探花大神

The 探花大神 Active Directory Integration (ADI) enables the syncing of users, groups, and passwords between 探花大神 and on-premise or off-premise AD. As covered in Get Started: Active Directory Integration, the ADI uses two agents: an Import Agent and a Sync Agent that can be installed in three (3) configurations which are based on where you want to manage users, groups, and passwords:

1. Manage users, groups, and passwords in AD
2. Manage users, groups, and passwords in 探花大神
3. Manage users and passwords in either system, or both

This article provides a step-by-step guide for configuring ADI to manage users, security groups, and passwords in AD, 探花大神, or both. This configuration provides the greatest flexibility. It allows AD and 探花大神 to manage user credentials and attributes together in unison, a full two-way sync. Users are able to change passwords within either AD or 探花大神. It also supports a hybrid approach where specific information is managed in one system and other information is managed in the other system. This configuration supports:

• Data syncs bidirectionally between 探花大神 and AD
• Passwords managed in either system or both
• Users created, updated, and deactivated in either system or both
• User (security) groups created and managed in either system or both
• Group membership managed in either system or both

Deployment Configuration Overview

• Use both the ADI import agent and ADI sync agent
• Install agents on either domain controllers (DCs) or member servers

• Add users and security groups under the ADI security group in AD to sync from AD to 探花大神
• Assign users and user groups to the ADI AD domain in 探花大神 to sync from 探花大神 to AD

To explore the use cases and benefits of this configuration see Manage users and passwords in either system, or both in the Configure Active Directory Integration (ADI) help center article.

Workflows

Two-way sync – single domain

Two-way sync – multiple domains

To learn more about the general user identity workflow and expected behavior for any user, group, and password change after the AD Import and AD Sync agents have been configured, read Use and Manage the Active Directory Integration (ADI) . 

System Requirements

• 64-bit Windows Server (versions 2012, 2016, 2019, 2022)
  • Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the /msiexec parameter when running the agent installer
• 15MB disk space
• 10MB RAM

Installation Steps Overview

The main steps you will take to install and configure AD for bi-directional use are:

1. Determine on which servers the AD import agents will be installed: member servers or domain controllers (DCs).
2. Complete the prerequisite checklist.
3. Determine the Root User container in AD.
4. Create the 探花大神 ADI Integration Security Group in AD.
5. Create the AD Import Service Account.
6. Create the AD Sync Service Account.
7. Delegate control for the AD Import and AD Sync Service Accounts.
8. Create an AD domain instance in 探花大神.
9. Select your configuration and download the agents.
10. Run the the AD Import Agent installation wizard.
11. Reboot each AD server where the import agent was installed.
12. Verify the Import Agent Service started.
13. Complete post-installation AD import agent configuration on each DC.
14. Run the AD Sync Agent installation wizard.
15. Verify AD sync and AD import agents in the 探花大神 Admin Portal.

Considerations

Agent Version Considerations

Import Agent

• Import agent v3.0.0 and higher supports delegated user authentication to AD
• As of import agent v2.2.1, the following changes were made:
  • The default location for all agent related installation, configuration, and log files is C:\Program Files\探花大神\AD Integration.
  • All references to AD Bridge changed to AD Import.
  • The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts.

Sync Agent

• As of ADI sync agent version 4.5.1, the following changes were made:
  • The default location for all agent related installation, configuration, and log files is C:\Program Files\探花大神\AD Integration\
  • The ADI sync agent can be installed independently of the ADI import agent
  • The ADI sync agent connect key is encrypted and the value in the registry is replaced with the encrypted value when the agent starts

Delegated Authentication Considerations

The delegated authentication functionality is specific to the ADI AD import agent. Review ADI: Use AD Delegated Authentication for specific considerations and more information about delegated authentication to AD. 

• The delegated authentication setting, Delegated Password Validation, is disabled by default but can be enabled.
• When the delegated authentication setting, Delegated Password Validation, is enabled and active:
  • All users imported from AD to 探花大神 by import agent v3.0.0 or higher will have their Delegated Authority automatically set to Active Directory and their login to the 探花大神 User Portal and SSO login delegated to AD for validation.
  • Existing AD users imported from AD to 探花大神 no longer have to reset their password in AD to log in to 探花大神 managed resources when delegation is enabled for them.
• When the delegated authentication setting, Delegated Password Validation, is disabled:
  • All users imported by import agent v3.0.0 or higher will have their Delegated Authority automatically set to Active Directory and their login to the 探花大神 User Portal and SSO login delegated to AD for validation.
  • Existing AD users imported from AD to 探花大神 no longer have to reset their password in AD to log in to 探花大神 managed resources when delegation is enabled for them.

