> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/frequently-asked-questions.md). # Frequently Asked Questions Answers to common questions about HerdAI, AI Coach, reports, simulations, training tracks, Okta and Azure AD SSO and sync, and Google Workspace allow-listing. ### HerdAI **What is HerdAI?** HerdAI is Herd's built-in conversational AI assistant. You can use it to create trainings, draft phishing simulations, assign content to users and groups, and surface risk insights — all through a chat interface, without clicking through forms. *** **What can I ask HerdAI to do?** HerdAI can generate a complete training from a topic or reference document, build and launch phishing simulations, answer questions about your organization's data (such as completion rates or risk scores), and help with assignments. It respects your permissions, so it can only do what your role and group allow. *** **Does HerdAI follow my permissions?** Yes. HerdAI's available actions are filtered by your permissions. Operators only see and do what their group permissions allow, and Members interact with a more limited assistant experience through Slack or Teams. *** **Can I choose which AI model Herd uses?** Herd's text generation runs on **Herd AI**, Herd's own AI system, and fails over automatically to a backup engine during a provider outage, so there's no vendor to pick. In HerdAI chat, the model selector lets anyone choose a tier per conversation: **Fast**, **Balanced** (the default) or **Complete**. Admins set the organization default under **Settings → General → AI model**, where an **Alternate engine** is offered when your Herd platform has one configured (see [General & Security](/herd-security-docs/settings/settings/general-and-approvals.md#ai-model)). To bill Anthropic usage to your own account instead, see [LLM Providers](/herd-security-docs/settings/settings/llm-providers.md). *** **Can I connect Claude, Cursor, or another AI tool to Herd?** Yes, over MCP. Point the client at `https://api.herdsecurity.io/mcp`; it will open a browser window where you sign in to Herd as usual and approve the connection. The client can then read your reporting and create draft trainings, but it can never publish, assign, or message a learner. See [MCP Server](/herd-security-docs/api-documentation/mcp-server.md). *** ### AI Coach **What is AI Coach?** AI Coach is Herd's AI governance and enablement feature. It scores how effectively your team prompts AI tools like Claude, ChatGPT, and Microsoft Copilot, then turns the results into targeted, friendly coaching. *** **Is AI Coach a performance evaluation of my employees?** No. AI Coach is explicitly a coaching signal, not a performance evaluation. It describes prompting habits, not the person, and the goal is upskilling rather than surveillance. *** **How do I get access to AI Coach?** AI Coach is currently in beta and enabled per organization. If you don't see **AI Coach** in your left-hand navigation, contact your Herd representative to request access. Viewing it requires the AI Coach view permission (`ai_governance.view`). *** ### Reports & Settings **Where did Settings → Monitoring go?** The monitoring views (Logs, Training, Email, Slack, Teams, and Jobs) moved into the Reports hub. Click **Reports** in the sidebar and open the **Activity** tab; the audit log is the **Activity log** section there. Old Settings → Monitoring links redirect automatically. See [Activity & Monitoring](/herd-security-docs/reports/reports/activity-and-monitoring.md). *** **Where did Compliance, Users, and Team Risk go in the sidebar?** They were renamed and regrouped, not removed. **Compliance** is now **Campaigns** under **Manage** (same page, same link). **Users** is now **People**, which expands into **Directory** and **Groups**. **Team Risk** is **Intelligence › Team risk** under **Risk**, alongside **User risk** and **Risk score**. Announcements and the reminders page for work outside Herd are grouped under **Messaging**. Old links redirect. See [Finding your way around](/herd-security-docs/getting-started/quickstart.md#finding-your-way-around). *** **How do I switch between light and dark mode?** Use the sun/moon icon in the Dashboard header. It opens a menu with **Light**, **Dark**, and **System**. Theme is a personal, per-device choice, so it's no longer a tile in Settings. *** **Why did a digest or reminder arrive at 9 AM Pacific when we never set business hours?