This article provides an overview of the benefits, example use cases, workflows, and implementation steps as well as a link to the step-by-step configuration article for each deployment configuration. It also outlines the prerequisites and considerations across all deployment configurations.<\/p>\n\n\n\n
ADI Prerequisites<\/strong><\/h2>\n\n\n\nBefore getting started with ADI, JumpCloud recommends going through this list and ensuring all items have been completed before continuing.<\/p>\n\n\n\n
You will need: <\/p>\n\n\n\n
\n- AD Domain Admin credentials<\/li>\n\n\n\n
- Access to all Domain Controllers (DCs) or member servers in your AD domain<\/li>\n\n\n\n
- Network access to the internet from DCs or member servers and ability to communicate outbound (only) to console.jumpcloud.com over HTTPS port 443\n
\n- The JumpCloud AD Import and Sync Agent services use SSL\/TLS for all communication. If no network connectivity exists to JumpCloud, ADI will fail to connect and won’t work properly<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- JumpCloud Organization for your company<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>
Important:<\/strong> \n\n- We STRONGLY<\/strong> recommend installing and using LDAPS for ADI<\/a>. \n
\n- Configuring and using LDAPS on the Domain Controller to which the JumpCloud ADI agents will connect secures any sensitive information that is exchanged between the JumpCloud agents and the Domain Controller and protects against malicious users<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Create a separate JumpCloud admin account for this integration\n
\n- API tokens are specific to each JumpCloud Admin account. An integration admin account prevents the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
System Requirements<\/strong><\/h2>\n\n\n\n\n- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n
\n- Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the \/msiexec<\/strong> parameter when running the agent installer<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- 15MB disk space<\/li>\n\n\n\n
- 10MB RAM<\/li>\n<\/ul>\n\n\n\n
General<\/strong> Considerations<\/strong><\/h2>\n\n\n\nThese considerations apply to all or most of the use case scenarios and configurations.<\/p>\n\n\n\n
\n- When specifying a DN, you must use a semicolon (;), commas (,) are not supported.<\/li>\n\n\n\n
- The user attributes that sync by default are:\n
\n- First Name<\/li>\n\n\n\n
- Last Name<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Email<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The import agent can be configured to sync additional attributes.<\/li>\n\n\n\n
- Non-standard ASCII characters are not supported in the Root User DN<\/li>\n\n\n\n
- When updating an existing agent installation, only minimal installation screens are shown<\/li>\n\n\n\n
- Demoting a DC installation to a member server or promoting a member server installation to a DC installation aren\u2019t supported. The agent(s) must be uninstalled first and then installed on the other type of server<\/li>\n\n\n\n
- The passwords for the service accounts used by the integration (e.g., jcimport and jcsync)should be rotated periodically for security reasons<\/li>\n\n\n\n
- As of ADI sync agent version 4.x and import agent 2.x, the following changes were made:\n
\n- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration\\<\/li>\n\n\n\n
- All references to AD Bridge changed to AD Import<\/li>\n\n\n\n
- The ADI sync agent can be installed independently of the ADI import agent<\/li>\n\n\n\n
- The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts<\/li>\n\n\n\n
- The ADI sync agent connect key is encrypted and the value in the registry is replaced with the encrypted value when the agent starts<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The JumpCloud ADI import and sync agent services use TLS for all communication. If no network connectivity exists to JumpCloud, ADI won\u2019t work properly<\/li>\n<\/ul>\n\n\n\n
