The Active Directory section allows you to configure synchronisation of one or more Active Directory domains with the USS cloud account. The advantage of this is that you can use Active Directory attributes in products that support them, such as Web Security, Email Security and Cloud Application Security. On-premise, Azure AD or hybrid environments are supported.
On-Premise Active Directory sync
To view and edit your AD syncs, visit your USS Dashboard and click Products ⟶ Settings ⟶ Active Directory.
Your existing Active Directory listings will be shown.
To add new domain, click the button. Enter the details of your new domain into the form that's displayed.
A description for the domain. Typically your Active Directory domain name, for example:
Enter the DNS name of the domain, or the name or IP address of a specific domain controller. Leave empty to use the server where the AD Connector is installed.
Select the protocol to use for retrieving data from the domain controller(s). LDAPS utilises SSL/TLS encryption.
Enter credentials for connecting to the domain controller(s).
This can be entered in UPN format e.g.
email@example.com or using LDAP notation e.g.
Enter the DN to use as the root of the search, or leave blank to sync the entire domain.
Enter a specific NetBIOS name to use or attempt to detect NetBIOS domain automatically.
Select whether or not to import email addresses from Active Directory and optionally set the attribute containing the email address.
Click to add the domain to the list.
443from the server the AD Connect agent is installed on, to the AD Connect web service.
You should now proceed to download and install the AD Connector service on your local network.
AzureAD or Hybrid
You can link an Azure Active Directory to USS, in addition to or instead of an on-premise Active Directory sync. To do so, just choose Azure Active Directory from the dropdown menu.
You will need your Azure tenant name (which will be in a form similar to
name.onmicrosoft.com), and you'll be required to approve USS for read access to the Azure directory. You'll need an administrator account to grant that access.
This is a friendly name to identify the AzureAD connection.
This is the Microsoft tenant name, e.g xxx.onmicrosoft.com entered in full.
This option can be used to exclude email addresses from being synchronised. It is also possible to specify a custom attribute that contains the email address. Email addresses are used if the Cloud MFA product or Email Security product is licensed.
This specifies the default telephone prefix for synchronised users. This is required if the Cloud MFA product is licensed.
This option can be used to exclude phone numbers from being synchronised. It is also possible to specify a custom attribute that contains the phone number. Phone numbers are used if the Cloud MFA product is licensed.
Only synchronise users with this attribute set
This advanced option lets you specify a User Property from the Graph API that must be present with the given value(s) in order for the user object to be synchronised. You may specify multiple values using a semi-colon
Only synchronise groups with this attribute set
Coming soon. Please ask your service provider to configure this option manually if required.
Once the domain is added, a new browser window will open and redirect you to Microsoft login page for the specified tenant in the Source name/IP option.
You must sign in with an administrator account for the tenant and grant consent for the USS service to read directory data from Azure AD.
Click Accept to continue. You can now close the browser tab and return to the USS dashboard.