General Installation Considerations

• The AD sync agent does not need to be installed on all servers.
• Connect Keys are one-time use keys required for installing the agents on a new AD server. They expire in seven days.
• The AD Domain and Root User container DN must be the same for both the AD import agent and AD sync agent 
• Non-standard ASCII characters are not supported in the Root User DN.
• When upgrading an agent, the installation wizard prompts for minimal information:
  • Directory for where the installation should occur.
  • Finish screen.
  • Upgrading from AD import agent v2.6.0 or lower to v3.0.0 or higher will also prompt for the import agent connect key.
• An ADI integration specific Security Group (e.g., 鈥溙交ù笊疋��) must be configured within the root user container or root OU to import and sync users from AD to 探花大神:

• Demoting a DC installation to a member server and promoting a member server installation to a DC aren鈥檛 supported.  The agent(s) must be uninstalled first and then installed on the other type of server.
• A reinstall of the same ADI import agent is treated as an update.
• When multiple AD agents are installed, one import agent and one sync agent are designated as the primary agent by the ADI service. All create and change requests are sent to that agent. If that agent becomes unavailable, another active agent is automatically designated as the primary. For the import agent, all delegated authentication requests are also sent to the primary agent.
• When updating an existing agent installation, only minimal installation screens are shown:
  • Directory for where the installation should occur
  • Finish screen

Member Server Installation Considerations

The following are considerations only if you choose to install the ADI agents on member servers:

Import Agent

• The AD password does NOT sync from AD to 探花大神. Users imported and synced from AD will not have a password in 探花大神.
• A server reboot is required.

Sync Agent

• If you have member servers in your AD environment, installing the sync agent on member servers is the recommended option.
• All sync agent functionality works when the agent is installed on member servers.
• A server reboot is NOT required.

Domain Controller (DC) Installation Considerations

The following are considerations only if you choose to install the agents on DCs:

Import Agent

• Downtime should be scheduled. The installation requires a server reboot.
• An import agent must be installed on all Domain Controllers.
• AD passwords will sync from AD to 探花大神.

Sync Agent

• A sync agent does NOT need to be installed on all Domain Controllers.
• Installing the sync agent on more than one DC is recommended for redundancy and high-availability .
• The installation does not require a server reboot.
• 探花大神 passwords will sync from 探花大神 to AD.

Security Considerations

• It is STRONGLY recommended to install and use LDAPS for the ADI. Configuring and using LDAPS when agents are installed on a member server secures any sensitive information that is exchanged between the 探花大神 agents, the member server, and the Domain Controller, and protects against malicious users.
• We recommend periodically rotating the passwords for the server accounts used by the integration e.g., jcimport and jcsync) for security reasons.
• API tokens are specific to each Admin account. Use a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your 探花大神 organization when an Admin account is deleted.

Password Considerations

• Password complexity requirements in AD and 探花大神 should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.

• Users imported from AD to 探花大神 will have their Password Authority set to None (探花大神). This setting can be changed from Users>More Actions>Set External Password Authority or directly from the User Details page.

• When the 探花大神 AD import agent is installed on member servers, the AD password does NOT sync to 探花大神.
  • This configuration is used when user passwords are managed in 探花大神.
  • Users imported from AD will not have their AD password stored on their initial login to 探花大神 nor will the password sync from AD to 探花大神.
  • Users imported from AD will have
  • When a user's Password Authority is set to None (探花大神) the password can set and managed in 探花大神.

• When the 探花大神 AD import agent is installed on all DCs, the AD password does sync from AD to 探花大神. This means that the password will be saved in both AD and 探花大神.
  • When a user's Password Authority is set to None (探花大神):
    • Passwords can be managed in AD, 探花大神, or both.
    • Password expiration notifications are sent from 探花大神.
  • When a user's Password Authority is set to Active Directory:
    • The password cannot be set or changed password in 探花大神, with the exception of the link from the password expiration notification.
    • Passwords must be managed in AD.
    • Password expiration notifications are sent from 探花大神.

