Active Directory / LDAP
Mirror users, groups and computers from Active Directory over LDAP, or from Entra ID, and optionally provision Aegis accounts from them.
At a glance
| Direction | Into Aegis. The connector reads the directory; it never writes to it. |
|---|---|
| What it brings in | User, group and computer objects of the directory, with group membership. |
| Where it lands |
A directory mirror per connection (Synced objects),
and, when user provisioning is switched on, Aegis users: invitations
for joiners, roles from group mappings, and deactivation of leavers
linked to that connection.
|
| Credentials and permissions | For LDAP: the server address and a bind account that can read the directory. For Entra ID: an app registration with read access to users and groups. |
| Owner of imported records | Mirrored objects have no owner. Provisioned users are invited, so they confirm their email and set up their own sign-in. |
| When it runs | Connections are checked every five minutes against their own sync schedule, and on demand with the sync button. |
| Set it up |
/connectors/ad, by people allowed to configure
connectors, on a plan that includes the connector. Several
connections can live under this one tile.
|
Good to know
- Provisioning has a dry run that writes nothing, and stops the destructive part of a run that would change more users than its safety ratio allows.
- A local or single-sign-on administrator is never deactivated by a directory read: only users linked to that connection are.
Where this connects
Directory data also feeds HR; role mappings are explained in What each role can do.