** Herd's automatic sends (scheduled training reminders, compliance auto-nudges, and subscription digests) never go out outside a working window. When your organization's business hours are switched off, they use a platform default of 9 AM to 5 PM Pacific Time on weekdays. Turn on **Business hours** under **Settings** to use your own window and timezone instead. Anything you send manually still goes out immediately. *** **A toast says a new version of Herd is available. Do I have to reload?** No. Herd never reloads a tab on its own, so nothing you're editing is lost. Click **Reload** when you're ready, or dismiss the toast and it will offer again later; navigating to another page picks up the new version on its own. *** ### Simulations **What types of simulations does Herd support?** Herd supports phishing (email) and smishing (SMS) simulation campaigns, plus a hands-on voice deepfake exercise (AI voice cloning) delivered as a step inside trainings, and training videos presented by an AI likeness of your own executives ([Custom Avatars and Voices](/herd-security-docs/trainings/getting-started-with-trainings/custom-likenesses.md)) — so you can test how employees respond to social engineering across multiple channels. *** **Will simulations land in employees' inboxes?** To ensure delivery, you should allowlist Herd's sending domains in your email environment. See the allowlisting guides for Google Workspace and Microsoft 365. Herd sends from a pool of verified domains, each styled to impersonate a familiar brand. *** **What happens when an employee falls for a simulation?** Herd can deliver just-in-time training the moment a user clicks a link, submits credentials on a landing page, or otherwise interacts with a simulation. Results — open rate, click rate, and report rate — feed into reporting and individual risk scores. *** ### Okta SSO **Is Herd available as a pre-built app in the Okta marketplace?** No. The Herd application is not available in the Okta marketplace, so you'll need to set up Herd as a custom app integration directly in your Okta admin console. *** **Which sign-in method and application type should I use for Herd in Okta?** When creating the app integration, select **OIDC – OpenID Connect** as the sign-in method and choose **Web Application** as the application type. Name it something like "Herd" or "Herd Security" so it's easy for admins to recognize later. Keep the **Authorization Code** grant type, let Okta generate the client ID and secret, and leave **Require PKCE as additional verification** unchecked. Herd does not offer SAML. *** **Who should be assigned to the Herd Okta application?** Only the people who should use the Herd **dashboard** — your security team, admins and reviewers — plus yourself, so you can run the test sign-in. Once SSO is on, only people assigned to the app in Okta can sign in, so check the assignment covers every administrator and operator who needs the dashboard. Under the original **Everyone who signs in** [app-access policy](/herd-security-docs/users/users/app-access.md), which organizations set up before October 2026 may still be on, don't assign the whole company: anyone who signs in to the web app is promoted to **Operator** and added to the group new operators join, which starts out as **Full Access**, so assigning everyone hands **full admin** access to everyone, including managing admins, permissions and single sign-on. Assign only the people who should be admins. Under **Only people an admin adds** (or with Okta marking operators by group), people who aren't operators sign in as learners and see only their own training; see [Let People Reach Their Training from My Apps](/herd-security-docs/users/users/let-people-reach-training-from-my-apps.md). To bring your workforce into Herd for training, use [Okta Group & App Sync](/herd-security-docs/okta/okta-group-and-app-sync.md), a separate integration that brings people in as learners with no dashboard access. *** **Does assigning someone to the Okta SSO app add them to Herd?** No. SSO only handles sign-in. A person appears in Herd the first time they actually sign in through Okta, and unassigning or removing them in Okta does not remove them from Herd. When someone leaves, deactivate them in Okta and remove them in Herd. *** **Do I need Herd's help to set up Okta SSO?** No. An administrator with the **Manage permissions** permission sets it up from **Settings → General → Access → Sign-in**: create the app in Okta, enter its issuer, client ID and client secret in Herd, run a test sign-in, then turn SSO on. The client secret goes straight into Herd, where it is stored encrypted. See [Okta Single Sign-On](/herd-security-docs/okta/okta-single-sign-on.md). *** **What redirect URLs should I configure in Okta for Herd?