---
title: "Identities"
slug: "identities"
updated: 2026-09-08T20:25:35Z
published: 2026-09-09T16:09:43Z
canonical: "docs.redcanary.com/identities"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identities

Once your Zscaler MDR account is activated, you can begin collecting identity telemetry. Identity telemetry is some of the most valuable data for your security program because users pose a distinct risk and are frequently involved in threats. Zscaler MDR receives this data from your Identity Provider.

## Integrate with an identity provider

Today, Zscaler MDR supports Okta Workforce Identity.

For more information about integrating Okta Workforce Identity with Zscaler MDR, see [Integrate Okta Workforce Identity with Zscaler MDR](/doc/docs/integrate-okta-workforce-identity-with-red-canary).

## Verify your integration

To verify that the integration is working correctly, review your Zscaler MDR dashboard and scroll down to the Telemetry and Alerts section. Review your telemetry and alerts recorded from your Okta integration.

For more information, see [How Identity Licensing and Usage are Determined](/doc/docs/mdr-identities-licensing-how-licensing-and-usage-are-determined).

## Where do identities come from?

Identities are collected from several data types processed by Zscaler MDR, such as telemetry collected from your endpoints and alerts collected from your other security products.

## How are identities classified?

Endpoint identities are classified as either **local** or **domain** identities. Identities are classified as **domain** identities if they contain a domain prefix (domain\\username on Windows) and that domain is not that of a known endpoint’s hostname.

Endpoint identities are also classified as **system accounts** if they are identities commonly used by operating systems as system accounts—for example, *s-1-5-18* (Local System on Windows) or *_coreaudiod* on macOS.

## What tags are automatically applied to identities?

Zscaler MDR automatically applies several tags to identities as they are created and updated:

- **Local Account** is set to **true** if the account appears to be a local (non-domain) account.
- **Domain Account** is set to **true** if the account appears to be a domain account.
- **System Account** is set to **true** if the account appears to be one commonly used by operating systems as system accounts.