This article provides a step-by-step guide for configuring ADI to manage users, security groups, and passwords in AD. This configuration is typically used when you want to extend AD to the cloud for additional functionality, plan to keep AD as your primary user, group, and password authority, and want minimal changes to your existing AD environment. <\/p>\n\n\n\n
Deployment Configuration<\/strong> Overview<\/h2>\n\n\n\n\n- Use ADI import agent only.<\/li>\n\n\n\n
- Install import agent on all domain controllers (DCs) or on at least 2 member servers.<\/li>\n\n\n\n
- Add users and security groups under the ADI security group in AD.<\/li>\n<\/ul>\n\n\n\n
To explore the use cases and benefits of this configuration, see Manage users, groups, and passwords in AD<\/a> in the Configure Active Directory Integration (ADI)<\/a> help center article.<\/p>\n\n\n\n
Workflows<\/strong><\/h2>\n\n\n\nAD Import Agent Only \u2013 Single Domain Workflow<\/strong><\/h3>\n\n\n\n![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/06\/AD-Import-single-domain-workflow.jpg\")
<\/figure>\n\n\n\nAD Import Agent Only \u2013 Multiple Domain Workflow<\/strong><\/h3>\n\n\n\n![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/AD-Import-multiple-domain-workflow.jpg\")
<\/figure>\n\n\n\nTo learn more about the general user identity workflow and expected behavior for any user, group, and password change in AD and in JumpCloud read Use and Manage the Active Directory Integration (ADI)<\/a> . <\/p>\n\n\n\n
System Requirements<\/strong><\/h2>\n\n\n\n\n- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n
\n- Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the \/msiexec<\/strong> parameter when running the agent installer<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- 15MB disk space<\/li>\n\n\n\n
- 10MB RAM<\/li>\n<\/ul>\n\n\n\n
New Installation Overview<\/h2>\n\n\n\nThe main steps you will take to install and configure ADI for a one-way sync from AD to JumpCloud are:<\/p>\n\n\n\n
\n- Determine on which servers the AD import agents will be installed: member servers or domain controllers (DCs).<\/li>\n\n\n\n
- Complete the prerequisite checklist.<\/li>\n\n\n\n
- Determine the Root User Container in AD. <\/li>\n\n\n\n
- Create the JumpCloud ADI Integration Security Group in AD.<\/li>\n\n\n\n
- Create the AD Import Service Account.<\/li>\n\n\n\n
- Delegate read-only control for the JumpCloud import account.<\/li>\n\n\n\n
- Create an ADI domain instance in JumpCloud.<\/li>\n\n\n\n
- Select your configuration and follow the installation steps and download the import agent<\/li>\n\n\n\n
- Run the the AD Import Agent installation wizard<\/li>\n\n\n\n
- Reboot the servers on which the agent was installed.<\/li>\n\n\n\n
- Verify the Import Agent Service started on each AD server.<\/li>\n\n\n\n
- Complete post-installation AD import agent configuration on each AD server.<\/li>\n\n\n\n
- Verify the AD import.<\/li>\n<\/ol>\n\n\n\n
Considerations<\/strong><\/h2>\n\n\n\nAgent Version Considerations<\/h3>\n\n\n\n\n- As of import agent v2.2.1, the following changes were made:\n
\n- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration.<\/li>\n\n\n\n
- All references to AD Bridge changed to AD Import.<\/li>\n\n\n\n
- The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Import agent v3.0.0 and higher supports delegated user authentication to AD.<\/li>\n<\/ul>\n\n\n\n
Delegated Authentication Considerations<\/h3>\n\n\n\n
Warning:<\/strong> \nWhen the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and Pending<\/strong> for the ADI configuration and the user’s Delegated Authority<\/strong> is Active Directory<\/strong>, the user will not be able to log in. An AD import agent, version 3.0 or higher, must be installed and active to change the status of Delegated Password Validation<\/strong> from Pending<\/strong> to Active<\/strong>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>
Important:<\/strong> \n\n- When upgrading from AD import agent v2.6.0 or lower, you must select Install New Agent<\/strong> from the Downloads dropdown menu in the ADI Details page to get the connect key, which is required to complete the upgrade of the agent on the AD server.<\/li>\n<\/ul>\n\n\n\n
\n- When upgrading the AD import agent to version 3.0, existing users connected to the domain will not have their log in delegated to AD unless the Delegated Authority<\/strong> is manually set to Active Directory<\/strong> for those existing users.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- The delegated authentication setting, Delegated Password Validation<\/strong>, is enabled by default for this ADI configuration and cannot be disabled.<\/li>\n\n\n\n
- When the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and active: \n
\n- All users imported by import agent v3.0.0 or higher will have their Delegated Authority<\/strong> automatically set to Active Directory<\/strong> and their login to the JumpCloud User Portal and SSO login delegated to AD for validation.<\/li>\n\n\n\n
- Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegation is enabled for them.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
General Installation Considerations<\/h3>\n\n\n\n![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>
Warning:<\/strong> \nAll installed import agents should be the same version to avoid unexpected behavior or the potential for users not being able to log in if the primary agent is switched.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Non-standard ASCII characters are not supported in the Root User DN.<\/li>\n\n\n\n
- When upgrading an import agent, the installation wizard prompts for minimal information:\n
\n- Agent connect key, when upgrading from import agent v2.6.0 or lower.<\/li>\n\n\n\n
- Directory for where the installation should occur.<\/li>\n\n\n\n
- Finish screen.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Warning:<\/strong> \nThe Connect Key will expire in 7 days if it is not used.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Demoting a DC installation to a member server and promoting a member server installation to a DC aren\u2019t supported. The agent(s) must be uninstalled first and then installed on the other type of server.<\/li>\n\n\n\n
- A reinstall of the same ADI import agent is treated as an update.<\/li>\n\n\n\n
- User passwords must be managed in AD.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.<\/li>\n<\/ul>\n\n\n\n
Member Server Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on member servers:<\/p>\n\n\n\n
\n- The AD password does<\/strong> NOT<\/strong> sync from AD to JumpCloud. Users imported and synced from AD will not have a password in JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Domain Controller (DC) Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on DCs:<\/p>\n\n\n\n
\n- An import agent must be installed on all<\/em><\/strong> Domain Controllers. <\/li>\n\n\n\n
- Downtime should be scheduled. The installation requires a server reboot.<\/li>\n\n\n\n
- AD passwords will<\/strong> sync from AD to JumpCloud. This means that the password will be managed in AD and stored in both AD and JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Security Considerations<\/h3>\n\n\n\n\n- We STRONGLY recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/li>\n\n\n\n
- We recommend periodically rotating the password for the server account used by the integration (e.g., jcimport<\/strong>)for security reasons.<\/li>\n\n\n\n
- API tokens are specific to each Admin account. Use a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Warning:<\/strong> \nIf the JumpCloud Administrator Account associated with the import is deleted or the API key is rotated, the import will stop working. All imports will fail until a valid API key is generated and updated in the registry on the AD servers.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Password Considerations<\/h3>\n\n\n\n\n- Users imported and synced from AD to JumpCloud will have their Password Authority<\/strong> set to Active Directory<\/strong>, which means a password cannot be created or changed in JumpCloud by either a JumpCloud Admin or an end-user. The password can only be created and updated in AD.<\/li>\n<\/ul>\n\n\n\n
\n- When the JumpCloud AD import agent is installed on member servers<\/strong>, the AD password does NOT <\/strong>sync to JumpCloud. The password will only be in AD.\n
\n- In this configuration, the user\u2019s Password Authority<\/strong> should also be set to Active Directory<\/strong> to prevent a password from being entered in JumpCloud by either a JumpCloud Admin or the end user.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\n- When the JumpCloud AD import agent is installed on all DCs<\/strong>, the AD password does<\/strong> sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud. \n
\n- When passwords are imported and synced from AD to JumpCloud:\n
\n- Passwords are still managed in AD.<\/li>\n\n\n\n
- Password complexity requirements in AD and JumpCloud should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.<\/li>\n\n\n\n
- If you set a password expiration policy in JumpCloud, these users will not receive password expiration notifications automatically.<\/li>\n\n\n\n
- Sending password expiration notifications from JumpCloud is not recommended. You can send notifications manually by going to users \u00bb select expiring users \u00bb resend email<\/strong>.<\/li>\n\n\n\n
- Users with their password authority set to Active Directory managed by AD are restricted from changing their password in JumpCloud, with the exception of the link from the password expiration notification.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>
Note:<\/strong> \n\n- If the import agent is installed on DCs<\/strong>, the password is stored<\/strong> in JumpCloud after the initial log in. The stored password continues to be synced from AD to JumpCloud and from JumpCloud to other resources. The password can be used to log in to resources that don\u2019t support delegated authentication to AD, such as Cloud RADIUS, Cloud LDAP, and devices.<\/li>\n<\/ul>\n\n\n\n
