Active Directory

Updated 2 weeks ago by admin

The Active Directory section allows you to configure synchronisation of one or more Active Directory domains with the USS cloud account. The advantage of this is that you can use Active Directory attributes in products that support them, such as Web Security, Email Security and Cloud Application Security. On-premise, Azure AD or hybrid environments are supported.

In the case of the Web Security product, it is still able to log usernames even without synchronising with Active Directory. However, you will not be able to enforce rules based on Active Directory attributes without synchronisation on on-prem or hybrid AzureAD domains.

On-Premise Active Directory sync

AD synchronisation uses a locally-install AD Connector service, which pushes objects securely to the USS Cloud.

To view and edit your AD syncs, visit your USS Dashboard and click ProductsSettingsActive Directory.

Your existing Active Directory listings will be shown. On-premise Active Directory connections have a Windows icon and Azure Active Directory connections have a cloud icon.

To add new domain connection, click the button. Enter the details of your new domain into the form that's displayed.

Options

Domain

A description for the domain. Typically your Active Directory domain name, for example: ourdomain.local

Server Hostname

Enter the DNS name of the domain, or the name or IP address of a specific domain controller. Enter localhost to use the server where the AD Connector is installed.

Common Names

Only available if the Cloud MFA product is licensed. Synchronise the user common names as an alias, so that users can log in without needing to specify the domain of their username.

MFA Users

Only available if the Cloud MFA product is licensed. This option will allow you to limit synchronising users to the Cloud MFA service based on group membership.

Changing the MFA Group filter will cause existing users to be deleted, new users to be synchronised and Soft Tokens will require re-provisioning

Protocol

Select the protocol to use for retrieving data from the domain controller(s). LDAPS utilises SSL/TLS encryption.

Credentials

Enter credentials for connecting to the domain controller(s).

A user with read access to Deleted Objects Container is recommended in order to remove objects from USS once they have been removed from Active Directory

This can be entered in UPN format e.g. user@domain.local or using LDAP notation e.g. CN=ldapsync,CN=Users,DC=ourdomain,DC=local

Base DN

Enter the DN to use as the root of the search, or leave blank to sync the entire domain.

NetBIOS

Enter a specific NetBIOS name to use or attempt to detect NetBIOS domain automatically.

Email Addresses

Select whether or not to import email addresses from Active Directory and optionally set the attribute containing the email address.

Default Prefix

When importing phone numbers, this international dialling prefix will be used e.g. +1, +44

Phone numbers

Select whether or not to import phone numbers from Active Directory and optionally set the attribute containing the phone number. This is required for the MFA powered by IntelliTrust product. If enabled, the phone number field must contain a valid number. A leading zero is not permitted.

Only synchronise users with this attribute set

This advanced option lets you specify an attribute I that must be present with the given value(s) in order for the user object to be synchronised. You may specify multiple values using a semi-colon ; separator, if required e.g. attribute name = officeLocation value = London;Paris

Click to add the domain to the list.

If you block outbound connections then it may be necessary to open TCP port 443 from the server the AD Connect agent is installed on, to the AD Connect web service.

Optionally, create an API key pair to use with the AD Connect client software. If you do not create a key pair, you will need to authenticate with an administrator user and password with at least the Agent Installer role.

To create a key pair, after the new domain is added, click the key icon in the Actions column:

Click the + icon in the top right hand corner of the API Keys panel.

This is the only time you will be able to copy the API client secret for use with the AD Connect client software. If you lose the secret key, you will have to create a new one.

Copy the Client ID and Client Secret for use with the AD Connect client software.

You should now proceed to download and install the AD Connect software on your local network.

Please note that API Keys are account wide and can only be used for on-premise Active Directory synchronisation. If multiple on-premise domains exist, they will share the same API key for the purposes of synchronisation.
It is recommended that API keys are changed on a regular basis along with security best practice. The age of the key is displayed next to the Client ID in the API Keys section.

