xAI has released documentation outlining how administrators can configure identity and access for Grok Bot, specifically for those using Okta or Microsoft Entra ID as their identity provider (IdP). This guidance addresses two primary scenarios: enabling non-engineering personnel to access Grok Bot via their Cursor team and allowing users to sign in to IdP-provisioned applications from the Bot's hosted computer.
Grok Bot operates through a persistent cloud computer, which can utilize a browser, command line, files, and connected tools. This cloud computer is assigned to a user's account, not an individual Bot, and is shared among all Bots on that account. Browser cookies and signed-in sessions are also shared across Bots.
Key Points
- Grok Bot access requires users to be members of a Cursor team, leveraging existing Cursor single sign-on (SSO).
- Cursor SSO supports SAML 2.0 and integrates with Okta, Microsoft Entra ID, Google Workspace, and OneLogin.
- The guidance focuses on Okta and Microsoft Entra ID due to common device-trust policy considerations.
- No separate Grok Bot application is needed in Okta or Entra ID; all configurations occur within the existing Cursor app.
- For SCIM users on the Enterprise plan, provisioning is SCIM 2.0, and deprovisioning is automatic upon user removal from the IdP.
- Inside the hosted computer, users sign in to applications via their own IdP in the browser, with sessions governed by their session policies.
- The hosted computer runs Linux, is not enrolled in mobile device management (MDM), and does not support device-trust agents like Okta FastPass.
Context
According to xAI, the configuration involves two distinct changes: one for Grok Bot sign-in and another for IdP-provisioned app sign-in within the Bot's computer. Only the first change controls Grok Bot sign-in, and the second does not block it or apply to plugin authentication. The Grok Bot's cloud computer is separate from a user's local machine, and it can run commands on the local computer only if explicitly enabled and approved under a local-computer policy.
Why It Matters
This guidance helps administrators manage access to Grok Bot and its associated cloud computing environment, ensuring that security policies, particularly those related to device trust and single sign-on, are correctly applied without disrupting broader organizational security postures. It clarifies how existing identity infrastructure can be leveraged for Grok Bot access.
What To Do
- Review the xAI Docs on "Configure identity and access" for detailed steps on adjusting Okta or Microsoft Entra ID settings.
- Note that device-trust policies requiring FastPass or managed devices will fail within the Grok Bot's Linux-based computer browser and require specific rule adjustments.
- Compare the guidance for Okta Identity Engine and Microsoft Entra ID to understand platform-specific configurations for device platforms and authentication strengths.
- Watch for updates regarding Grok Bot security and rollout steps in the "Grok Bot security" and "Grok Bot for teams and enterprises" documentation.