** Copy them from the **Single sign-on** card in Herd, which shows the **Sign-in redirect URI**, the **Sign-out redirect URI** and the **Herd app URL (initiate login URI)** for your organization, each with a copy button. Don't type them by hand: the sign-in redirect URI is specific to your organization and deployment region. *** **Will setting up Okta SSO change how my users sign in before I'm ready?** No. Nothing changes until you click **Turn on SSO**, and Herd only lets you do that after you've passed a test sign-in through Okta yourself within the last hour. *** ### Okta Group & App Sync **What does Okta group sync do in Herd?** Okta group sync pulls your existing groups from your Okta tenant into Herd and automatically attaches those groups to their respective users. This lets you assign trainings, campaigns, events, and stacks to groups instead of managing assignments at the individual-user level. *** **What permissions are required on the Okta API token for group and app sync?** You'll need an Okta API token with the following scopes: * **Group Sync:** `okta.users.read`, `okta.groups.read`, and `okta.roles.read` * **App Sync:** `okta.apps.read` These permissions allow Herd to read users, groups, roles, and apps from your Okta tenant. *** **How do I find and share my Okta domain with Herd?** Your Okta domain is visible in the browser URL when you're logged into the Okta admin console and is typically formatted as `company-url.okta.com`. Copy that domain and enter it into the Okta domain field in the Herd Okta Configuration Settings, along with your Okta API token. *** **Where do I enter my Okta domain and API token in Herd?** In the Herd admin console, go to **Settings**, then under **Okta Integration**, open **Okta Configuration Settings**. Enter your Okta domain in the first box and your Okta API token in the second box, then click **Save Configuration**. *** **How do I start syncing Okta groups and apps into Herd?** Once your Okta domain and API token are saved in Herd, click **Sync groups** to pull group information from Okta into Herd. Groups will automatically be attached to the corresponding users. To enable the Security Advisor feature, you should also sync apps so Herd can see which applications users are assigned to in Okta. *** ### Azure AD SSO **How does Herd's Azure AD SSO architecture work?** Herd uses AWS Cognito as the identity broker, which federates to Azure AD for authentication. The flow is: > User → Herd App → AWS Cognito → Azure AD → User Authenticated This lets users sign in with their existing Azure AD credentials while Herd delegates authentication to Azure AD through Cognito. *** **Do I need a separate app registration for Azure AD SSO and Azure AD User Sync?** Yes. The SSO app registration is separate from the User Sync app registration. SSO requires different redirect URIs, token configuration, and delegated permissions than the read-only app used for syncing users and groups. *** **Which IDs and secrets do I need from Azure AD for SSO?** From your Azure AD SSO app registration, you must capture: * **Application (client) ID** * **Directory (tenant) ID** * A **Client Secret** (the secret *Value*, not the Secret ID) Copy the secret value immediately after creating it, because Azure AD will not show it again. *** **Why might I see "Invalid client secret provided" during SSO setup?** This error typically occurs when the **Secret ID** was copied instead of the secret **Value** when you created the client secret. To fix it, create a new client secret in Azure AD, copy the **Value** column, and update the secret in AWS Cognito under your Azure AD identity provider settings. *** **What should I check if users can't sign in via Azure AD SSO or are not being created in Herd?** If users see "User not found / Cannot create user," it usually means the user doesn't exist in Herd and couldn't be auto-created. Make sure you: * Run **Azure AD User Sync** first to import users into Herd, or * Verify that Azure AD is configured to include the **email claim** in ID tokens so Herd can create and match users based on their email address. *** ### Azure AD User & Group Sync **What does Azure AD user and group sync do in Herd?** Azure AD sync connects Herd to your Azure Active Directory so Herd can automatically pull in users and groups from your tenant. This keeps your Herd roster aligned with your directory, reduces manual user management, and helps you keep onboarding and off-boarding clean and consistent. *** **Which Microsoft Graph permissions does the Azure AD sync app need?