User Sync Considerations

• Synced users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty, otherwise the users will fail to sync.
• The 探花大神 ADI import and sync agent services use TLS for all communication. If no network connectivity exists to 探花大神, the ADI won鈥檛 work properly 

Sync from AD to 探花大神

• We recommend that all users you plan to import from AD into 探花大神 live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory.
  • If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your 探花大神 instance, along with any associated data and resource associations.
• To sync users from AD to 探花大神, users must be members of the ADI specific Security Group (e.g., 鈥溙交ù笊疋�� or "探花大神 -Domain1") or of a Security Group nested under this Security Group
• Users who are imported from AD to 探花大神 will automatically have their Password Authority set to Active Directory by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.
• You can manage users in 2 ways:
  • Individually by adding them to the security group created for this integration, located in the designated OU 
  • Using groups located in or nested in the designated Root user container by adding those groups as a member of the 探花大神 Integration Security Group
• ADI Import Agent settings in the jcadimportagent.config.json file control the behaviors that occur in 探花大神 when certain actions are taken on the user in AD
  • Removing users from the 探花大神 integration Security Group within AD will either delete those users in 探花大神 and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in 探花大神 and allowing them to be managed in 探花大神 directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file
• Removing users from the 探花大神 Integration Security Group within AD will either delete those users in 探花大神 and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in 探花大神 and allowing them to be managed in 探花大神 directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file 
• Importing , such as Domain Admins and accounts with 鈥渁dminCount=1鈥�, into 探花大神 from AD, isn鈥檛 supported.
• The Password Authority setting can be changed for a specific user from their user record directly or for multiple users from Users >More Actions>Set External Password Authority.

Export and sync from 探花大神 to AD

• Users created in AD from 探花大神 are created in the AD root container.

Regular

Migrating device accounts from AD Managed to 探花大神 Managed

• 探花大神 has a tool, called the , which is used to migrate end-user Windows computers from AD to 探花大神

Attributes

The user attributes that sync from AD to 探花大神 and 探花大神 to AD are:

• First Name
• Last Name
• Username
• Email

If the SyncAdditionalAttributes setting is true in the jcadimportagent.config.json file, the following attributes are also synced from AD to 探花大神:

• displayname
• description
• JobTitle
• department
• company
• location
• employeeType
• phoneNumbers
• addresses
• manager 

Prerequisite Checklist

Before installing the AD import and AD sync agents, we recommend completing each of the following checklist items before continuing.

1. Know your AD Domain Admin credentials.
2. Decide whether you want to install the sync agents on your AD domain鈥檚 non-DC Domain Member Servers (member servers) or Domain Controllers (DCs).
   • When installing the import agent on DCs, schedule downtime. Installation requires server reboot! 
   • If installing the AD sync agent on DCs, we recommend that you install the AD Sync agent on your Primary DC and any DC impacted by extended replication delays.
3. Verify you have access to all DCs or member servers in the AD domain.
4. Ensure your DCs or member servers are running on a 探花大神 supported 64-bit Windows Server version (2012, 2016, 2019, 2022).
5. Verify DCs or member servers have networking access to the internet and are able to communicate outbound to console.jumpcoud.com over HTTPS port 443. 
6. Create a dedicated Administrator account in 探花大神 that is specifically for the ADI.

7. Generate and securely store the API key for the ADI dedicated Administration account.
8. Verify all users to be synced from AD to 探花大神 and 探花大神 to AD have a value for first name and last name.
9. Align password complexity requirements between AD and 探花大神 as closely as possible. Otherwise, passwords may not replicate if they鈥檙e rejected by the destination directory鈥檚 complexity requirements.
10. (Recommended) Verify all users you plan to import into 探花大神 live in a single OU or are nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory. 
11. Review Advanced Configurations for the Active Directory Import Agent to understand the configuration settings available for the import agent and note any default values that need to be changed as part of the installation.
12. (Strongly recommended) Install LDAPS when installing the agents on a member server.

Prepare AD for the Agent Installations

Determine Root User Container

Prepare for the agent installations in AD by determining the Root User Container.

AD Import Agent

The 探花大神 AD Import agent is designed to integrate with AD鈥檚 default 鈥楿sers鈥� container (CN=Users) which is pre-populated in the AD Users and Computers (ADUC) interface and labeled as 鈥淯sers鈥� as shown in the following image. (This is a default domain with no custom containers. In this use-case the Root Container is CN=Users;DC=example;DC=com). 