\n- If the import agent is installed on AD member servers<\/strong>, the password is never stored <\/strong>in JumpCloud.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Import Considerations<\/h3>\n\n\n\n\n- We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory\n
\n- If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your JumpCloud instance, along with any associated data and resource associations<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The JumpCloud ADI import agent services use TLS for all communication. If no network connectivity exists to JumpCloud, the ADI will fail to sync and will not work properly.<\/li>\n\n\n\n
- Users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty, otherwise the users will fail to sync from AD to JumpCloud.<\/li>\n\n\n\n
- When multiple AD import agents are installed, one is designated as the primary agent by the ADI service for all user, group, delegated authentication, and password related actions (directives) performed by the import agent. If the primary import agent becomes unavailable, another active import agent is automatically designated as the primary.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.\n
\n- The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>. <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- To enable successful AD user imports, you must ensure that User Settings > Default Password Authority<\/strong> is set to None (JumpCloud)<\/strong> <\/li>\n\n\n\n
- You can manage users in 2 ways:\n
\n- Individually by adding them to the security group created for this integration, located in the designated OU <\/li>\n\n\n\n
- Using groups located in or nested in the designated Root user container by adding those groups as a member of the JumpCloud Integration Security Group.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- ADI Import Agent settings in the jcadimportagent.config.json<\/strong> file control the behaviors that occur in JumpCloud when certain actions are taken on the user in AD.\n
\n- Removing users from the JumpCloud integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Importing privileged user accounts<\/a>, such as Domain Admins and accounts with \u201cadminCount=1\u201d, into JumpCloud from AD or managing them in AD from JumpCloud, isn\u2019t supported. <\/li>\n<\/ul>\n\n\n\n
Attributes<\/h2>\n\n\n\nThe user attributes that sync from AD to JumpCloud are:<\/p>\n\n\n\n
\n- First Name<\/li>\n\n\n\n
- Last Name<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Email<\/li>\n<\/ul>\n\n\n\n
If the SyncAdditionalAttributes<\/strong> setting is true<\/strong> in the jcadimportagent.config.json<\/kbd> file, the following attributes are also updated:<\/p>\n\n\n\n
\n- displayname<\/li>\n\n\n\n
- description<\/li>\n\n\n\n
- JobTitle<\/li>\n\n\n\n
- department<\/li>\n\n\n\n
- company<\/li>\n\n\n\n
- location<\/li>\n\n\n\n
- employeeType<\/li>\n\n\n\n
- phoneNumbers<\/li>\n\n\n\n
- addresses<\/li>\n\n\n\n
- manager <\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Note:<\/strong> \nThese attributes become read-only (restrictedFields) in JumpCloud when a user’s Password Authority<\/strong> is set to Active Directory<\/strong>. The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prerequisite Checklist for New Installations<\/h2>\n\n\n\nBefore installing the ADI import agents for the first time, complete the following checklist<\/p>\n\n\n\n
\n- Know your AD Domain Admin credentials.<\/li>\n\n\n\n
- Decide whether you want to install the sync agents on your AD domain\u2019s non-DC Domain Member Servers (member servers) or Domain Controllers (DCs).\n
\n- When installing the import agent on DCs<\/strong>, schedule downtime. <\/strong>Installation requires server reboot! <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Verify you have access to all<\/em> Domain Controllers (DCs) in the AD domain or to the member servers on which you plan to install the import agents.<\/li>\n\n\n\n
- Ensure the servers on which you are installing the import agent are running on a JumpCloud supported 64-bit Windows Server version (2012, 2016, 2019, 2022).<\/li>\n\n\n\n
- Confirm the servers on which you are installing the import agent have networking access to the internet and are able to communicate outbound to console.jumpcloud.com over HTTPS port 443. <\/li>\n\n\n\n
- If installing the import agents on DCs, schedule Downtime \u2013 installation requires a server reboot!<\/li>\n\n\n\n
- Create a dedicated Administrator account<\/a> in JumpCloud that is specifically for the ADI.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nAPI tokens are specific to each Admin account. Create a dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Generate and securely store the API key<\/a> for the ADI dedicated Administration account.<\/li>\n\n\n\n
- Verify all users to be synced from AD to JumpCloud have a value for first name and last name in AD.<\/li>\n\n\n\n
- If you install the import agents on DCs, align password complexity requirements between AD and JumpCloud as closely as possible. Otherwise, passwords may not replicate if they\u2019re rejected by the destination directory\u2019s complexity requirements.<\/li>\n\n\n\n
- [Recommended<\/strong>] Verify all users you plan to import into JumpCloud live in a single OU or are nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory. <\/li>\n\n\n\n
- Review Advanced Configurations for the Active Directory Import Agent<\/a> to understand the configuration settings available for the import agent and note any default values that need to be changed as part of the installation. <\/li>\n\n\n\n
- [STRONGLY recommended<\/strong>] Install LDAPS<\/a>.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nWe STRONGLY<\/strong> recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare AD for the Import Agent Installations<\/h2>\n\n\n\nTo import and update user identities, attributes, and user groups from AD into JumpCloud, you’ll need to install a JumpCloud AD import agent on your non-DC Domain Member Servers (member servers) or all<\/em> Domain Controllers (DCs) within your domain. Complete the steps below to prepare for installing the agents on your servers.<\/p>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nPasswords can only be synced from AD to JumpCloud if the import agent is installed on a DC. When installing on DCs, an import agent must be installed on all<\/strong><\/em> DCs.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare for the AD Import Agent Installation in AD<\/strong><\/h3>\n\n\n\n
To explore the use cases and benefits of this configuration, see Manage users, groups, and passwords in AD<\/a> in the Configure Active Directory Integration (ADI)<\/a> help center article.<\/p>\n\n\n\n
Workflows<\/strong><\/h2>\n\n\n\nAD Import Agent Only \u2013 Single Domain Workflow<\/strong><\/h3>\n\n\n\n<\/figure>\n\n\n\nAD Import Agent Only \u2013 Multiple Domain Workflow<\/strong><\/h3>\n\n\n\n<\/figure>\n\n\n\nTo learn more about the general user identity workflow and expected behavior for any user, group, and password change in AD and in JumpCloud read Use and Manage the Active Directory Integration (ADI)<\/a> . <\/p>\n\n\n\n
System Requirements<\/strong><\/h2>\n\n\n\n\n- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n
\n- Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the \/msiexec<\/strong> parameter when running the agent installer<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- 15MB disk space<\/li>\n\n\n\n
- 10MB RAM<\/li>\n<\/ul>\n\n\n\n
New Installation Overview<\/h2>\n\n\n\nThe main steps you will take to install and configure ADI for a one-way sync from AD to JumpCloud are:<\/p>\n\n\n\n
\n- Determine on which servers the AD import agents will be installed: member servers or domain controllers (DCs).<\/li>\n\n\n\n
- Complete the prerequisite checklist.<\/li>\n\n\n\n
- Determine the Root User Container in AD. <\/li>\n\n\n\n
- Create the JumpCloud ADI Integration Security Group in AD.<\/li>\n\n\n\n
- Create the AD Import Service Account.<\/li>\n\n\n\n
- Delegate read-only control for the JumpCloud import account.<\/li>\n\n\n\n
- Create an ADI domain instance in JumpCloud.<\/li>\n\n\n\n
- Select your configuration and follow the installation steps and download the import agent<\/li>\n\n\n\n
- Run the the AD Import Agent installation wizard<\/li>\n\n\n\n
- Reboot the servers on which the agent was installed.<\/li>\n\n\n\n
- Verify the Import Agent Service started on each AD server.<\/li>\n\n\n\n
- Complete post-installation AD import agent configuration on each AD server.<\/li>\n\n\n\n
- Verify the AD import.<\/li>\n<\/ol>\n\n\n\n
Considerations<\/strong><\/h2>\n\n\n\nAgent Version Considerations<\/h3>\n\n\n\n\n- As of import agent v2.2.1, the following changes were made:\n
\n- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration.<\/li>\n\n\n\n
- All references to AD Bridge changed to AD Import.<\/li>\n\n\n\n
- The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Import agent v3.0.0 and higher supports delegated user authentication to AD.<\/li>\n<\/ul>\n\n\n\n
Delegated Authentication Considerations<\/h3>\n\n\n\n
Warning:<\/strong> \nWhen the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and Pending<\/strong> for the ADI configuration and the user’s Delegated Authority<\/strong> is Active Directory<\/strong>, the user will not be able to log in. An AD import agent, version 3.0 or higher, must be installed and active to change the status of Delegated Password Validation<\/strong> from Pending<\/strong> to Active<\/strong>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \n\n- When upgrading from AD import agent v2.6.0 or lower, you must select Install New Agent<\/strong> from the Downloads dropdown menu in the ADI Details page to get the connect key, which is required to complete the upgrade of the agent on the AD server.<\/li>\n<\/ul>\n\n\n\n
