What must be true about the server that hosts the Okta Active Directory agent?

The correct answer indicates that the server hosting the Okta Active Directory agent must be a member of the same Windows domain as the Active Directory users. This requirement is essential because the agent is responsible for facilitating communication and interaction between Okta and the Active Directory environment.

Being a member of the same domain enables the agent to authenticate users and synchronize data effectively. It allows the agent to integrate seamlessly with domain resources, thereby ensuring that it can properly access user attributes and other directory information necessary for identity management. This alignment with the domain is critical for maintaining security protocols and ensuring that the agent can perform its functions without encountering domain-related access issues.

The other choices do not align with the requirements for the Okta Active Directory agent. For example, the agent does not have to be a standalone server, as it can operate on existing servers that meet the necessary prerequisites. Additionally, there is flexibility regarding internet connectivity—while being operationally desirable, it is not a strict requirement that the server always be connected. Lastly, the agent is specifically designed to run on Windows environments rather than Linux, making that option incorrect.