ADI Configurations<\/strong><\/h2>\n\n\n\nThe table below provides an overview of the three (3) deployment configurations and main use cases. The sections that follow describe the capabilities, example use cases, benefits, workflow, and considerations for each configuration, as well as a link to the step-by-step guide. <\/p>\n\n\n\n
\n\n \n\n \n \n \n \n \n \n \n
- \n
- The JumpCloud AD Import and Sync Agent services use SSL\/TLS for all communication. If no network connectivity exists to JumpCloud, ADI will fail to connect and won’t work properly<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- JumpCloud Organization for your company<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Important:<\/strong> \n
- \n
- We STRONGLY<\/strong> recommend installing and using LDAPS for ADI<\/a>. \n
- \n
- Configuring and using LDAPS on the Domain Controller to which the JumpCloud ADI agents will connect secures any sensitive information that is exchanged between the JumpCloud agents and the Domain Controller and protects against malicious users<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Create a separate JumpCloud admin account for this integration\n
- \n
- API tokens are specific to each JumpCloud Admin account. An integration admin account prevents the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
System Requirements<\/strong><\/h2>\n\n\n\n
- \n
- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n
- \n
- Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the \/msiexec<\/strong> parameter when running the agent installer<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- 15MB disk space<\/li>\n\n\n\n
- 10MB RAM<\/li>\n<\/ul>\n\n\n\n
General<\/strong> Considerations<\/strong><\/h2>\n\n\n\n
These considerations apply to all or most of the use case scenarios and configurations.<\/p>\n\n\n\n
- \n
- When specifying a DN, you must use a semicolon (;), commas (,) are not supported.<\/li>\n\n\n\n
- The user attributes that sync by default are:\n
- \n
- First Name<\/li>\n\n\n\n
- Last Name<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Email<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The import agent can be configured to sync additional attributes.<\/li>\n\n\n\n
- Non-standard ASCII characters are not supported in the Root User DN<\/li>\n\n\n\n
- When updating an existing agent installation, only minimal installation screens are shown<\/li>\n\n\n\n
- Demoting a DC installation to a member server or promoting a member server installation to a DC installation aren\u2019t supported. The agent(s) must be uninstalled first and then installed on the other type of server<\/li>\n\n\n\n
- The passwords for the service accounts used by the integration (e.g., jcimport and jcsync)should be rotated periodically for security reasons<\/li>\n\n\n\n
- As of ADI sync agent version 4.x and import agent 2.x, the following changes were made:\n
- \n
- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration\\<\/li>\n\n\n\n
- All references to AD Bridge changed to AD Import<\/li>\n\n\n\n
- The ADI sync agent can be installed independently of the ADI import agent<\/li>\n\n\n\n
- The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts<\/li>\n\n\n\n
- The ADI sync agent connect key is encrypted and the value in the registry is replaced with the encrypted value when the agent starts<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The JumpCloud ADI import and sync agent services use TLS for all communication. If no network connectivity exists to JumpCloud, ADI won\u2019t work properly<\/li>\n<\/ul>\n\n\n\n
ADI Configurations<\/strong><\/h2>\n\n\n\n
The table below provides an overview of the three (3) deployment configurations and main use cases. The sections that follow describe the capabilities, example use cases, benefits, workflow, and considerations for each configuration, as well as a link to the step-by-step guide. <\/p>\n\n\n\n
\n\n \n\n \n \n \n \n \n \n \n
- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n
- API tokens are specific to each JumpCloud Admin account. An integration admin account prevents the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- We STRONGLY<\/strong> recommend installing and using LDAPS for ADI<\/a>. \n