The import agent installation wizard assumes that this is the Root User container and uses this path in your AD Import agent configuration file. During installation, you鈥檙e prompted for the domain components (DC) used in your AD Domain (i.e., DC=example;DC=com). The installation wizard uses this base level domain information to construct the following Root user container DN (Distinguished Name).

EXAMPLE: CN=Users;DC=example;DC=com

AD Sync Agent

The AD sync agent installation wizard prompts you to enter the Root User Container during the 探花大神 AD sync agent installation. 

If you want to use AD鈥檚 default Root User container for the 探花大神 AD Integration, the value you will need to enter during the AD sync agent installation is CN=Users;DC=example;DC=com

If AD鈥檚 default Root User container (CN=Users) isn鈥檛 the Root User Container you want to use for your 探花大神 AD integration, follow the steps below to get the distinguishedName value you will need to enter during the AD sync agent installation. You will need to follow similar steps to update the Root User Container value in the AD import after the AD Import agent install completes.

1. Verify the full LDAP path for the chosen Root user container you have selected in ADUC:
   1. From the ADUC panel鈥檚 View menu, enable Advanced Features. 
   2. Right-click the container and select Properties. 
   3. Select the Attribute Editor tab. 
   4. Select the 鈥�distinguishedName鈥� attribute, then click View.
   5. Note the value. It will need to be entered during the AD sync agent installation.
      

Create the 探花大神 ADI Integration Security Group in AD

A Security Group for the integration must be created within the Root User Container you鈥檝e defined in the previous step. This Security Group is required. Any member of this group will be synced from AD to 探花大神.

1. Open the ADUC Menu, click the Start button, type 鈥渄sa鈥� and click the Active Directory Users and Computers icon.
2. Find your Root User Container.
3. Right-click the Root User Container鈥檚 folder and click New > Group.
   1. Ensure the Security Group is a Global Security Group.
   2. Give the Security Group a name that helps identify it as the group used by the ADI (e.g., 鈥溙交ù笊疋�� for single domain environments, 鈥溙交ù笊� (Domain)鈥� for multi-domain environments).
      
   3. Click OK.

Create the AD Import Service Account in AD

After you identify the 鈥楻oot user DN鈥� that you want to use with your 探花大神 integration, you proceed by creating a new AD-based service account (standard user account) that allows the 探花大神 AD import agent to manage users and groups.

1. Open the ADUC Menu, click the Start button, type 鈥渄sa鈥� and click the Active Directory Users and Computers icon.
2. Find your Root User Container.
3. Right-click the container and click New > User.

4. Enter the following values for the 探花大神 Import Service Account user:
   1. First Name: 探花大神
   2. Last Name: Import
   3. User logon name: jcimport
      

5. Enter a password for the jcimport user and ensure that it is set to Never Expire since this will be a service account for the Import Agent.

6. Click Save.

Create the AD Sync Service Account in AD

After you identify the Root User Container (鈥楻oot user DN鈥�) that you want to use with your 探花大神 AD integration, create a new AD-based service account (standard user account) that allows the 探花大神 AD sync agent to manage users and groups.

1. Open the ADUC Menu, click the Start button, type 鈥渄sa鈥� and click the Active Directory Users and Computers icon.
2. Find your Root User Container, right-click the container and click New > User.

3. Enter the following values for the 探花大神 Import Service Account user:
   1. First Name: 探花大神
   2. Last Name: Sync
   3. User logon name: jcsync
      

4. Click Next
5. Enter a password for the jcsync user and ensure that it is set to Never Expire since this will be a service account for the Sync Agent.

6. Click Save.

Delegate Control for the AD Import and Sync Service Accounts in AD

1. Navigate to the Root User Container in ADUC that you have selected, right-click the container and select Delegate Control. This launches the Delegation of Control Wizard.
2. Click Next.
3. Add the newly created service account user to the Delegation of Control Wizard.
   
4. Click Next, then select the following tasks:
   1. Create, delete, and manage user accounts.
   2. Reset user passwords and force password change at next logon.
   3. Read all user information.
   4. Create, delete, and manage groups.
   5. Modify the membership of a group.
      
5. Click Next, then click Finish at the final screen.
6. Right-click the Root User Container in ADUC again and select Delegate Control. 
7. Click Next.
8. Add the 探花大神 Import Agent account to the Delegation of Control Wizard.
   
