Domain audit

Note

Domain audit is currently in Early Access.

Domain audit identifies uncaptured users. Uncaptured users are Docker users who have authenticated to Docker using an email address associated with one of your verified domains, but they’re not a member of your organization in Docker. You can audit domains on organizations that are part of the Docker Business subscription. To upgrade your existing account to a Docker Business subscription, see Upgrade your subscription.

Uncaptured users who access Docker Desktop in your environment may pose a security risk because your organization’s security settings, like Image Access Management and Registry Access Management, aren’t applied to a user’s session. In addition, you won’t have visibility into the activity of uncaptured users. You can add uncaptured users to your organization to gain visibility into their activity and apply your organization’s security settings.

Domain audit can’t identify the following Docker users in your environment:

  • Users who access Docker Desktop without authenticating
  • Users who authenticate using an account that doesn’t have an email address associated with one of your verified domains

Although domain audit can’t identify all Docker users in your environment, you can enforce sign-in to prevent unidentifiable users from accessing Docker Desktop in your environment. For more details about enforcing sign-in, see Configure registry.json to enforce sign-in.

Audit your domains for uncaptured users

Before you audit your domains, the following prerequisites are required:

  • Your organization must be part of a Docker Business subscription. To upgrade your existing account to a Docker Business subscription, see Upgrade your subscription.
  • Single sign-on must be configured for your organization. To configure single sign-on, see Configure Single Sign-on.
  • You must add and verify your domains. To add and verify a domain, see Domain control.

To audit your domains:

  1. Sign in to Docker Hub as an owner of your organization.

  2. Select Organizations and then select your organization.

  3. Select Settings and then select Security.

  4. In Domain Audit, select Export Users to export a CSV file of uncaptured users with the following columns:

    • Name: The name of the user.
    • Username: The Docker ID of the user.
    • Email: The email address of the user.

You can invite all the uncaptured users to your organization using the exported CSV file. For more details, see Invite members via CSV file. Optionally, enforce single sign-on or enable SCIM to add users to your organization automatically. For more details, see Single Sign-on or SCIM.

Note

Domain audit may identify accounts of users who are no longer a part of your organization. If you don’t want to add a user to your organization and you don’t want the user to appear in future domain audits, you must deactivate the account or update the associated email address.

Only someone with access to the Docker account can deactivate the account or update the associated email address. For more details, see Deactivating an account.

If you don’t have access to the account, you can contact Docker support to discover if more options are available.