\n- When upgrading the AD import agent to version 3.0, existing users connected to the domain will not have their log in delegated to AD unless the Delegated Authority<\/strong> is manually set to Active Directory<\/strong> for those existing users.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- The delegated authentication setting, Delegated Password Validation<\/strong>, is enabled by default for this ADI configuration and cannot be disabled.<\/li>\n\n\n\n
- When the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and active: \n
\n- All users imported by import agent v3.0.0 or higher will have their Delegated Authority<\/strong> automatically set to Active Directory<\/strong> and their login to the JumpCloud User Portal and SSO login delegated to AD for validation.<\/li>\n\n\n\n
- Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegation is enabled for them.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
General Installation Considerations<\/h3>\n\n\n\n<\/p><\/div>
Warning:<\/strong> \nAll installed import agents should be the same version to avoid unexpected behavior or the potential for users not being able to log in if the primary agent is switched.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Non-standard ASCII characters are not supported in the Root User DN.<\/li>\n\n\n\n
- When upgrading an import agent, the installation wizard prompts for minimal information:\n
\n- Agent connect key, when upgrading from import agent v2.6.0 or lower.<\/li>\n\n\n\n
- Directory for where the installation should occur.<\/li>\n\n\n\n
- Finish screen.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Warning:<\/strong> \nThe Connect Key will expire in 7 days if it is not used.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Demoting a DC installation to a member server and promoting a member server installation to a DC aren\u2019t supported. The agent(s) must be uninstalled first and then installed on the other type of server.<\/li>\n\n\n\n
- A reinstall of the same ADI import agent is treated as an update.<\/li>\n\n\n\n
- User passwords must be managed in AD.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.<\/li>\n<\/ul>\n\n\n\n
Member Server Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on member servers:<\/p>\n\n\n\n
\n- The AD password does<\/strong> NOT<\/strong> sync from AD to JumpCloud. Users imported and synced from AD will not have a password in JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Domain Controller (DC) Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on DCs:<\/p>\n\n\n\n
\n- An import agent must be installed on all<\/em><\/strong> Domain Controllers. <\/li>\n\n\n\n
- Downtime should be scheduled. The installation requires a server reboot.<\/li>\n\n\n\n
- AD passwords will<\/strong> sync from AD to JumpCloud. This means that the password will be managed in AD and stored in both AD and JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Security Considerations<\/h3>\n\n\n\n\n- We STRONGLY recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/li>\n\n\n\n
- We recommend periodically rotating the password for the server account used by the integration (e.g., jcimport<\/strong>)for security reasons.<\/li>\n\n\n\n
- API tokens are specific to each Admin account. Use a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Warning:<\/strong> \nIf the JumpCloud Administrator Account associated with the import is deleted or the API key is rotated, the import will stop working. All imports will fail until a valid API key is generated and updated in the registry on the AD servers.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Password Considerations<\/h3>\n\n\n\n\n- Users imported and synced from AD to JumpCloud will have their Password Authority<\/strong> set to Active Directory<\/strong>, which means a password cannot be created or changed in JumpCloud by either a JumpCloud Admin or an end-user. The password can only be created and updated in AD.<\/li>\n<\/ul>\n\n\n\n
\n- When the JumpCloud AD import agent is installed on member servers<\/strong>, the AD password does NOT <\/strong>sync to JumpCloud. The password will only be in AD.\n
\n- In this configuration, the user\u2019s Password Authority<\/strong> should also be set to Active Directory<\/strong> to prevent a password from being entered in JumpCloud by either a JumpCloud Admin or the end user.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\n- When the JumpCloud AD import agent is installed on all DCs<\/strong>, the AD password does<\/strong> sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud. \n
\n- When passwords are imported and synced from AD to JumpCloud:\n
\n- Passwords are still managed in AD.<\/li>\n\n\n\n
- Password complexity requirements in AD and JumpCloud should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.<\/li>\n\n\n\n
- If you set a password expiration policy in JumpCloud, these users will not receive password expiration notifications automatically.<\/li>\n\n\n\n
- Sending password expiration notifications from JumpCloud is not recommended. You can send notifications manually by going to users \u00bb select expiring users \u00bb resend email<\/strong>.<\/li>\n\n\n\n
- Users with their password authority set to Active Directory managed by AD are restricted from changing their password in JumpCloud, with the exception of the link from the password expiration notification.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Note:<\/strong> \n\n- If the import agent is installed on DCs<\/strong>, the password is stored<\/strong> in JumpCloud after the initial log in. The stored password continues to be synced from AD to JumpCloud and from JumpCloud to other resources. The password can be used to log in to resources that don\u2019t support delegated authentication to AD, such as Cloud RADIUS, Cloud LDAP, and devices.<\/li>\n<\/ul>\n\n\n\n
\n- If the import agent is installed on AD member servers<\/strong>, the password is never stored <\/strong>in JumpCloud.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Import Considerations<\/h3>\n\n\n\n\n- We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory\n
\n- If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your JumpCloud instance, along with any associated data and resource associations<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The JumpCloud ADI import agent services use TLS for all communication. If no network connectivity exists to JumpCloud, the ADI will fail to sync and will not work properly.<\/li>\n\n\n\n
- Users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty, otherwise the users will fail to sync from AD to JumpCloud.<\/li>\n\n\n\n
- When multiple AD import agents are installed, one is designated as the primary agent by the ADI service for all user, group, delegated authentication, and password related actions (directives) performed by the import agent. If the primary import agent becomes unavailable, another active import agent is automatically designated as the primary.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.\n
\n- The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>. <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- To enable successful AD user imports, you must ensure that User Settings > Default Password Authority<\/strong> is set to None (JumpCloud)<\/strong> <\/li>\n\n\n\n
- You can manage users in 2 ways:\n
\n- Individually by adding them to the security group created for this integration, located in the designated OU <\/li>\n\n\n\n
- Using groups located in or nested in the designated Root user container by adding those groups as a member of the JumpCloud Integration Security Group.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- ADI Import Agent settings in the jcadimportagent.config.json<\/strong> file control the behaviors that occur in JumpCloud when certain actions are taken on the user in AD.\n
\n- Removing users from the JumpCloud integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Importing privileged user accounts<\/a>, such as Domain Admins and accounts with \u201cadminCount=1\u201d, into JumpCloud from AD or managing them in AD from JumpCloud, isn\u2019t supported. <\/li>\n<\/ul>\n\n\n\n
Attributes<\/h2>\n\n\n\nThe user attributes that sync from AD to JumpCloud are:<\/p>\n\n\n\n
\n- First Name<\/li>\n\n\n\n
- Last Name<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Email<\/li>\n<\/ul>\n\n\n\n
If the SyncAdditionalAttributes<\/strong> setting is true<\/strong> in the jcadimportagent.config.json<\/kbd> file, the following attributes are also updated:<\/p>\n\n\n\n
\n- displayname<\/li>\n\n\n\n
- description<\/li>\n\n\n\n
- JobTitle<\/li>\n\n\n\n
- department<\/li>\n\n\n\n
- company<\/li>\n\n\n\n
- location<\/li>\n\n\n\n
- employeeType<\/li>\n\n\n\n
- phoneNumbers<\/li>\n\n\n\n
- addresses<\/li>\n\n\n\n
- manager <\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Note:<\/strong> \nThese attributes become read-only (restrictedFields) in JumpCloud when a user’s Password Authority<\/strong> is set to Active Directory<\/strong>. The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prerequisite Checklist for New Installations<\/h2>\n\n\n\nBefore installing the ADI import agents for the first time, complete the following checklist<\/p>\n\n\n\n
\n- Know your AD Domain Admin credentials.<\/li>\n\n\n\n
- Decide whether you want to install the sync agents on your AD domain\u2019s non-DC Domain Member Servers (member servers) or Domain Controllers (DCs).\n
\n- When installing the import agent on DCs<\/strong>, schedule downtime. <\/strong>Installation requires server reboot! <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Verify you have access to all<\/em> Domain Controllers (DCs) in the AD domain or to the member servers on which you plan to install the import agents.<\/li>\n\n\n\n
- Ensure the servers on which you are installing the import agent are running on a JumpCloud supported 64-bit Windows Server version (2012, 2016, 2019, 2022).<\/li>\n\n\n\n
- Confirm the servers on which you are installing the import agent have networking access to the internet and are able to communicate outbound to console.jumpcloud.com over HTTPS port 443. <\/li>\n\n\n\n
- If installing the import agents on DCs, schedule Downtime \u2013 installation requires a server reboot!<\/li>\n\n\n\n