** In the Azure AD app registration used for sync, you must add the following **Application** permissions for Microsoft Graph: * `Directory.Read.All` – Read directory data * `User.Read.All` – Read all users * `Group.Read.All` – Read all groups * `GroupMember.Read.All` – Read group memberships After adding them, you must click **Grant admin consent** for your organization. *** **What values do I need to configure Azure AD sync in Herd?** From the Azure AD app registration you created for sync, you'll need: * **Tenant ID** (Directory tenant ID) * **Client ID** (Application client ID) * **Client Secret** (the secret Value you created) In Herd, go to **Settings**, find the **Azure AD** section, enter these values, click **Test Connection**, and if successful, click **Save**. *** **What does a 403 Forbidden error mean when testing the Azure AD sync connection?** A 403 Forbidden error usually means that required permissions are missing or admin consent has not been granted. Check that all four Microsoft Graph Application permissions are present, confirm they show a green checkmark after **Grant admin consent**, wait 5–10 minutes for changes to propagate, and then retry the connection test. *** **Can the Azure AD sync app modify or delete anything in my directory?** No. The app registration for Azure AD sync is configured with read-only permissions (`Directory.Read.All`, `User.Read.All`, `Group.Read.All`, `GroupMember.Read.All`). It can read users, groups, and memberships to sync them into Herd, but it cannot modify or delete objects in your Azure AD tenant. *** ### Training Tracks **Can a user be on multiple tracks at the same time?** Yes. A user can be assigned to as many tracks as needed. Each track runs its cadence independently. *** **What happens if I change the cadence after assigning users?** The cadence is snapshotted at assignment time. Existing assignments are unaffected. To change the cadence for existing users, remove them from the track and re-assign with the new settings. *** **Can I reorder trainings after users have started?** Yes. Reordering only affects trainings the user hasn't received yet. Their current in-progress training is not changed. *** **What if a user completes a training before the next cadence window?** Herd queues the next training at the scheduled time regardless. Completing early doesn't move the next delivery date up — unless Catch-Up is enabled and the threshold is exceeded. *** **Can I export completion data?** Yes. From the **Assignment** tab, use **Export** to download a CSV of user progress for the track. ### Allowlisting email domains – Google Workspace **1. Who should use this allowlisting method in Google Workspace?**\ This method is for **Google Workspace administrators** who have permission to manage Gmail settings at the admin console level. It’s intended for org-wide configuration, not for individual end users changing their own Gmail settings. **2. Which Herd-related domains should I allowlist?**\ Herd sends simulations from a pool of verified domains, each styled to impersonate a familiar brand (the generic `x7k2m.net` is used when a simulation isn't brand-specific). Allowlist the domains relevant to your organization — see the full list under [Allowlisting Email Domains → Herd sending domains](/herd-security-docs/simulations/phishing-simulations/allowlisting-email-domains.md#herd-sending-domains). The username portion can vary; allowlisting the **domain** covers every address on it. Herd adds new domains over time, so confirm the current set with your Herd representative. **3. Where do I go in the Admin console to find the email allowlist?**\ From `https://admin.google.com`, sign in with your admin account, then go to:\ Apps → Google Workspace → Gmail → **Spam, phishing and malware** (or **Security**, depending on your UI).\ There you’ll find the **Email allowlist / Approved senders**-type setting where you can add trusted domains and addresses. **4. Should I add a full domain or specific email addresses to the allowlist?**\ You can add either: * A full domain (for example, `herdsecurity.io`) to allow all senders from that domain, or * A specific address (for example, `notifications@service.com`) if you only want to trust one sender. The page recommends adding the **domains** you use for simulations so that all emails from those domains bypass spam filtering. **5. How long do allowlist changes take to apply to my users?**\ After you save your changes in the Gmail allowlist settings and confirm the organizational units they apply to, it can take **several minutes** for the new policy to propagate across all user accounts. You may need to wait a short time before testing delivery with real messages.