Active Directory
This guide describes how to enable and configure Active Directory for Lifecycle Management in Veza, including supported capabilities and required configuration steps.
Overview
Active Directory integration with Lifecycle Management enables automated user provisioning, access management, and de-provisioning capabilities. This includes creating and managing AD users, group memberships, and disabling accounts when employees leave the organization.
Supported Capabilities
Identity Provider Status
Active Directory serves as an Identity Provider in Lifecycle Management workflows and supports custom properties defined in the integration configuration.
Supported Actions
Manage Relationships
Controls relationships between users and Active Directory groups.
Entity Types: Active Directory Groups
Assignee Types: Active Directory Users
Supports Removing Relationships: Yes
Example Use Cases:
Add users to specific Active Directory groups to manage access
Remove users from groups when access requirements change
Sync Identities
Synchronizes identity attributes between Active Directory and downstream systems.
Create Allowed: Yes (New user identities can be created if not found)
Supported Attributes:
Required (Unique Identifiers):
AccountName (No Continuous Sync)
DistinguishedName
UserPrincipalName
Optional:
Email, GivenName, DisplayName, SurName, Title
Description, ManagerID, PrimaryGroupDN
StreetAddress, City, StateOrProvinceName
CountryCode, PostalCode, Company
PhysicalDeliveryOfficeName, JobTitle
Department, CountryOrRegion, Office
Example Use Cases:
Create new user accounts when users are added
Keep user information synchronized across integrated systems
De-provision Identity
Safely removes or disables access when users leave or no longer need access.
Entity Type: Active Directory Users
Remove All Relationships: Yes (Removes existing group memberships)
De-provisioning Method: Disabled (Users are marked as disabled rather than deleted)
Example Use Cases:
Disable accounts when employees leave
Remove group memberships while retaining audit information
Configuration Steps
1. Create a Service Account
Create a dedicated AD user with minimum required permissions:
Using Active Directory Users and Computers:
Open Active Directory Users and Computers
Navigate to the target Organizational Unit
Right-click > New > User
Complete the new user details form
Recommended name: "Veza AD Lifecycle Manager"
Set a strong password
Uncheck "User must change password at next logon"
Using PowerShell:
2. Configure Required Permissions
Grant the service account permissions to manage users in the target OUs:
Using Active Directory Users and Computers:
Navigate to the target Organizational Unit
Right-click > Delegate Control
Click Add and enter the service account name
Select these delegated tasks:
Create, delete, and manage user accounts
Reset user passwords and force password change
Read all user information
Modify group membership
Using PowerShell:
3. Configure the Integration in Veza
Navigate to Configurations > Integrations
Either:
Create a new Active Directory integration
Edit an existing Active Directory integration
Enable Lifecycle Management:
Check Enable Lifecycle Management
Enter the Lifecycle Management Username (service account created above)
Enter the Lifecycle Management Password
Save the configuration
Note: The AD User created for lifecycle management can be the same as the primary AD User created for extraction, provided that the user has all required permissions listed above.
Last updated