- Create a dedicated Administrator account<\/a> in JumpCloud that is specifically for the ADI.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nAPI tokens are specific to each Admin account. Create a dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Generate and securely store the API key<\/a> for the ADI dedicated Administration account.<\/li>\n\n\n\n
- Verify all users to be synced from AD to JumpCloud have a value for first name and last name in AD.<\/li>\n\n\n\n
- If you install the import agents on DCs, align password complexity requirements between AD and JumpCloud as closely as possible. Otherwise, passwords may not replicate if they\u2019re rejected by the destination directory\u2019s complexity requirements.<\/li>\n\n\n\n
- [Recommended<\/strong>] Verify all users you plan to import into JumpCloud live in a single OU or are nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory. <\/li>\n\n\n\n
- Review Advanced Configurations for the Active Directory Import Agent<\/a> to understand the configuration settings available for the import agent and note any default values that need to be changed as part of the installation. <\/li>\n\n\n\n
- [STRONGLY recommended<\/strong>] Install LDAPS<\/a>.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nWe STRONGLY<\/strong> recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare AD for the Import Agent Installations<\/h2>\n\n\n\nTo import and update user identities, attributes, and user groups from AD into JumpCloud, you’ll need to install a JumpCloud AD import agent on your non-DC Domain Member Servers (member servers) or all<\/em> Domain Controllers (DCs) within your domain. Complete the steps below to prepare for installing the agents on your servers.<\/p>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nPasswords can only be synced from AD to JumpCloud if the import agent is installed on a DC. When installing on DCs, an import agent must be installed on all<\/strong><\/em> DCs.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare for the AD Import Agent Installation in AD<\/strong><\/h3>\n\n\n\n
<\/figure>\n\n\n\nAD Import Agent Only \u2013 Multiple Domain Workflow<\/strong><\/h3>\n\n\n\n<\/figure>\n\n\n\nTo learn more about the general user identity workflow and expected behavior for any user, group, and password change in AD and in JumpCloud read Use and Manage the Active Directory Integration (ADI)<\/a> . <\/p>\n\n\n\n
System Requirements<\/strong><\/h2>\n\n\n\n\n- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n
\n- Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the \/msiexec<\/strong> parameter when running the agent installer<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- 15MB disk space<\/li>\n\n\n\n
- 10MB RAM<\/li>\n<\/ul>\n\n\n\n
New Installation Overview<\/h2>\n\n\n\nThe main steps you will take to install and configure ADI for a one-way sync from AD to JumpCloud are:<\/p>\n\n\n\n
\n- Determine on which servers the AD import agents will be installed: member servers or domain controllers (DCs).<\/li>\n\n\n\n
- Complete the prerequisite checklist.<\/li>\n\n\n\n
- Determine the Root User Container in AD. <\/li>\n\n\n\n
- Create the JumpCloud ADI Integration Security Group in AD.<\/li>\n\n\n\n
- Create the AD Import Service Account.<\/li>\n\n\n\n
- Delegate read-only control for the JumpCloud import account.<\/li>\n\n\n\n
- Create an ADI domain instance in JumpCloud.<\/li>\n\n\n\n
- Select your configuration and follow the installation steps and download the import agent<\/li>\n\n\n\n
- Run the the AD Import Agent installation wizard<\/li>\n\n\n\n
- Reboot the servers on which the agent was installed.<\/li>\n\n\n\n
- Verify the Import Agent Service started on each AD server.<\/li>\n\n\n\n
- Complete post-installation AD import agent configuration on each AD server.<\/li>\n\n\n\n
- Verify the AD import.<\/li>\n<\/ol>\n\n\n\n
Considerations<\/strong><\/h2>\n\n\n\nAgent Version Considerations<\/h3>\n\n\n\n\n- As of import agent v2.2.1, the following changes were made:\n
\n- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration.<\/li>\n\n\n\n
- All references to AD Bridge changed to AD Import.<\/li>\n\n\n\n
- The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Import agent v3.0.0 and higher supports delegated user authentication to AD.<\/li>\n<\/ul>\n\n\n\n
Delegated Authentication Considerations<\/h3>\n\n\n\n
Warning:<\/strong> \nWhen the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and Pending<\/strong> for the ADI configuration and the user’s Delegated Authority<\/strong> is Active Directory<\/strong>, the user will not be able to log in. An AD import agent, version 3.0 or higher, must be installed and active to change the status of Delegated Password Validation<\/strong> from Pending<\/strong> to Active<\/strong>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \n\n- When upgrading from AD import agent v2.6.0 or lower, you must select Install New Agent<\/strong> from the Downloads dropdown menu in the ADI Details page to get the connect key, which is required to complete the upgrade of the agent on the AD server.<\/li>\n<\/ul>\n\n\n\n
\n- When upgrading the AD import agent to version 3.0, existing users connected to the domain will not have their log in delegated to AD unless the Delegated Authority<\/strong> is manually set to Active Directory<\/strong> for those existing users.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- The delegated authentication setting, Delegated Password Validation<\/strong>, is enabled by default for this ADI configuration and cannot be disabled.<\/li>\n\n\n\n
- When the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and active: \n
\n- All users imported by import agent v3.0.0 or higher will have their Delegated Authority<\/strong> automatically set to Active Directory<\/strong> and their login to the JumpCloud User Portal and SSO login delegated to AD for validation.<\/li>\n\n\n\n
- Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegation is enabled for them.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
General Installation Considerations<\/h3>\n\n\n\n<\/p><\/div>
Warning:<\/strong> \nAll installed import agents should be the same version to avoid unexpected behavior or the potential for users not being able to log in if the primary agent is switched.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Non-standard ASCII characters are not supported in the Root User DN.<\/li>\n\n\n\n
- When upgrading an import agent, the installation wizard prompts for minimal information:\n
\n- Agent connect key, when upgrading from import agent v2.6.0 or lower.<\/li>\n\n\n\n
- Directory for where the installation should occur.<\/li>\n\n\n\n
- Finish screen.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Warning:<\/strong> \nThe Connect Key will expire in 7 days if it is not used.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Demoting a DC installation to a member server and promoting a member server installation to a DC aren\u2019t supported. The agent(s) must be uninstalled first and then installed on the other type of server.<\/li>\n\n\n\n
- A reinstall of the same ADI import agent is treated as an update.<\/li>\n\n\n\n
- User passwords must be managed in AD.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.<\/li>\n<\/ul>\n\n\n\n
Member Server Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on member servers:<\/p>\n\n\n\n
\n- The AD password does<\/strong> NOT<\/strong> sync from AD to JumpCloud. Users imported and synced from AD will not have a password in JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Domain Controller (DC) Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on DCs:<\/p>\n\n\n\n
\n- An import agent must be installed on all<\/em><\/strong> Domain Controllers. <\/li>\n\n\n\n
- Downtime should be scheduled. The installation requires a server reboot.<\/li>\n\n\n\n
- AD passwords will<\/strong> sync from AD to JumpCloud. This means that the password will be managed in AD and stored in both AD and JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Security Considerations<\/h3>\n\n\n\n\n- We STRONGLY recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/li>\n\n\n\n
- We recommend periodically rotating the password for the server account used by the integration (e.g., jcimport<\/strong>)for security reasons.<\/li>\n\n\n\n
- API tokens are specific to each Admin account. Use a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Warning:<\/strong> \nIf the JumpCloud Administrator Account associated with the import is deleted or the API key is rotated, the import will stop working. All imports will fail until a valid API key is generated and updated in the registry on the AD servers.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Password Considerations<\/h3>\n\n\n\n\n- Users imported and synced from AD to JumpCloud will have their Password Authority<\/strong> set to Active Directory<\/strong>, which means a password cannot be created or changed in JumpCloud by either a JumpCloud Admin or an end-user. The password can only be created and updated in AD.<\/li>\n<\/ul>\n\n\n\n
\n- When the JumpCloud AD import agent is installed on member servers<\/strong>, the AD password does NOT <\/strong>sync to JumpCloud. The password will only be in AD.\n
\n- In this configuration, the user\u2019s Password Authority<\/strong> should also be set to Active Directory<\/strong> to prevent a password from being entered in JumpCloud by either a JumpCloud Admin or the end user.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\n- When the JumpCloud AD import agent is installed on all DCs<\/strong>, the AD password does<\/strong> sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud. \n
\n- When passwords are imported and synced from AD to JumpCloud:\n
\n- Passwords are still managed in AD.<\/li>\n\n\n\n
- Password complexity requirements in AD and JumpCloud should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.<\/li>\n\n\n\n
- If you set a password expiration policy in JumpCloud, these users will not receive password expiration notifications automatically.<\/li>\n\n\n\n