9. Click Next, then select Read all user information.
   
10. Click Next, then click Finish at the final screen.

Install the AD Import and Sync Agents

Create an ADI AD Domain in 探花大神

Create a new ADI domain instance in 探花大神 if one does not already exist.

1. Log in to the .
2. Go to Directory Integrations > Active Directory.

3. Click ( + Add ADI Domain ).
4. Select Manage users and passwords in 探花大神, AD or both.

3. Enter the name of an Active Directory domain that you want to integrate with your 探花大神 tenant. For example, 鈥�DC=example;DC=com鈥�.

6. Click Save.
7. If you want to use delegated authentication, select the checkbox for Delegated Password Validation.
   • This option may be useful when importing existing users from AD to 探花大神. It allows them to log in to the 探花大神 User Portal using their existing AD credentials for the first time.

Download the agents

1. Click Download Import Agent.

2. The Import Agent installer will automatically save to your local Downloads folder.
3. After downloading the agent, note and store the 3 values needed for the agent installation:
   • Your 探花大神 Organization ID
   • Your Import Agent Connect Key
   • The API key for the dedicated admin account for the integration

4. Copy and securely store the values.
5. If you already generated an API key but didn鈥檛 store it, you will need to regenerate it. Regenerating an API key will break any currently installed import agents and all other integrations using that API key. Be cautious with this option. See Rotate the Active Directory Import API Key for more information.
6. Click Close.
7. Click Download Sync Agent.
8. The Sync Agent installer will automatically save to your local Downloads folder.
9. The Install Sync Agent modal appears and you will be presented with the AD Sync Agent Installation Connect Key. This is the unique one-time use key that is required to connect the Sync Agent to your 探花大神 Org and this AD domain Integration within 探花大神. You will input this key during the AD Sync Agent install in the steps below.
10. Click Copy and save it to a password manager for later use.

6. Click Close. 
7. Save the downloaded installers to the AD servers.

Run the AD Import Agent Installation Wizard

Now you are ready to install the 探花大神 AD import agent.

1. Browse to where you saved the AD Import installer file on the server. 
2. Right-click the file, then select Run as administrator.
3. The Install Wizard will start and prompt you to agree to the C++ license terms and conditions.

4. Select the type of server on which you are installing the AD import agent:

5. If you selected Domain Controller, skip to step 9.
6. If you selected Member Server for the server type, provide the FQDN or IP address for that server. We recommend using FQDN.

6. Confirm your LDAP connection type and decide if you want to allow the use of LDAP if the connection using secure LDAP fails.

7. If you checked Allow insecure connection (LDAP) to a Domain Controller, if secure connection fails, you must confirm that you understand the risk before you can proceed.

8. Enter the AD Distinguished Name (DN) of the domain and click Next.

9. Enter the jcimport account and password, then click Next. Be sure to use the NetBIOS domain format and not the full DNS name. (For example, example\jcimport and the user password).

10. Enter the 探花大神 API Key for the dedicated Admin account created for the ADI, then click Next.

11. Enter your 探花大神 Organization ID, then click Next.

12. On Selecting the File Destination, leave the defaults and click Next.

13. Click Install. The import agent will take about 1 to 2 minutes to install.

14. Select Yes, restart the computer now and click Finish.

Verify the 探花大神 AD Import Agent Service Started

Once your DC restarted, verify that the service started by confirming display name: 鈥溙交ù笊� AD Integration Import Agent鈥� ; service name: 鈥淛CADImportAgent鈥�; is running in services.msc. If the service fails to start, you can review the agent logs at C:\Program Files\探花大神\AD Integration\探花大神_AD_Import.log 

Configure AD Import Agent

There are several configuration options that you should implement post-installation of the AD import agent. The recommended configuration updates are: 

• Update LDAPS configuration file
• Modify the Root User Container Used by AD Import
• Update the security group name if your environment has multiple domains

Verify and update default import settings described in Advanced Configurations for AD Import.

Modify the Root User Container used by AD Import

If your Root User Container is the default CN=Users;DC=company;DC=com, you can skip this section.

If you鈥檙e using a different Root user container for managing AD resources with the AD Import agent, follow the steps below to modify the User container location in the agent configuration json file. 

1. Verify the full LDAP path for the chosen Root user container you have selected in ADUC:
   1. From the ADUC panel鈥檚 View menu, enable Advanced Features. 
   2. Right-click the container and select Properties. 
   3. Select the Attribute Editor tab. 
   4. Select the 鈥渄istinguishedName鈥� attribute, then click View.

