Identity provider (IdP) integrations are among the most impactful connections in LowerPlane. They provide evidence for access control, authentication, and user lifecycle management — requirements that span every compliance framework.

​
Supported Identity Providers

​
What Data Is Collected

LowerPlane syncs your full user directory from the identity provider:
  • Full name, email address, and username
  • Department and job title (if available)
  • Account status (active, suspended, deactivated)
  • Creation date and last login time
  • Assigned groups and roles
  • Licensed applications and SSO assignments

​
How Identity Data Maps to Compliance

Identity provider data directly addresses critical controls across every framework:

​
Automated Tests from Identity Providers

When an identity provider is connected, LowerPlane automatically creates and runs these tests:
  • MFA enrolled for all users — Verifies every active user has at least one MFA factor registered.
  • No inactive accounts — Flags accounts that have not logged in within a configurable period (default: 90 days).
  • SSO enforced for critical applications — Checks that key applications are accessed through SSO rather than local credentials.
  • Admin accounts use strong MFA — Verifies privileged accounts use hardware keys or authenticator apps, not SMS.
  • Deactivated users have no active sessions — Confirms terminated employee accounts are fully deprovisioned.
  • Password policy meets requirements — Validates minimum length, complexity, and rotation requirements.
The “MFA enrolled for all users” test is one of the most frequently requested evidence items by auditors. Connecting your identity provider automates this check entirely.

​
People Directory Integration

Identity provider data syncs into the People directory alongside HR data. When both an HR system and identity provider are connected:
  1. HR system provides employment data (name, department, start/end date, status).
  2. Identity provider provides access data (MFA status, account status, last login).
  3. LowerPlane matches records by email address.
  4. The combined record gives you a complete compliance view per employee.
This merged data powers:
  • Access reviews: Compare active employees to active accounts and flag mismatches.
  • Offboarding verification: Confirm terminated employees have deactivated accounts.
  • MFA compliance: Track MFA enrollment rates across the organization.

​
Connection Guides

  1. In Okta Admin Console, go to Security > API > Tokens.
  2. Create a new token with a descriptive name (e.g., “LowerPlane Read-Only”).
  3. Copy the token value immediately — it is only shown once.
  4. In LowerPlane, navigate to Integrations > Okta and paste the token.
  5. Enter your Okta domain (e.g., yourcompany.okta.com).
  6. Click Connect to verify and begin the initial sync.
  1. In LowerPlane, navigate to Integrations > Google Workspace and click Connect.
  2. You will be redirected to Google’s OAuth consent screen.
  3. Sign in with a Google Workspace super admin account.
  4. Grant the requested permissions (read-only access to directory, reports, and admin settings).
  5. After authorization, you are redirected back to LowerPlane and the sync begins.
  1. In the Azure Portal, register a new application under App registrations.
  2. Grant the following API permissions: User.Read.All, Group.Read.All, Directory.Read.All, AuditLog.Read.All.
  3. Create a client secret and note the Application (client) ID and Directory (tenant) ID.
  4. In LowerPlane, navigate to Integrations > Azure Active Directory.
  5. Enter the tenant ID, client ID, and client secret.
  6. Click Connect to verify credentials and start syncing.
Identity provider integrations often contain sensitive access data. Ensure that only authorized administrators can view integration configurations and sync results within LowerPlane. Use role-based access to restrict visibility.

​
Troubleshooting