- Sending password expiration notifications from JumpCloud is not recommended. You can send notifications manually by going to users \u00bb select expiring users \u00bb resend email<\/strong>.<\/li>\n\n\n\n
- Users with their password authority set to Active Directory managed by AD are restricted from changing their password in JumpCloud, with the exception of the link from the password expiration notification.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Note:<\/strong> \n\n- If the import agent is installed on DCs<\/strong>, the password is stored<\/strong> in JumpCloud after the initial log in. The stored password continues to be synced from AD to JumpCloud and from JumpCloud to other resources. The password can be used to log in to resources that don\u2019t support delegated authentication to AD, such as Cloud RADIUS, Cloud LDAP, and devices.<\/li>\n<\/ul>\n\n\n\n
\n- If the import agent is installed on AD member servers<\/strong>, the password is never stored <\/strong>in JumpCloud.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Import Considerations<\/h3>\n\n\n\n\n- We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory\n
\n- If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your JumpCloud instance, along with any associated data and resource associations<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The JumpCloud ADI import agent services use TLS for all communication. If no network connectivity exists to JumpCloud, the ADI will fail to sync and will not work properly.<\/li>\n\n\n\n
- Users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty, otherwise the users will fail to sync from AD to JumpCloud.<\/li>\n\n\n\n
- When multiple AD import agents are installed, one is designated as the primary agent by the ADI service for all user, group, delegated authentication, and password related actions (directives) performed by the import agent. If the primary import agent becomes unavailable, another active import agent is automatically designated as the primary.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.\n
\n- The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>. <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- To enable successful AD user imports, you must ensure that User Settings > Default Password Authority<\/strong> is set to None (JumpCloud)<\/strong> <\/li>\n\n\n\n
- You can manage users in 2 ways:\n
\n- Individually by adding them to the security group created for this integration, located in the designated OU <\/li>\n\n\n\n
- Using groups located in or nested in the designated Root user container by adding those groups as a member of the JumpCloud Integration Security Group.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- ADI Import Agent settings in the jcadimportagent.config.json<\/strong> file control the behaviors that occur in JumpCloud when certain actions are taken on the user in AD.\n
\n- Removing users from the JumpCloud integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Importing privileged user accounts<\/a>, such as Domain Admins and accounts with \u201cadminCount=1\u201d, into JumpCloud from AD or managing them in AD from JumpCloud, isn\u2019t supported. <\/li>\n<\/ul>\n\n\n\n
Attributes<\/h2>\n\n\n\nThe user attributes that sync from AD to JumpCloud are:<\/p>\n\n\n\n
\n- First Name<\/li>\n\n\n\n
- Last Name<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Email<\/li>\n<\/ul>\n\n\n\n
If the SyncAdditionalAttributes<\/strong> setting is true<\/strong> in the jcadimportagent.config.json<\/kbd> file, the following attributes are also updated:<\/p>\n\n\n\n
\n- displayname<\/li>\n\n\n\n
- description<\/li>\n\n\n\n
- JobTitle<\/li>\n\n\n\n
- department<\/li>\n\n\n\n
- company<\/li>\n\n\n\n
- location<\/li>\n\n\n\n
- employeeType<\/li>\n\n\n\n
- phoneNumbers<\/li>\n\n\n\n
- addresses<\/li>\n\n\n\n
- manager <\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Note:<\/strong> \nThese attributes become read-only (restrictedFields) in JumpCloud when a user’s Password Authority<\/strong> is set to Active Directory<\/strong>. The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prerequisite Checklist for New Installations<\/h2>\n\n\n\nBefore installing the ADI import agents for the first time, complete the following checklist<\/p>\n\n\n\n
\n- Know your AD Domain Admin credentials.<\/li>\n\n\n\n
- Decide whether you want to install the sync agents on your AD domain\u2019s non-DC Domain Member Servers (member servers) or Domain Controllers (DCs).\n
\n- When installing the import agent on DCs<\/strong>, schedule downtime. <\/strong>Installation requires server reboot! <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Verify you have access to all<\/em> Domain Controllers (DCs) in the AD domain or to the member servers on which you plan to install the import agents.<\/li>\n\n\n\n
- Ensure the servers on which you are installing the import agent are running on a JumpCloud supported 64-bit Windows Server version (2012, 2016, 2019, 2022).<\/li>\n\n\n\n
- Confirm the servers on which you are installing the import agent have networking access to the internet and are able to communicate outbound to console.jumpcloud.com over HTTPS port 443. <\/li>\n\n\n\n
- If installing the import agents on DCs, schedule Downtime \u2013 installation requires a server reboot!<\/li>\n\n\n\n
- Create a dedicated Administrator account<\/a> in JumpCloud that is specifically for the ADI.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nAPI tokens are specific to each Admin account. Create a dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Generate and securely store the API key<\/a> for the ADI dedicated Administration account.<\/li>\n\n\n\n
- Verify all users to be synced from AD to JumpCloud have a value for first name and last name in AD.<\/li>\n\n\n\n
- If you install the import agents on DCs, align password complexity requirements between AD and JumpCloud as closely as possible. Otherwise, passwords may not replicate if they\u2019re rejected by the destination directory\u2019s complexity requirements.<\/li>\n\n\n\n
- [Recommended<\/strong>] Verify all users you plan to import into JumpCloud live in a single OU or are nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory. <\/li>\n\n\n\n
- Review Advanced Configurations for the Active Directory Import Agent<\/a> to understand the configuration settings available for the import agent and note any default values that need to be changed as part of the installation. <\/li>\n\n\n\n
- [STRONGLY recommended<\/strong>] Install LDAPS<\/a>.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nWe STRONGLY<\/strong> recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare AD for the Import Agent Installations<\/h2>\n\n\n\nTo import and update user identities, attributes, and user groups from AD into JumpCloud, you’ll need to install a JumpCloud AD import agent on your non-DC Domain Member Servers (member servers) or all<\/em> Domain Controllers (DCs) within your domain. Complete the steps below to prepare for installing the agents on your servers.<\/p>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nPasswords can only be synced from AD to JumpCloud if the import agent is installed on a DC. When installing on DCs, an import agent must be installed on all<\/strong><\/em> DCs.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare for the AD Import Agent Installation in AD<\/strong><\/h3>\n\n\n\n
<\/figure>\n\n\n\nTo learn more about the general user identity workflow and expected behavior for any user, group, and password change in AD and in JumpCloud read Use and Manage the Active Directory Integration (ADI)<\/a> . <\/p>\n\n\n\n
System Requirements<\/strong><\/h2>\n\n\n\n\n- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n
\n- Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the \/msiexec<\/strong> parameter when running the agent installer<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- 15MB disk space<\/li>\n\n\n\n
- 10MB RAM<\/li>\n<\/ul>\n\n\n\n
New Installation Overview<\/h2>\n\n\n\nThe main steps you will take to install and configure ADI for a one-way sync from AD to JumpCloud are:<\/p>\n\n\n\n
\n- Determine on which servers the AD import agents will be installed: member servers or domain controllers (DCs).<\/li>\n\n\n\n
- Complete the prerequisite checklist.<\/li>\n\n\n\n
- Determine the Root User Container in AD. <\/li>\n\n\n\n
- Create the JumpCloud ADI Integration Security Group in AD.<\/li>\n\n\n\n
- Create the AD Import Service Account.<\/li>\n\n\n\n
- Delegate read-only control for the JumpCloud import account.<\/li>\n\n\n\n
- Create an ADI domain instance in JumpCloud.<\/li>\n\n\n\n
- Select your configuration and follow the installation steps and download the import agent<\/li>\n\n\n\n
- Run the the AD Import Agent installation wizard<\/li>\n\n\n\n
- Reboot the servers on which the agent was installed.<\/li>\n\n\n\n
- Verify the Import Agent Service started on each AD server.<\/li>\n\n\n\n
- Complete post-installation AD import agent configuration on each AD server.<\/li>\n\n\n\n
- Verify the AD import.<\/li>\n<\/ol>\n\n\n\n
Considerations<\/strong><\/h2>\n\n\n\nAgent Version Considerations<\/h3>\n\n\n\n\n- As of import agent v2.2.1, the following changes were made:\n
\n- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration.<\/li>\n\n\n\n
- All references to AD Bridge changed to AD Import.<\/li>\n\n\n\n
- The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Import agent v3.0.0 and higher supports delegated user authentication to AD.<\/li>\n<\/ul>\n\n\n\n
Delegated Authentication Considerations<\/h3>\n\n\n\n
Warning:<\/strong> \nWhen the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and Pending<\/strong> for the ADI configuration and the user’s Delegated Authority<\/strong> is Active Directory<\/strong>, the user will not be able to log in. An AD import agent, version 3.0 or higher, must be installed and active to change the status of Delegated Password Validation<\/strong> from Pending<\/strong> to Active<\/strong>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \n\n- When upgrading from AD import agent v2.6.0 or lower, you must select Install New Agent<\/strong> from the Downloads dropdown menu in the ADI Details page to get the connect key, which is required to complete the upgrade of the agent on the AD server.<\/li>\n<\/ul>\n\n\n\n
