Vanta Private Integrations – Integrating Active Directory (PowerShell)

With PowerShell being supported on Windows, Linux, Azure Functions, AWS Lambdas, PowerApps. and elsewhere, it is our favorite scripting runtime. It is very easy to integrate with Vanta Private Integrations.

Eric Shoemaker – Advisory CISO – Genius GRC

Private integrations – An Overview

Before you read this post, you should check out our Vanta Private Integrations primer post. It provides relevant resources to build your integration along with helpful tips and some limitations to be aware of.

Combining AD With Vanta Automation

Active Directory Domains are ubiquitous. They’ve been around longer than the internet, and there are very good reasons to maintain them as a primary identity source. Auditors understand what to look for, and securing your joined computers is relatively easy with Group Policy. It just makes sense to be able to integrate AD Users with Vanta. At this point in time (9/15/2023), it’s best used to support entitlement reviews, but we believe that Private Integrations will eventually allow you to leverage AD as a primary identity provider. This post explains how to use the Vanta Private Integrations feature with AD. We even throw in some freebie PowerShell functions to make the integration much easier.

Create a New Application in Vanta

Logon to your Vanta tenant and navigate to Settings -> Developer Console. If this doesn’t exist, you may need to request access to the developer console. Genius GRC managed customers have it enabled automatically.

  • In the Developer Console, click the + Create button at the top right to create the application.
  • Name the application. We leverage the nomenclature. We are going to name it AD – GeniusGRC.com.
  • Set a Description and set the App Visibility to Private.
  • Click Create
  • Select the Application Categories the application supports. As “Identity Provider” is not an option at this time, we will choose Other.
  • Click Generate Client Secret
  • Make note of the OAuth Client ID the generated Client Secret and save it for later. You will need this in your script later on. This is the only time you can copy the Client Secret.
  • Click Save
  • Click the Resources tab.
  • On the Resources tab, click + Create Resource.
  • Name the resource AD Users and set the base resource type to UserAccount.
  • Note the JSON Schema. If you don’t use the PowerShell function provided in this post, you will need to build the UserAccount objects according to this schema.
  • Click Create.
  • Make note of the Resource ID. You will need it later in the script.
  • This completes the Vanta portion of the Private Integration.

PowerShell Freebies. Help for Your Vanta Integration

We’ve created 3 custom functions to make your Vanta integration easier. These format the objects appropriately and sync them to Vanta.

  • Get-VantaOAuthToken
  • New-VantaUserObject
  • Invoke-VantaUserSyncAll

Putting It All Together – Building the AD Sync

We assume you understand Active Directory requirements, so we aren’t going to go into what permissions are required to get the user objects, how to install the RSAT tools, or other AD nuances. Also, we think you probably understand PowerShell, so we aren’t showing how to pull the functions into your script. The script below is used to perform the sync. It just needs to be scheduled to run each hour.

Lines 1-3 and line 8 must be updated to reflect your environment.

Final Thoughts

Hopefully this helps you to integrate your Active Directory environment with Vanta’s Private Integrations both quickly and easily! Happy coding!

More Posts

Getting Started with Vanta’s Private Integrations

“Vanta’s Private Integrations are poised to be a game changer! Finally, all organizations can integrate Vanta’s automated compliance platform with any application in their portfolio regardless of whether it’s hosted in a private cloud, custom developed, or even a SaaS app that is restricted by source IP or doesn’t have

Improving the Audit Experience: Producing Effective Evidence

The best way to make an audit a positive experience for all individuals involved is for the auditee organization to make it as easy as possible for the auditor to draw a positive conclusion from the evidence being presented. This is best accomplished by providing high quality evidence for each

How to Write the Best IT Security Policies

If a policy is wrongheaded feckless and corrupt I take it personally and consider it a moral obligation to sound off and not shut up until it’s fixed. David Hackworth Most people find the topic of IT Security Policies to be about as exciting as a term paper on IT