> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure Microsoft Entra ID to support LDAP

This section describes how to connect Microsoft Entra ID Directory (AD) using LDAP. Before you begin, ensure that you have completed the prerequisites described in [Integrate Microsoft Entra ID with Identity as a Service](/docs/directories-and-provisioning/manage-directories/integrate-microsoft-entra-id-with-identity-as-a-service.md).

## Step 1: Prerequisites

Before you begin, ensure that you have the following:

- A valid Microsoft Entra ID subscription
- A Microsoft Entra ID directory synchronized with an on-premises directory or a cloud-only directory
- Microsoft Entra ID Domain Services enabled (see [Microsoft Create and configure a Microsoft Enter Domain Services managed domain](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-create-instance))
- A certificate for secure LDAP to the managed domain (see [Configure secure LDAP for a Microsoft Entra Domain Services managed domain).](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-ldaps)

## Step 2: Export the secure LDAP certificate

You need to export the certificate in both .PFX **and** .CER **formats.** The .PFX format is used in Microsoft Entra ID and the .CER format is used in Identity as a Service. Use one of the following procedures:

### Export the secure LDAP certificate in .PFX format

1. Go to the **Start** menu on your computer and click **Run**.

2. Enter mmc in the Run window and click **OK**.

3. Click **Yes** when prompted to accept changes to your computer. The **Microsoft Management Console** window appears.

4. Go to **File > Add/Remove Snap-in...** The **Add or Remove Snap-ins** dialog box appears.

5. Click **Certificates** under **Available Snap-in**.

6. Click **Add**. A **Certificates snap-in** dialog box appears.

7. Select **My user account**.

8. Click **Finish**. The **Certificates Snap-in** is added to the list of **Selected snap-ins**.

9. Select **Certificates - Current User** and click **OK** to add the certificates snap-in to MMC.

   You are returned to the Console dialog box and **Certificates - Current User** is added to the Console dialog box.

10. Under **Console Root** expand **Certificates - Current User > Personal > Certificates**. The self-signed certificate you created appears in the list of certificates.

    ![Microsoft Management Console](/assets/images/microsoft-management-console-2e476089e0c80775b76c59553b4cf2ab.png)

11. Right-click the self-signed certificate you created and select **All Tasks > Export...** The **Certificate Export Wizard** opens.

note
You must export both the private key and the certificate. You cannot enable secure LDAP for a managed domain using a PFX that does not contain the certificate's private key.

12. Complete the following steps to complete the **Certificate Export Wizard**.

    1. Method 1

       1. Click **Next**. The **Export Private Key** page appears.

       2. Select **Yes, export the private key** and click **Next**. The **Export File Format** page appears.

       3. Select **Personal Information Exchange - PKCS #12 (.PFX)** as the file format for the exported certificate.

       4. Select **Include all certificates in the certification path if possible**.

       5. Click **Next**. The **Password** page appears.

       6. Type a password for your certificate in the **Password** field.

       7. Retype to confirm the password.

    note
    Record this password in a separate location. You will need to enter this password to access the certificate.

    8.  Click **Next**. The **File to Export** page appears.

    9.  Enter the file path, including the file name and location, where you want to export the certificate

    10. Method 2

        1.  Click browse to navigate to where you want to store the certificate and type the certificate name.
        2.  Click **Save** to return to the File to Export page.
        3.  Click **Next**.
        4.  Click **Finish**. A confirmation messaged appears and you are returned to the Console window.
        5.  Click **OK**.

### Export secure LDAP certificate in .CER format

1. In the Console window, reselect the certificate you created in _Step 1: Obtain a certificate for secure LDAP to the managed domain_.
2. Right-click the self-signed certificate you created and select **All Tasks > Export...** The **Certificate Export Wizard** opens.
3. Click **Next** and do the following to export the certificate in .CER format:
   1. Click **No, do not export the private key** and click **Next**. The **Export File Format** page appears
   2. Select **DER encoded binary X.509 (.CER)** as the format you want to use and click **Next**.
   3. Browse to where you want to store the certificate, enter a name for the certificate.
   4. Click **Save** to return to the File Export page.
   5. Click **Next**.
   6. Click **Finish**. A confirmation messaged appears and you are returned to the Console window.
4. Click **OK**.

## Step 3: Enable secure LDAP for managed domain using Microsoft Entra ID

1. Open a Web browser and navigate to the [Azure portal](https://portal.azure.com). The **Microsoft Azure** page appears.

2. Click **Manage Microsoft Entra ID**. Sign in to Microsoft Entra ID.

3. In the **Search** box of the Microsoft Entra ID page, type **domain services**. A list of search results appears.

4. Select **Microsoft Entra ID Domain Services** from the search results. The **Microsoft Entra ID Domain Services** page appears.

5. Click the name of your managed domain to display the domain details.

6. Click **Secure LDAP**. The **Secure LDAP** settings appears.

7. Click **Enable** under **Secure LDAP**. An **Allow secure LDAP access over the internet** option appears.

8. Select **Enable** to allow secure LDAP over the internet.

Caution
Enabling secure LDAP access over the Internet makes your domain susceptible to password brute force attacks. Entrust recommends setting up a Network Security Group (NSG) to restrict access to only the desired source IP address range. See [Lock down LDAPS access to your managed domain over the internet](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-ldaps#task-5---lock-down-secure-ldap-access-to-your-managed-domain-over-the-interne) for assistance.

9. Browse to select the **.PFX file with Secure LDAP certificate**.

10. Type the **Password to decrypt the .PXF file**.

11. Click **Save**. A message appears stating that secure LDAP is being configured for the managed domain. You cannot modify the domain settings until you complete this operation.

note
The operation takes 10-15 minutes to complete. If the provided secure LDAP certificate does not match the required criteria, secure LDAP for the directory is not enabled. A failure message also appears. If this occurs, retry the operation using a valid certificate.

12. Update the DNS servers as required. See the [Microsoft Entra IS documentation](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-ldaps#task-4---configure-dns-to-access-the-managed-domain-from-the-internet).

13. Restart the Virtual machines in the network to apply the new DNS settings.

14. Enable password hash synchronization using the instructions provided in the following Microsoft Azure documentation:

    - [For cloud-only accounts](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-create-instance)
    - [For user accounts synchronized from an on-premises directory](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-configure-password-hash-sync)