![](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/microsoft-logo.jpg\"){kind=logo}
<\/td>\n ![](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/AD-to-JC-data-flow.jpg\")
<\/td>\n ![](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/Install-yes.jpg\")
<\/td>\n ![](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/Install-no.jpg\")
<\/td>\n <\/tr>\n ![](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/jumpcloud-logo.jpg\"){kind=logo}
<\/td>\n ![](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/bidirectional-data-flow-between-AD-and-JC.jpg\")
<\/td>\n ![](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/jumpcloud-microsoft-logos.jpg\")
<\/td>\n ![](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/JC-to-AD-data-flow.jpg\")
<\/td>\n ![](\"https:\/\/lh7-us.googleusercontent.com\/WwUeFsVOw6DcaSefsyE-yyUCqCn7KTLh2zDqEYS0A00iJJ-JVrEr8A2peOrlPmJ67Jkm_gciu_esxULhvLkHv1mjVku4pd1lg2kSE2NpK_zlm24N4c2un97tRiWSdj3YLcdCOoNLa2FXthXvQFZ5fWc\")
<\/span><\/span>![](\"https:\/\/lh7-us.googleusercontent.com\/VppYxO6VEbbzzpWKs6cDX4YaMJqU-BQYkC2R45SEE69LGyDrWFMyhW9uOwvuQk2o59FNxRabMFUqRAu1977lwaOFyQss266MzSTabgOBs6vfvUsPsoDD9y7IiOSlw7CZTvoLRiVKja8uxON1Lmv1094\")
<\/span><\/span>![](\"https:\/\/lh7-us.googleusercontent.com\/Te0wI7Ywezafv3e_jUcR9LydkNb5kYeTU50tV5Xe4iQOkBPkfqxlmR8nB38eT4nTIa81H-trmggZpHbgbdCrb-O0m1-yPMZ1NGeGX1Lgw9HlNfgdRAOgl79zqbI_-krEdTCzszX8qP9LCsDxjNdeo-U\")
<\/span><\/span> ![](\"https:\/\/lh7-us.googleusercontent.com\/xSo56gP2EW9k8AO1z6IsGtMYBp-4DO2WA7qXmzmZMS3r-c1bMSnGx03b_LNrCHDdGqtFvS2GF2q-T0-ByFi1fZd6GVAgEP8zcfElWKwo7IxfB7Pq2pnEbpdwzIrtvosbYOd2tAYYtRXGJeAmkbjmwTY\")
<\/span><\/span>![](\"https:\/\/lh7-us.googleusercontent.com\/9JE1YAooq4sPrsEgP21T8Q-x2CQnv7nBDkgmGwnqhi3PqlB6v7G9XaYgqlvvarI7h8watjzPmtSHLo0OuuR7CDrW0nGOKOPDb0ReNItV6n68GMd26m1lP-DXg7LUvfJ7UY0T_BDNpDBXx7h0S2rrZMk\")
<\/span><\/span>![](\"https:\/\/lh7-us.googleusercontent.com\/elIhqTZLNd99S2iM-HkFSRoOU_oT5_Md2CG9p4l9Z4FRLYUSvDz2IFHijcV9-g87CWT0lNns9eiWi6_Ij28IBXoqs_o_LObifh2-0lDl3f83sVBfN-LN_5XZwVQxVCi88U-tXc3R7Ug0ig5IQ1uI3nA\")
<\/span><\/span>![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/06\/AD-Import-single-domain-workflow.jpg\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/AD-Import-multiple-domain-workflow.jpg\")
<\/figure>\n\n\n\n![](\"https:\/\/lh7-us.googleusercontent.com\/hp4cG2I2IH7TJjEHI2rf40H_rnGAhUcwf-dw5FXaRI3T-Omgg6LEJCLAMhp3eeHFdjta86Cs2xSCetBEcwhITDRRT2jsDZUDmyHzy_QnBDS93rTV8NtCbsn3VpdkrSLcC96ZdLm73hGg4G5JMprNe4M\")
![](\"https:\/\/lh7-us.googleusercontent.com\/fKaOokNOy9PTEjzn4fyB0NiBoV-PnM0JbuMoBj8J_ij99DyMMwq2_r9zy1O7QYFUH2DpMyKhEDSD1hEHbNoA-6I8aOLG6wppBeOkad7aK6lisE2MDdpf6ix52wr1xNt39K8wqgLHOFYJ7osdL9_rk_c\")
![](\"https:\/\/lh7-us.googleusercontent.com\/SbK8UMK8f0avuN-a2ZECFStR7lmrC2tN-WkIBKu3B64UHSmdnQWDkWVnnRJM9HE1bgxBSh4zrt0vOXoDTVixiawT6ED-zPpuLxFpDnt6G7IaDZCQnPMHRB3GVWTsoYypON9NIWB-Zt-ThCkBIc0WMpM\")
<\/span><\/span>![](\"https:\/\/lh7-us.googleusercontent.com\/aZEk8cxBPATc1t0b7uC2TsW-lJOJ9KX-MnJclDvj1aJu8Wd99YKC8Pw-t3cO4f8ujvZyngF4HTXXbhX6pDkvtY3uZAVmZPnOuzR95XwhdGai3mZdmZOoQj9V2Ug1c4kpgHfjy0UhI7A8i9cqUwPRf5I\")
<\/span><\/span> ![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/Bidirectional-single-domain-workflow.jpg\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/06\/Bidirectional-multiple-domain-workflow.jpg\")
<\/figure>\n\n\n\n![](\"https:\/\/lh7-us.googleusercontent.com\/UoCGG4GdiJl3o1Oo0koNA4tLFisa0S6PYoPty9FZ3asQl9jTQEVXoUTsGEZJirsnmVSdyUxlT8OqzBeEgtP7XCQXXo-o8jYfqV-ImvpKHAmFFS8r59gcOnl-nxoD6yQG_FfzHq3Sz1jlr5112COScPs\")
<\/span><\/span>![](\"https:\/\/lh7-us.googleusercontent.com\/fC_uy22dzvF5bCJaG-lzD9ANWN6Gb_-oHijO8LJw9S4u_SzDoeKOLR0EggWUPiYgJc1i8cxr_6vB-VtIURKDScacLhANFrd1_Ppbd4juumdNp8LdUKd_K83iNUYf1bE9VMgHyDB63noKCXQT79CTPvo\")
<\/span><\/span>![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/JC-sync-single-domain-workflow.jpg\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/JC-sync-multiple-domain-workflow.jpg\")
<\/figure>\n\n\n\n