Domain audit
Domain audit identifies uncaptured users in an organization. Uncaptured users are Docker users who have authenticated to Docker using an email address associated with one of your verified domains, but they're not a member of your organization in Docker. You can audit domains on organizations that are part of the Docker Business subscription. To upgrade your existing account to a Docker Business subscription, see Upgrade your subscription.
Uncaptured users who access Docker Desktop in your environment may pose a security risk because your organization's security settings, like Image Access Management and Registry Access Management, aren't applied to a user's session. In addition, you won't have visibility into the activity of uncaptured users. You can add uncaptured users to your organization to gain visibility into their activity and apply your organization's security settings.
Domain audit can't identify the following Docker users in your environment:
- Users who access Docker Desktop without authenticating
- Users who authenticate using an account that doesn't have an email address associated with one of your verified domains
Although domain audit can't identify all Docker users in your environment, you can enforce sign-in to prevent unidentifiable users from accessing Docker Desktop in your environment. For more details about enforcing sign-in, see Configure registry.json to enforce sign-in.
Prerequisites
Before you audit your domains, review the following required prerequisites:
- Your organization must be part of a Docker Business subscription. To upgrade your existing account to a Docker Business subscription, see Upgrade your subscription.
- You must add and verify your domains.
Important
Domain audit is not supported for companies or organizations within a company.
Audit your domains for uncaptured users
To audit your domains:
Sign in to Docker Hub.
Select Organizations, your organization, Settings, and then Security.
In Domain Audit, select Export Users to export a CSV file of uncaptured users with the following columns:
- Name: The name of the user.
- Username: The Docker ID of the user.
- Email: The email address of the user.
You can invite all the uncaptured users to your organization using the exported CSV file. For more details, see Invite members. Optionally, enforce single sign-on or enable SCIM to add users to your organization automatically. For more details, see SSO or SCIM.
Note
Domain audit may identify accounts of users who are no longer a part of your organization. If you don't want to add a user to your organization and you don't want the user to appear in future domain audits, you must deactivate the account or update the associated email address.
Only someone with access to the Docker account can deactivate the account or update the associated email address. For more details, see Deactivating an account.
Early Access
The Docker Admin Console is an early access product.
It's available to all company owners and organization owners. You can still manage companies and organizations in Docker Hub, but the Admin Console includes enhanced features for company-level management.
To audit your domains:
Sign in to the Admin Console.
Select your organization in the left navigation drop-down menu, and then select Domain management.
In Domain Audit, select Export Users to export a CSV file of uncaptured users with the following columns:
- Name: The name of the user.
- Username: The Docker ID of the user.
- Email: The email address of the user.
You can invite all the uncaptured users to your organization using the exported CSV file. For more details, see Invite members. Optionally, enforce single sign-on or enable SCIM to add users to your organization automatically. For more details, see SSO or SCIM.
Note
Domain audit may identify accounts of users who are no longer a part of your organization. If you don't want to add a user to your organization and you don't want the user to appear in future domain audits, you must deactivate the account or update the associated email address.
Only someone with access to the Docker account can deactivate the account or update the associated email address. For more details, see Deactivating an account.