Manage directories

You can add an on-premises directory or a Microsoft Entra ID directory to sync your directory users and groups with IDaaS. Users synced with your Active Directory or Microsoft Entra ID can use their directory password to log in to IDaaS.

note

The Enterprise Service Gateway supports AD, ADLDS, and Radiant Logic directories.

See the following topics:

To sync users and groups from Active Directory server, use Configure an on-premises Active Directory.
To sync users and groups from Microsoft Entra ID, use Configure Microsoft Entra ID.
To sync users and groups from an LDAP directory, see Configure an LDAP directory.
To sync users and groups with an AD Connector, use Configure an AD Connector directory.
To sync users and groups from Microsoft Entra ID, use Integrate Microsoft Entra ID with IDaaS.

Permission requirements

For active directory (AD) sync to succeed, the AD administrator account must have read-only access to the top of the context root. The AD user whose User Name and Password are entered as part of the directory settings in IDaaS must have read-only access to AD.

To authorize IDaaS to access your Microsoft Entra ID, you should use a designated administrator service account. This account must have the Global Administrator role for the configuration of the directory in IDaaS.

For AD Connector, the AD user must have rights to change password on behalf of other users, otherwise password change will not work.

Topics in this section

📄️On-premises Active Directory

You can create an on-premises directory to sync users and groups from your Active Directory to IDaaS.

📄️Microsoft Entra ID directory

You can configure an Microsoft Entra ID directory to manage your users and groups through IDaaS. You can also manage your Microsoft Entra ID password (change or reset) through IDaaS and can use them to log in to IDaaS.

📄️LDAP directory

Configure an LDAP directory to on-board users and groups that are stored in an LDAP directory other than Active Directory. When configured, users can use their LDAP directory password for first-factor authentication.

📄️Directory synchronization

Directory synchronization keeps your IDaaS user directory in sync with your corporate directory (Active Directory, Microsoft Entra ID, LDAP, or AD Connector). When you configure directory synchronization, your corporate directory becomes the source of truth for user information.

📄️Immutable ID mapping

Complete this procedure to map an Identity as a Service custom user attribute to the user's objectGUID value in your directory account. The objectGUID attribute value is imported and applied to the ImmutableID attribute in Identity as a Service through Active Directory Sync. Being able to map the Immutable ID attribute to an objectGUID helps to streamline the configuration of specific SAML applications (such as Office 365) with Identity as a Service.