--- title: "Integrating Active Directory with Decisions" slug: "integrating-active-directory-with-decisions" description: "This document introduces Active Directory integration with Decisions. The Active Directory is a Microsoft service that manages domains, users, objects, and devices that operate within a network. In Decisions it can be used to sync users, computers, and groups into the Decisions Portal. " tags: ["active directory", "account", "Server"] updated: 2026-08-28T00:31:15Z published: 2026-08-28T00:31:15Z canonical: "documentation.decisions.com/integrating-active-directory-with-decisions" --- > ## Documentation Index > Fetch the complete documentation index at: https://documentation.decisions.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrating Active Directory with Decisions ## Overview **Active Directory** (AD) is a Microsoft directory service that manages domains, users, objects, and devices that operate within a network. Active Directory can be used to sync users, computers, and groups into the Decisions Portal account base. These accounts can then be used from the Active Directory Server as Decisions accounts without manually adding each account individually. A few key points of syncing to Active Directory are: - **Active Directory Sync Jobs** only fetch users and groups from the Active Directory Server. This is one-way sync where account/user/group information from Active Directory is stored in Decisions. - Information about organization units is not synced into Decisions. - For users, Decisions retrieves all the personal information (First Name, Last Name, etc.) and the contact information (Address, Phone Numbers, Emails, etc.) from Active Directory. - When a user is deactivated in Active Directory, that user will be deactivated in Decisions. Users cannot set up Active Directory Sync simultaneously with Single Sign-On (via the SAML and OpenID Modules). Doing so will cause an error and will require users to reset their sign-on setup. --- Below are some examples of how Active Directory can be used when integrated into Decisions: ## [Active Directory Server Authentication](/version-10/docs/setting-up-active-directory-ad-server-authentication) The **Active Directory Server Authentication** is used to authenticate users or system Active Directory credentials to log in to Decisions. AD accounts cannot be edited in Decisions but can be used to access the Portal and for other purposes such as Assignments and Groups. There are specific steps that must be performed to do this for Decisions to start Authentication with AD accounts. ## [Active Directory Sync Job](/version-10/docs/creating-an-active-directory-ad-sync-job) Once AD Server Authentication is configured, AD Sync Jobs can be performed. AD Sync Jobs allows the automatic creation of AD accounts that have logged into Decisions by running a Scheduled Sync Job to the AD Server. The Sync will pull information from the selected AD Domain provided in the Server Authentication. Depending on the options selected, users can sync specified data (Groups, Accounts, Organizations, etc.) or sync all elements by choosing to sync from the Entire Domain. ## Active Directory Setup in Containers To learn more about containers refer to the [Containers Overview](https://documentation.decisions.com/version-10/docs/containers-overview) article. Active Directory module might fail to pass authentication via LDAP/LDAPS to the Active Directory domain when running in Containers. To prevent authentication failure, follow these steps while setting up an AD server. - Currently, containers can access all steps in the active directory module except for the **Create user advanced** and **Set Password** steps. For logging into a container using an AD account, the user must enter the domain name along with the username (**domainName\userName**). - Ensure to Disable "**Use No Login Prefix**" in the server settings while adding the servers. Refer to the following image. ![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/image-1783017129582.png) --- ## Active Directory Account Sync with Deployment Tower When environments are connected to the Deployment Tower, Active Directory account synchronization must be managed from the Deployment Tower. This ensures that accounts and directory settings remain aligned across the Deployment Tower and the registered client environments. Active Directory Password ManagementActive Directory account passwords are not synchronized or managed by Decisions. Passwords remain controlled by the external Active Directory provider. ### Upgrading to Version 10 Use the following guidance when upgrading to version 10. - **AD Settings Already Exist in All Environments:** If Active Directory settings already exist in all environments before the upgrade, run the **AD Sync** action from **System Settings** on the Deployment Server after upgrading and registering environments to version 10. - **AD Settings Exist Only on Client Environments:** If Active Directory settings exist only on client environments, such as Development, QA, and Production, and were never configured on the Repository or Deployment Server: 1. Register the environments with the Deployment Tower. 2. Add the Active Directory settings on the Deployment Server. 3. Run the **AD Sync** action from **System Settings** on the Deployment Server. ### Fresh Installs For fresh installations: 1. Register the environments with the Deployment Tower. 2. Configure the Active Directory settings on the Deployment Tower. 3. Configure the Active Directory settings on each client environment. 4. Run the **AD Sync** action from **System Settings** on the Deployment Tower. ### Result After the AD Sync action runs from the Deployment Tower, Active Directory account information is synchronized with the registered client environments. This allows users to authenticate and access the appropriate environments using the expected directory configuration.