Active Directory

This guide describes how to enable and configure Active Directory for Lifecycle Management in Veza, including supported capabilities and required configuration steps.

Overview

Active Directory integration with Lifecycle Management enables automated user provisioning, access management, and de-provisioning capabilities. This includes creating and managing AD users, group memberships, and disabling accounts when employees leave the organization.

Supported Capabilities

Identity Provider Status

Active Directory serves as an Identity Provider in Lifecycle Management workflows and supports custom properties defined in the integration configuration.

Supported Actions

Manage Relationships

Controls relationships between users and Active Directory groups.

  • Entity Types: Active Directory Groups

  • Assignee Types: Active Directory Users

  • Supports Removing Relationships: Yes

Example Use Cases:

  • Add users to specific Active Directory groups to manage access

  • Remove users from groups when access requirements change

Sync Identities

Synchronizes identity attributes between Active Directory and downstream systems.

  • Create Allowed: Yes (New user identities can be created if not found)

  • Supported Attributes:

    • Required (Unique Identifiers):

      • AccountName (No Continuous Sync)

      • DistinguishedName

      • UserPrincipalName

    • Optional:

      • Email, GivenName, DisplayName, SurName, Title

      • Description, ManagerID, PrimaryGroupDN

      • StreetAddress, City, StateOrProvinceName

      • CountryCode, PostalCode, Company

      • PhysicalDeliveryOfficeName, JobTitle

      • Department, CountryOrRegion, Office

Example Use Cases:

  • Create new user accounts when users are added

  • Keep user information synchronized across integrated systems

De-provision Identity

Safely removes or disables access when users leave or no longer need access.

  • Entity Type: Active Directory Users

  • Remove All Relationships: Yes (Removes existing group memberships)

  • De-provisioning Method: Disabled (Users are marked as disabled rather than deleted)

Example Use Cases:

  • Disable accounts when employees leave

  • Remove group memberships while retaining audit information

Configuration Steps

1. Create a Service Account

Create a dedicated AD user with minimum required permissions:

Using Active Directory Users and Computers:

  1. Open Active Directory Users and Computers

  2. Navigate to the target Organizational Unit

  3. Right-click > New > User

  4. Complete the new user details form

    • Recommended name: "Veza AD Lifecycle Manager"

    • Set a strong password

    • Uncheck "User must change password at next logon"

Using PowerShell:

New-ADUser -Name "Veza AD Lifecycle Manager" `
    -Path "OU=<your_OU>,DC=<domain>,DC=<tld>" `
    -GivenName "Veza" `
    -Surname "AD Lifecycle Manager" `
    -SamAccountName "veza-ad-lcm" `
    -AccountPassword (ConvertTo-SecureString -AsPlainText "<password>" -Force) `
    -ChangePasswordAtLogon $False `
    -DisplayName "Veza AD Lifecycle Manager" `
    -Enabled $True

2. Configure Required Permissions

Grant the service account permissions to manage users in the target OUs:

Using Active Directory Users and Computers:

  1. Navigate to the target Organizational Unit

  2. Right-click > Delegate Control

  3. Click Add and enter the service account name

  4. Select these delegated tasks:

    • Create, delete, and manage user accounts

    • Reset user passwords and force password change

    • Read all user information

    • Modify group membership

Using PowerShell:

Import-Module ActiveDirectory
$OrganizationalUnit = "OU=<your_OU>,DC=<domain>,DC=<tld>"
$Users = [GUID]"bf967aba-0de6-11d0-a285-00aa003049e2"
Set-Location AD:

$User = Get-ADUser -Identity "veza-ad-lcm"
$UserSID = [System.Security.Principal.SecurityIdentifier] $User.SID
$Identity = [System.Security.Principal.IdentityReference] $UserSID

# Create permission for managing users
$RuleCreateDeleteUsers = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, "CreateChild, DeleteChild", "Allow", $Users, "All"

# Create permission for password resets
$ResetPassword = [GUID]"00299570-246d-11d0-a768-00aa006e0529"
$RuleResetPassword = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($Identity,
"ExtendedRight", "Allow", $ResetPassword, "Descendents", $Users)

# Apply permissions
$ACL = Get-Acl -Path $OrganizationalUnit
$ACL.AddAccessRule($RuleCreateDeleteUsers)
$ACL.AddAccessRule($RuleResetPassword)
Set-Acl -Path $OrganizationalUnit -AclObject $ACL

3. Configure the Integration in Veza

  1. Navigate to Configurations > Integrations

  2. Either:

    • Create a new Active Directory integration

    • Edit an existing Active Directory integration

  3. Enable Lifecycle Management:

    • Check Enable Lifecycle Management

    • Enter the Lifecycle Management Username (service account created above)

    • Enter the Lifecycle Management Password

  4. Save the configuration

Note: The AD User created for lifecycle management can be the same as the primary AD User created for extraction, provided that the user has all required permissions listed above.

Last updated