\n- When upgrading the AD import agent to version 3.0, existing users connected to the domain will not have their log in delegated to AD unless the Delegated Authority<\/strong> is manually set to Active Directory<\/strong> for those existing users.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- The delegated authentication setting, Delegated Password Validation<\/strong>, is enabled by default for this ADI configuration and cannot be disabled.<\/li>\n\n\n\n
- When the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and active: \n
\n- All users imported by import agent v3.0.0 or higher will have their Delegated Authority<\/strong> automatically set to Active Directory<\/strong> and their login to the JumpCloud User Portal and SSO login delegated to AD for validation.<\/li>\n\n\n\n
- Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegation is enabled for them.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
General Installation Considerations<\/h3>\n\n\n\n<\/p><\/div>
Warning:<\/strong> \nAll installed import agents should be the same version to avoid unexpected behavior or the potential for users not being able to log in if the primary agent is switched.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Non-standard ASCII characters are not supported in the Root User DN.<\/li>\n\n\n\n
- When upgrading an import agent, the installation wizard prompts for minimal information:\n
\n- Agent connect key, when upgrading from import agent v2.6.0 or lower.<\/li>\n\n\n\n
- Directory for where the installation should occur.<\/li>\n\n\n\n
- Finish screen.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Warning:<\/strong> \nThe Connect Key will expire in 7 days if it is not used.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Demoting a DC installation to a member server and promoting a member server installation to a DC aren\u2019t supported. The agent(s) must be uninstalled first and then installed on the other type of server.<\/li>\n\n\n\n
- A reinstall of the same ADI import agent is treated as an update.<\/li>\n\n\n\n
- User passwords must be managed in AD.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.<\/li>\n<\/ul>\n\n\n\n
Member Server Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on member servers:<\/p>\n\n\n\n
\n- The AD password does<\/strong> NOT<\/strong> sync from AD to JumpCloud. Users imported and synced from AD will not have a password in JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Domain Controller (DC) Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on DCs:<\/p>\n\n\n\n
\n- An import agent must be installed on all<\/em><\/strong> Domain Controllers. <\/li>\n\n\n\n
- Downtime should be scheduled. The installation requires a server reboot.<\/li>\n\n\n\n
- AD passwords will<\/strong> sync from AD to JumpCloud. This means that the password will be managed in AD and stored in both AD and JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Security Considerations<\/h3>\n\n\n\n\n- We STRONGLY recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/li>\n\n\n\n
- We recommend periodically rotating the password for the server account used by the integration (e.g., jcimport<\/strong>)for security reasons.<\/li>\n\n\n\n
- API tokens are specific to each Admin account. Use a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Warning:<\/strong> \nIf the JumpCloud Administrator Account associated with the import is deleted or the API key is rotated, the import will stop working. All imports will fail until a valid API key is generated and updated in the registry on the AD servers.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Password Considerations<\/h3>\n\n\n\n\n- Users imported and synced from AD to JumpCloud will have their Password Authority<\/strong> set to Active Directory<\/strong>, which means a password cannot be created or changed in JumpCloud by either a JumpCloud Admin or an end-user. The password can only be created and updated in AD.<\/li>\n<\/ul>\n\n\n\n
\n- When the JumpCloud AD import agent is installed on member servers<\/strong>, the AD password does NOT <\/strong>sync to JumpCloud. The password will only be in AD.\n
\n- In this configuration, the user\u2019s Password Authority<\/strong> should also be set to Active Directory<\/strong> to prevent a password from being entered in JumpCloud by either a JumpCloud Admin or the end user.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\n- When the JumpCloud AD import agent is installed on all DCs<\/strong>, the AD password does<\/strong> sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud. \n
\n- When passwords are imported and synced from AD to JumpCloud:\n
\n- Passwords are still managed in AD.<\/li>\n\n\n\n
- Password complexity requirements in AD and JumpCloud should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.<\/li>\n\n\n\n
- If you set a password expiration policy in JumpCloud, these users will not receive password expiration notifications automatically.<\/li>\n\n\n\n
- Sending password expiration notifications from JumpCloud is not recommended. You can send notifications manually by going to users \u00bb select expiring users \u00bb resend email<\/strong>.<\/li>\n\n\n\n
- Users with their password authority set to Active Directory managed by AD are restricted from changing their password in JumpCloud, with the exception of the link from the password expiration notification.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Note:<\/strong> \n\n- If the import agent is installed on DCs<\/strong>, the password is stored<\/strong> in JumpCloud after the initial log in. The stored password continues to be synced from AD to JumpCloud and from JumpCloud to other resources. The password can be used to log in to resources that don\u2019t support delegated authentication to AD, such as Cloud RADIUS, Cloud LDAP, and devices.<\/li>\n<\/ul>\n\n\n\n
\n- If the import agent is installed on AD member servers<\/strong>, the password is never stored <\/strong>in JumpCloud.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Import Considerations<\/h3>\n\n\n\n\n- We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory\n
\n- If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your JumpCloud instance, along with any associated data and resource associations<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The JumpCloud ADI import agent services use TLS for all communication. If no network connectivity exists to JumpCloud, the ADI will fail to sync and will not work properly.<\/li>\n\n\n\n
- Users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty, otherwise the users will fail to sync from AD to JumpCloud.<\/li>\n\n\n\n
- When multiple AD import agents are installed, one is designated as the primary agent by the ADI service for all user, group, delegated authentication, and password related actions (directives) performed by the import agent. If the primary import agent becomes unavailable, another active import agent is automatically designated as the primary.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.\n
\n- The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>. <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- To enable successful AD user imports, you must ensure that User Settings > Default Password Authority<\/strong> is set to None (JumpCloud)<\/strong> <\/li>\n\n\n\n
- You can manage users in 2 ways:\n
\n- Individually by adding them to the security group created for this integration, located in the designated OU <\/li>\n\n\n\n
- Using groups located in or nested in the designated Root user container by adding those groups as a member of the JumpCloud Integration Security Group.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- ADI Import Agent settings in the jcadimportagent.config.json<\/strong> file control the behaviors that occur in JumpCloud when certain actions are taken on the user in AD.\n
\n- Removing users from the JumpCloud integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Importing privileged user accounts<\/a>, such as Domain Admins and accounts with \u201cadminCount=1\u201d, into JumpCloud from AD or managing them in AD from JumpCloud, isn\u2019t supported. <\/li>\n<\/ul>\n\n\n\n
Attributes<\/h2>\n\n\n\nThe user attributes that sync from AD to JumpCloud are:<\/p>\n\n\n\n
\n- First Name<\/li>\n\n\n\n
- Last Name<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Email<\/li>\n<\/ul>\n\n\n\n
If the SyncAdditionalAttributes<\/strong> setting is true<\/strong> in the jcadimportagent.config.json<\/kbd> file, the following attributes are also updated:<\/p>\n\n\n\n
\n- displayname<\/li>\n\n\n\n
- description<\/li>\n\n\n\n
- JobTitle<\/li>\n\n\n\n
- department<\/li>\n\n\n\n
- company<\/li>\n\n\n\n
- location<\/li>\n\n\n\n
- employeeType<\/li>\n\n\n\n
- phoneNumbers<\/li>\n\n\n\n
- addresses<\/li>\n\n\n\n
- manager <\/li>\n<\/ul>\n\n\n\n
<\/p><\/div>
Note:<\/strong> \nThese attributes become read-only (restrictedFields) in JumpCloud when a user’s Password Authority<\/strong> is set to Active Directory<\/strong>. The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prerequisite Checklist for New Installations<\/h2>\n\n\n\nBefore installing the ADI import agents for the first time, complete the following checklist<\/p>\n\n\n\n
\n- Know your AD Domain Admin credentials.<\/li>\n\n\n\n
- Decide whether you want to install the sync agents on your AD domain\u2019s non-DC Domain Member Servers (member servers) or Domain Controllers (DCs).\n
\n- When installing the import agent on DCs<\/strong>, schedule downtime. <\/strong>Installation requires server reboot! <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Verify you have access to all<\/em> Domain Controllers (DCs) in the AD domain or to the member servers on which you plan to install the import agents.<\/li>\n\n\n\n
- Ensure the servers on which you are installing the import agent are running on a JumpCloud supported 64-bit Windows Server version (2012, 2016, 2019, 2022).<\/li>\n\n\n\n
