Published Date: June 26, 2026 | Last Updated: June 26, 2026
Overview
The Active Directory integration connects Tello IAM to a Microsoft Active Directory domain controller using LDAPS. Because Active Directory is deployed and managed as part of your organization’s infrastructure, the values required will be specific to your environment. This guide explains what each field expects — your IT Administrator or domain owner will need to supply the environment-specific values.
Active Directory or Microsoft Entra ID? If your organization uses Microsoft Entra ID (Azure AD), use the Microsoft Entra ID integration instead. In a hybrid environment with both on-premises AD and Azure AD, you only need one integration — not both. Rather than connecting both, Seasoft recommends running delta syncs to keep your on-premises and cloud directories aligned. Microsoft Entra ID is recommended for most organizations. The Active Directory integration is recommended for organizations running purely on-premises environments with no Azure AD presence.
Note: Active Directory requires network connectivity between Tello IAM and your domain controller. If your AD environment is on a private network, a VPN or network tunnel must be in place before configuring this integration.
Before connecting
The Administrator completing this setup must have access to the Active Directory domain and a service account with read permissions on the directory. LDAPS (TLS on port 636) is strongly recommended and enabled by default.
Connection settings
Navigate to Integrations in the left navigation, select + Add Integration, search for Active Directory, and select Add.
| Field | Description |
|---|---|
| Host | The hostname or IP address of the domain controller. |
| Port | The LDAP port. Default is 636 for LDAPS. Use 389 only if TLS is not available. |
| Use TLS (LDAPS) | Enables a secure LDAPS connection. Enabled by default and strongly recommended. |
| CA Certificate (PEM) | Optional. A PEM-encoded CA certificate for validating the domain controller’s TLS certificate. Required if the domain controller uses a self-signed or internal CA certificate. |
| Bind DN | The Distinguished Name of the service account used to authenticate to Active Directory (for example, CN=ServiceAccount,OU=ServiceAccounts,DC=example,DC=com). |
| Bind Password | The password for the Bind DN service account. |
| Base DN | The base Distinguished Name used as the starting point for all directory operations (for example, DC=example,DC=com). |
Advanced Options
Select Advanced Options to expand additional configuration fields. These fields are optional and fall back to the Base DN if left empty. Default values are pre-filled for standard Active Directory environments.
| Field | Description |
|---|---|
| User Base DN | Relative DN scoping user searches (for example, OU=Users). Uses Base DN if empty. |
| Group Base DN | Relative DN scoping group searches (for example, OU=Groups). Uses Base DN if empty. |
| User Search Filter | LDAP filter for user searches. Default is (&(objectClass=user)(objectCategory=person)). |
| Group Search Filter | LDAP filter for group searches. Default is (objectClass=group). |
| User Object Classes | Object classes used for user records. Default is top, person, organizationalPerson, user. |
| Group Object Classes | Object classes used for group records. Default is top, group. |
Complete the connection
Select Test Connection to verify the credentials and network connectivity are valid. A Connection successful confirmation will appear if accepted. Select Connect. The integration appears on the Integrations page and an initial sync begins automatically.
Verify the connection
After the initial sync completes, confirm the following on the Integrations page:
- The Active Directory integration displays a status of
Active - A sync timestamp is present and reflects the completed sync
- User records on the Users page reflect the users and groups imported from Active Directory
Related articles
- Configuring Integrations — manage sync schedules, drift detection, and integration settings
- Understanding Errors — resolve integration errors and authorization failures
Seasoft Security Solutions LLC | Tello IAM