The Cloud Identity agent collects user, organizational unit (OU), container, computer, and group attributes from your on-premises Active Directory or OpenLDAP-based directory server and stores them in the Cloud Identity Engine, a secure, cloud-based infrastructure. This allows your Palo Alto Networks cloud-based applications to use the directory attributes to display more context about users and devices and to help you configure user- or group-based policies.