- Confirm the servers on which you are installing the import agent have networking access to the internet and are able to communicate outbound to console.jumpcloud.com over HTTPS port 443. <\/li>\n\n\n\n
- If installing the import agents on DCs, schedule Downtime \u2013 installation requires a server reboot!<\/li>\n\n\n\n
- Create a dedicated Administrator account<\/a> in JumpCloud that is specifically for the ADI.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nAPI tokens are specific to each Admin account. Create a dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- Generate and securely store the API key<\/a> for the ADI dedicated Administration account.<\/li>\n\n\n\n
- Verify all users to be synced from AD to JumpCloud have a value for first name and last name in AD.<\/li>\n\n\n\n
- If you install the import agents on DCs, align password complexity requirements between AD and JumpCloud as closely as possible. Otherwise, passwords may not replicate if they\u2019re rejected by the destination directory\u2019s complexity requirements.<\/li>\n\n\n\n
- [Recommended<\/strong>] Verify all users you plan to import into JumpCloud live in a single OU or are nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory. <\/li>\n\n\n\n
- Review Advanced Configurations for the Active Directory Import Agent<\/a> to understand the configuration settings available for the import agent and note any default values that need to be changed as part of the installation. <\/li>\n\n\n\n
- [STRONGLY recommended<\/strong>] Install LDAPS<\/a>.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nWe STRONGLY<\/strong> recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare AD for the Import Agent Installations<\/h2>\n\n\n\nTo import and update user identities, attributes, and user groups from AD into JumpCloud, you’ll need to install a JumpCloud AD import agent on your non-DC Domain Member Servers (member servers) or all<\/em> Domain Controllers (DCs) within your domain. Complete the steps below to prepare for installing the agents on your servers.<\/p>\n\n\n\n
<\/p><\/div>
Important:<\/strong> \nPasswords can only be synced from AD to JumpCloud if the import agent is installed on a DC. When installing on DCs, an import agent must be installed on all<\/strong><\/em> DCs.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare for the AD Import Agent Installation in AD<\/strong><\/h3>\n\n\n\n
- \n
- Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the \/msiexec<\/strong> parameter when running the agent installer<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- 15MB disk space<\/li>\n\n\n\n
- 10MB RAM<\/li>\n<\/ul>\n\n\n\n
New Installation Overview<\/h2>\n\n\n\n
The main steps you will take to install and configure ADI for a one-way sync from AD to JumpCloud are:<\/p>\n\n\n\n
- \n
- Determine on which servers the AD import agents will be installed: member servers or domain controllers (DCs).<\/li>\n\n\n\n
- Complete the prerequisite checklist.<\/li>\n\n\n\n
- Determine the Root User Container in AD. <\/li>\n\n\n\n
- Create the JumpCloud ADI Integration Security Group in AD.<\/li>\n\n\n\n
- Create the AD Import Service Account.<\/li>\n\n\n\n
- Delegate read-only control for the JumpCloud import account.<\/li>\n\n\n\n
- Create an ADI domain instance in JumpCloud.<\/li>\n\n\n\n
- Select your configuration and follow the installation steps and download the import agent<\/li>\n\n\n\n
- Run the the AD Import Agent installation wizard<\/li>\n\n\n\n
- Reboot the servers on which the agent was installed.<\/li>\n\n\n\n
- Verify the Import Agent Service started on each AD server.<\/li>\n\n\n\n
- Complete post-installation AD import agent configuration on each AD server.<\/li>\n\n\n\n
- Verify the AD import.<\/li>\n<\/ol>\n\n\n\n
Considerations<\/strong><\/h2>\n\n\n\n
Agent Version Considerations<\/h3>\n\n\n\n
- \n
- As of import agent v2.2.1, the following changes were made:\n
- \n
- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration.<\/li>\n\n\n\n
- All references to AD Bridge changed to AD Import.<\/li>\n\n\n\n
- The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Import agent v3.0.0 and higher supports delegated user authentication to AD.<\/li>\n<\/ul>\n\n\n\n
Delegated Authentication Considerations<\/h3>\n\n\n\n
Warning:<\/strong> \nWhen the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and Pending<\/strong> for the ADI configuration and the user’s Delegated Authority<\/strong> is Active Directory<\/strong>, the user will not be able to log in. An AD import agent, version 3.0 or higher, must be installed and active to change the status of Delegated Password Validation<\/strong> from Pending<\/strong> to Active<\/strong>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
<\/p><\/div>Important:<\/strong> \n- \n
- When upgrading from AD import agent v2.6.0 or lower, you must select Install New Agent<\/strong> from the Downloads dropdown menu in the ADI Details page to get the connect key, which is required to complete the upgrade of the agent on the AD server.<\/li>\n<\/ul>\n\n\n\n
- \n
- When upgrading the AD import agent to version 3.0, existing users connected to the domain will not have their log in delegated to AD unless the Delegated Authority<\/strong> is manually set to Active Directory<\/strong> for those existing users.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- The delegated authentication setting, Delegated Password Validation<\/strong>, is enabled by default for this ADI configuration and cannot be disabled.<\/li>\n\n\n\n
- When the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and active: \n
- \n
- All users imported by import agent v3.0.0 or higher will have their Delegated Authority<\/strong> automatically set to Active Directory<\/strong> and their login to the JumpCloud User Portal and SSO login delegated to AD for validation.<\/li>\n\n\n\n
- Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegation is enabled for them.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
General Installation Considerations<\/h3>\n\n\n\n
<\/p><\/div>Warning:<\/strong> \nAll installed import agents should be the same version to avoid unexpected behavior or the potential for users not being able to log in if the primary agent is switched.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Non-standard ASCII characters are not supported in the Root User DN.<\/li>\n\n\n\n
- When upgrading an import agent, the installation wizard prompts for minimal information:\n
- \n
- Agent connect key, when upgrading from import agent v2.6.0 or lower.<\/li>\n\n\n\n
- Directory for where the installation should occur.<\/li>\n\n\n\n
- Finish screen.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Warning:<\/strong> \n
The Connect Key will expire in 7 days if it is not used.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Demoting a DC installation to a member server and promoting a member server installation to a DC aren\u2019t supported. The agent(s) must be uninstalled first and then installed on the other type of server.<\/li>\n\n\n\n
- A reinstall of the same ADI import agent is treated as an update.<\/li>\n\n\n\n
- User passwords must be managed in AD.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.<\/li>\n<\/ul>\n\n\n\n
Member Server Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on member servers:<\/p>\n\n\n\n
- \n
- The AD password does<\/strong> NOT<\/strong> sync from AD to JumpCloud. Users imported and synced from AD will not have a password in JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Domain Controller (DC) Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the import agents on DCs:<\/p>\n\n\n\n
- \n
- An import agent must be installed on all<\/em><\/strong> Domain Controllers. <\/li>\n\n\n\n
- Downtime should be scheduled. The installation requires a server reboot.<\/li>\n\n\n\n
- AD passwords will<\/strong> sync from AD to JumpCloud. This means that the password will be managed in AD and stored in both AD and JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Security Considerations<\/h3>\n\n\n\n
- \n
- We STRONGLY recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/li>\n\n\n\n
- We recommend periodically rotating the password for the server account used by the integration (e.g., jcimport<\/strong>)for security reasons.<\/li>\n\n\n\n
- API tokens are specific to each Admin account. Use a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Warning:<\/strong> \n
If the JumpCloud Administrator Account associated with the import is deleted or the API key is rotated, the import will stop working. All imports will fail until a valid API key is generated and updated in the registry on the AD servers.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Password Considerations<\/h3>\n\n\n\n
- \n
- Users imported and synced from AD to JumpCloud will have their Password Authority<\/strong> set to Active Directory<\/strong>, which means a password cannot be created or changed in JumpCloud by either a JumpCloud Admin or an end-user. The password can only be created and updated in AD.<\/li>\n<\/ul>\n\n\n\n
- \n
- When the JumpCloud AD import agent is installed on member servers<\/strong>, the AD password does NOT <\/strong>sync to JumpCloud. The password will only be in AD.\n
- \n
- In this configuration, the user\u2019s Password Authority<\/strong> should also be set to Active Directory<\/strong> to prevent a password from being entered in JumpCloud by either a JumpCloud Admin or the end user.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- \n
- When the JumpCloud AD import agent is installed on all DCs<\/strong>, the AD password does<\/strong> sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud. \n
- \n
- When passwords are imported and synced from AD to JumpCloud:\n
- \n
- Passwords are still managed in AD.<\/li>\n\n\n\n
- Password complexity requirements in AD and JumpCloud should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.<\/li>\n\n\n\n
- If you set a password expiration policy in JumpCloud, these users will not receive password expiration notifications automatically.<\/li>\n\n\n\n