Azure AD / Hybrid Azure AD

You can link an Azure Active Directory to USS, in addition to or instead of an on-premise Active Directory sync. To do so, just choose Azure Active Directory from the dropdown menu.

AzureAD synchronisation is not compatible with the Web Security product unless an on-premise AD is also synchronised with Azure. The Web Security product and user authentication features rely on samaccountname attribute which is not available with a native AzureAD.

You will need your Azure tenant name (which will be in a form similar to name.onmicrosoft.com), and you'll be required to approve USS for read access to the Azure directory. You'll need an administrator account to grant that access.

Options

Domain

This is a unique friendly name to identify the AzureAD connection. If using multiple domains, ensure the Domain name is unique.

Tenant name

This is the Microsoft tenant name, e.g xxx.onmicrosoft.com entered in full.

Common Names

Only available if the Cloud MFA product is licensed. Synchronise the user common names as an alias, so that users can log in without needing to specify the domain of their username.

MFA Users

If the Cloud MFA product is license, this option will allow you to limit synchronising users to the Cloud MFA service based on group membership.

Changing the MFA Group filter will cause existing users to be deleted, new users to be synchronised and Soft Tokens will require re-provisioning

Email addresses

This option can be used to exclude email addresses from being synchronised. It is also possible to specify a custom attribute that contains the email address. Email addresses are used if the Cloud MFA product or Email Security product is licensed.

Default Prefix

This specifies the default telephone prefix for synchronised users. This is required if the Cloud MFA product is licensed.

Phone numbers

This option can be used to exclude phone numbers from being synchronised. It is also possible to specify a custom attribute that contains the phone number. Phone numbers are used if the Cloud MFA product is licensed.

Only synchronise users with this attribute set

This advanced option lets you specify a User Property from the Graph API that must be present with the given value(s) in order for the user object to be synchronised. You may specify multiple values using a semi-colon ; separator, if required e.g. attribute name = officeLocation value = London;Paris

Only synchronise groups with this attribute set

This advanced option lets you specify a Group Property from the Graph API that must be present with the given value(s) in order for the group object to be synchronised. You may specify multiple values using a semi-colon ; separator, if required e.g. attribute name = extendedAttribute9 value = Web;Email

If you are using extended attributes, you will need to synchronise them with Azure AD using the Microsoft Azure Active Directory Connect tool.

Once the domain is added, a new browser window will open and redirect you to Microsoft login page for the specified tenant in the Tenant Name option.

You must sign in with an administrator account for the tenant and grant consent for the USS service to read directory data from Azure AD.

The permissions are as follows:

Permission

Description

API Permission (see reference)

Why is it needed?

Sign in and read user profile

Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.

User.Read

To authenticate the administrator, verify the tenant details and ensure there is permission to create the USS AzureAD Enterprise app.

Read directory data

Allows the app to read data in your organization's directory, such as users, groups and apps.

Directory.Read.All

To access all Azure Active Directory objects with read only permission, in order to synchronise them with the USS dashboard. No credentials are transferred.

Manage Exchange As Application

Allows the app to manage the organization's Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app.

Exchange.ManageAsApp

To simplify the configuration of Shared Mailbox detection. This permission alone does not grant any access other than to be able to send Graph API requests, which by default will be denied until further permissions are added manually via the Azure Portal. This permission can be removed from Enterprise Apps -> USS AzureAD -> Permissions section if Shared Mailbox detection is not required.

Click Accept to continue. You can now close the browser tab and return to the USS dashboard.

It can take up to 15 minutes for the Azure AD objects to synchronise with USS. Until then, the domain will show as having 0 objects in the list. After the synchronisation has complete, the available objects will be displayed. If you are also synchronising email addresses for Email Security or email and phone numbers for Cloud MFA, this can take several minutes longer.

Deleting a Domain Connection will remove the objects from any product rules that were using them, for example Web Security Rules or Multi-Factor Authentication rules.
In order to correctly sync from Active Directory, a user must have an associated first name, last name, email address and phone number. If the user object cannot be sync'd then a triangle icon will appear next to the user name:


How did we do?