2. In the AD Import Agent configuration file, replace the CN=Users;DC=company;DC=com reference in the LDAP section of the json configuration file with the 鈥渄istinguishedName鈥� value from ADUC, leaving the CN=探花大神 security group reference in place. See the example below.

An example of the configuration file that has been changed from the Defaults to match what鈥檚 actually the true Root User Container. In the below example config, Example鈥檚 Root User Container needs to be, CN=探花大神;OU=Corporate Users;DC=example;DC=com.

Modify the Security Group used by AD Import

You will need to update the security group name in the AD import configuration file to match the name you gave the 探花大神 integration Security Group in the Create the 探花大神 ADI Integration Security Group in AD above.

1. Update the security group reference in the DN, CN=探花大神, to match the name you gave the 探花大神 integration security group.

Modify default Advanced Configuration settings for AD Import

Adjust the default configuration settings to control how the import works and what happens to users in 探花大神 when certain actions are taken in AD. These settings are considered advanced configurations. See Advanced Configurations for AD Import for more information.

Save the configuration changes and restart the AD import agent service

Once all configuration changes have been made save them and restart the service.

1. Save the jcadimportagent.config.json file.
2. Restart the 探花大神 AD Import Agent service using the Windows Service Manager.

Run the AD Sync Agent Installation Wizard 

Now you are ready to install the 探花大神 Sync Agent on one or more member servers or your Primary DC and any DC within the domain that could experience replication delays.

1. Browse to where you saved the AD Integration Sync installer file on your DC. 
2. Right-click the file, then select Run as administrator.
3. Once the Installer Wizard appears, click Next.
4. On the Destination Folder screen, click Next.

5. Select the type of server on which you are installing the agent, DC or non-DC member server, then click Next.

6. If you chose Domain Controller, skip to step 9.
7. If you chose Member Server as your server type, enter the information for the DC to which the member server should connect to sync data from 探花大神 to AD. We recommend using the FQDN for your DC.

7. Confirm your LDAP connection type and decide if you want to allow the use of LDAP if the connection using secure LDAP fails.

8. If you checked Allow insecure connection (LDAP) to a Domain Controller, if secure connection fails, you must confirm that you understand the risk before you can proceed.

9. Enter in the Root User Container you noted in the Determine the Root User Container in AD section above. If you鈥檙e using the default AD Root User Container, the value will be CN=Users;DC=company;DC=com. If you鈥檝e chosen another Root User Container, enter the value you noted.
   • In this example, we鈥檝e modified the Root User Container. The value is: OU=Corporate Users;DC=example;DC=com

10. Enter the AD Sync Agent鈥檚 Service Account you鈥檝e created. This should be the jcsync User Account you created in the Create the AD Sync Service Account section above. Then click Next.

11. Enter the Connect Key that was presented to you within the 探花大神 Admin Portal after downloading the AD Sync Agent. Then click Next.

12. Finally, click the Install button to install the AD Sync Agent. This could take up to 3 minutes.

Congratulations! You鈥檝e installed the AD Sync Agent. You are ready to verify that the AD Sync Agent is communicating properly.

Verify AD Import and AD Sync

Once you鈥檝e installed the AD import and AD sync agents within your AD environment. You can easily verify that the 探花大神 AD Sync Agent is working. Please ensure the following are present and visible: 

• The 探花大神 AD Sync Agent should be shown as green and active within the Admin Portal under Directory Integrations > Active Directory > Domain Integration > Domain Agents tab.

Additionally, 

• 探花大神 User Group is now within your 探花大神 organization. The 探花大神 User Group should have a User Group icon with an AD badge in the User Group Details pane. See the example below:
  • Navigate to User Management > User Groups. You should see the 探花大神 User Group with a Microsoft badge next to it. Click on the User Group to open up its details

• When opened, you can see that the User Group has a Microsoft Badge and is also assigned to AD on the Directories tab.

Next Steps

Please read the Using and Managing the ADI article next.

Want additional assistance from 探花大神? 

If you鈥檙e having issues with getting 探花大神鈥檚 ADI working, try the Troubleshooting Guide. 探花大神 now offers myriad professional services offerings to assist customers with implementing and configuring 探花大神. If you鈥檙e looking for assistance with Migrating from AD, or to integrate AD with 探花大神, we recommend you reach out to 探花大神鈥檚 Professional Services team on the following page: Professional Services - 探花大神.