- Sending password expiration notifications from JumpCloud is not recommended. You can send notifications manually by going to users \u00bb select expiring users \u00bb resend email<\/strong>.<\/li>\n\n\n\n
- Users with their password authority set to Active Directory managed by AD are restricted from changing their password in JumpCloud, with the exception of the link from the password expiration notification.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
- \n
- If the import agent is installed on DCs<\/strong>, the password is stored<\/strong> in JumpCloud after the initial log in. The stored password continues to be synced from AD to JumpCloud and from JumpCloud to other resources. The password can be used to log in to resources that don\u2019t support delegated authentication to AD, such as Cloud RADIUS, Cloud LDAP, and devices.<\/li>\n<\/ul>\n\n\n\n
- \n
- If the import agent is installed on AD member servers<\/strong>, the password is never stored <\/strong>in JumpCloud.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Import Considerations<\/h3>\n\n\n\n
- \n
- We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory\n
- \n
- If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your JumpCloud instance, along with any associated data and resource associations<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- The JumpCloud ADI import agent services use TLS for all communication. If no network connectivity exists to JumpCloud, the ADI will fail to sync and will not work properly.<\/li>\n\n\n\n
- Users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty, otherwise the users will fail to sync from AD to JumpCloud.<\/li>\n\n\n\n
- When multiple AD import agents are installed, one is designated as the primary agent by the ADI service for all user, group, delegated authentication, and password related actions (directives) performed by the import agent. If the primary import agent becomes unavailable, another active import agent is automatically designated as the primary.<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.\n
- \n
- The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>. <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- To enable successful AD user imports, you must ensure that User Settings > Default Password Authority<\/strong> is set to None (JumpCloud)<\/strong> <\/li>\n\n\n\n
- You can manage users in 2 ways:\n
- \n
- Individually by adding them to the security group created for this integration, located in the designated OU <\/li>\n\n\n\n
- Using groups located in or nested in the designated Root user container by adding those groups as a member of the JumpCloud Integration Security Group.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- ADI Import Agent settings in the jcadimportagent.config.json<\/strong> file control the behaviors that occur in JumpCloud when certain actions are taken on the user in AD.\n
- \n
- Removing users from the JumpCloud integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Importing privileged user accounts<\/a>, such as Domain Admins and accounts with \u201cadminCount=1\u201d, into JumpCloud from AD or managing them in AD from JumpCloud, isn\u2019t supported. <\/li>\n<\/ul>\n\n\n\n
Attributes<\/h2>\n\n\n\n
The user attributes that sync from AD to JumpCloud are:<\/p>\n\n\n\n
- \n
- First Name<\/li>\n\n\n\n
- Last Name<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Email<\/li>\n<\/ul>\n\n\n\n
If the SyncAdditionalAttributes<\/strong> setting is true<\/strong> in the jcadimportagent.config.json<\/kbd> file, the following attributes are also updated:<\/p>\n\n\n\n
- \n
- displayname<\/li>\n\n\n\n
- description<\/li>\n\n\n\n
- JobTitle<\/li>\n\n\n\n
- department<\/li>\n\n\n\n
- company<\/li>\n\n\n\n
- location<\/li>\n\n\n\n
- employeeType<\/li>\n\n\n\n
- phoneNumbers<\/li>\n\n\n\n
- addresses<\/li>\n\n\n\n
- manager <\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
These attributes become read-only (restrictedFields) in JumpCloud when a user’s Password Authority<\/strong> is set to Active Directory<\/strong>. The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prerequisite Checklist for New Installations<\/h2>\n\n\n\n
Before installing the ADI import agents for the first time, complete the following checklist<\/p>\n\n\n\n
- \n
- Know your AD Domain Admin credentials.<\/li>\n\n\n\n
- Decide whether you want to install the sync agents on your AD domain\u2019s non-DC Domain Member Servers (member servers) or Domain Controllers (DCs).\n
- \n
- When installing the import agent on DCs<\/strong>, schedule downtime. <\/strong>Installation requires server reboot! <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Verify you have access to all<\/em> Domain Controllers (DCs) in the AD domain or to the member servers on which you plan to install the import agents.<\/li>\n\n\n\n
- Ensure the servers on which you are installing the import agent are running on a JumpCloud supported 64-bit Windows Server version (2012, 2016, 2019, 2022).<\/li>\n\n\n\n
- Confirm the servers on which you are installing the import agent have networking access to the internet and are able to communicate outbound to console.jumpcloud.com over HTTPS port 443. <\/li>\n\n\n\n
- If installing the import agents on DCs, schedule Downtime \u2013 installation requires a server reboot!<\/li>\n\n\n\n
- Create a dedicated Administrator account<\/a> in JumpCloud that is specifically for the ADI.<\/li>\n<\/ol>\n\n\n\n<\/p><\/div>Important:<\/strong> \n
API tokens are specific to each Admin account. Create a dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Generate and securely store the API key<\/a> for the ADI dedicated Administration account.<\/li>\n\n\n\n
- Verify all users to be synced from AD to JumpCloud have a value for first name and last name in AD.<\/li>\n\n\n\n
- If you install the import agents on DCs, align password complexity requirements between AD and JumpCloud as closely as possible. Otherwise, passwords may not replicate if they\u2019re rejected by the destination directory\u2019s complexity requirements.<\/li>\n\n\n\n
- [Recommended<\/strong>] Verify all users you plan to import into JumpCloud live in a single OU or are nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory. <\/li>\n\n\n\n
- Review Advanced Configurations for the Active Directory Import Agent<\/a> to understand the configuration settings available for the import agent and note any default values that need to be changed as part of the installation. <\/li>\n\n\n\n
- [STRONGLY recommended<\/strong>] Install LDAPS<\/a>.<\/li>\n<\/ol>\n\n\n\n<\/p><\/div>Important:<\/strong> \n
We STRONGLY<\/strong> recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare AD for the Import Agent Installations<\/h2>\n\n\n\n
To import and update user identities, attributes, and user groups from AD into JumpCloud, you’ll need to install a JumpCloud AD import agent on your non-DC Domain Member Servers (member servers) or all<\/em> Domain Controllers (DCs) within your domain. Complete the steps below to prepare for installing the agents on your servers.<\/p>\n\n\n\n
<\/p><\/div>Important:<\/strong> \nPasswords can only be synced from AD to JumpCloud if the import agent is installed on a DC. When installing on DCs, an import agent must be installed on all<\/strong><\/em> DCs.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare for the AD Import Agent Installation in AD<\/strong><\/h3>\n\n\n\n
- We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory\n
- If the import agent is installed on AD member servers<\/strong>, the password is never stored <\/strong>in JumpCloud.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- If the import agent is installed on DCs<\/strong>, the password is stored<\/strong> in JumpCloud after the initial log in. The stored password continues to be synced from AD to JumpCloud and from JumpCloud to other resources. The password can be used to log in to resources that don\u2019t support delegated authentication to AD, such as Cloud RADIUS, Cloud LDAP, and devices.<\/li>\n<\/ul>\n\n\n\n
- When passwords are imported and synced from AD to JumpCloud:\n
- When the JumpCloud AD import agent is installed on all DCs<\/strong>, the AD password does<\/strong> sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud. \n
- In this configuration, the user\u2019s Password Authority<\/strong> should also be set to Active Directory<\/strong> to prevent a password from being entered in JumpCloud by either a JumpCloud Admin or the end user.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- When the JumpCloud AD import agent is installed on member servers<\/strong>, the AD password does NOT <\/strong>sync to JumpCloud. The password will only be in AD.\n
- Users imported and synced from AD to JumpCloud will have their Password Authority<\/strong> set to Active Directory<\/strong>, which means a password cannot be created or changed in JumpCloud by either a JumpCloud Admin or an end-user. The password can only be created and updated in AD.<\/li>\n<\/ul>\n\n\n\n
- The AD password does<\/strong> NOT<\/strong> sync from AD to JumpCloud. Users imported and synced from AD will not have a password in JumpCloud.<\/li>\n<\/ul>\n\n\n\n
- When upgrading the AD import agent to version 3.0, existing users connected to the domain will not have their log in delegated to AD unless the Delegated Authority<\/strong> is manually set to Active Directory<\/strong> for those existing users.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- When upgrading from AD import agent v2.6.0 or lower, you must select Install New Agent<\/strong> from the Downloads dropdown menu in the ADI Details page to get the connect key, which is required to complete the upgrade of the agent on the AD server.<\/li>\n<\/ul>\n\n\n\n
- As of import agent v2.2.1, the following changes were made:\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/active-directory-users-computers.jpeg\")
<\/li>\n\n\n\n![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/create-ADI-group-in-AD.jpg\")
<\/figure>\n\n\n\n