endpoint or network indicators appear.

The Okta System Log provides all event types: authentication, user changes, admin actions, and API activity. ManySignal ingests the full Okta System Log via the API. Priority event types for detection include user.authentication.auth_via_mfa_challenge, user.session.start, and system.admin.auth.

Yes. ManySignal monitors Okta, Entra ID, and Duo for repeated MFA denial followed by approval — the MFA fatigue pattern. Alerts fire within 60 seconds of the suspicious approval, and automated session revocation can be configured.

Entra ID sign-in logs include Conditional Access policy evaluation results (applied, failed, not applied). ManySignal detects Conditional Access policy bypass attempts and alerts on authentication events where expected policies were not applied.

Yes. ManySignal's entity graph links identity events (Okta user session) to the device used for authentication (CrowdStrike or SentinelOne device ID). A single compromised identity shows both its authentication anomalies and the endpoint activity during the session.

ManySignal integrates with CyberArk, BeyondTrust, and HashiCorp Vault for privileged access telemetry. CyberArk session recordings and vault access events are correlated with other identity and cloud events.

Yes. ManySignal correlates authentication events across multiple identity providers for the same user. Impossible travel is detected whether the two logins occur in Okta, Entra ID, or any other IdP — the entity graph links them.

ManySignal can trigger Okta or Entra ID account suspension within seconds of a high-confidence verdict. For Okta, the suspend API call is typically acknowledged within 200ms. Session revocation follows immediately.

Yes. Service accounts, OAuth applications, and API keys are first-class entities in ManySignal's entity graph. Anomalous service account behaviour — accessing new resources, operating outside maintenance windows, appearing in new geographies — is detected with the same logic as human identity anomalies.

Start with your primary identity provider (Okta or Entra ID) — this provides the most immediate detection value. Add PAM tools (CyberArk, Vault) second. Then add RADIUS/VPN authentication sources for complete perimeter identity coverage.