This is a different integration path from SSO with Azure — that page covers SAML-based single sign-on. This page covers LDAP-based directory integration instead. See Microsoft’s tutorial on creating a Microsoft Entra Domain Services managed domain for further background.
1. Create a resource group
1
Sign in to the Azure portal
Go to portal.azure.com.
2
Open Resource groups
Search for and open Resource groups.
3
Create a resource group
Click Create, select a Subscription, enter a Resource group name, select a Region, and click Review + create, then Create.
2. Create a Microsoft Entra Domain Service
1
Open Microsoft Entra Domain Services
Search for and open Microsoft Entra Domain Services.
2
Start creation
Click Create.
3
Configure the instance
Select the Resource group created above, a DNS domain name (this must be a verified custom domain, configurable under Azure’s Domain Names service), a Region, and a SKU (Enterprise for larger environments, Standard for smaller ones).
4
Create and wait
Click Review + create, then Create, and wait for deployment to complete.
3. Confirm the domain is running
Open Microsoft Entra Domain Services and confirm the domain shows as running.4. Configure Secure LDAP (LDAPS)
IN SAAS ONLY: use a trusted certificate from an official certificate authority instead of the self-signed certificate described below.
Create and export a certificate
1
Generate a self-signed certificate
On any Windows computer, run in PowerShell:
OpenSSL, Keytool, MakeCert, or a certificate from a public or enterprise CA can be used instead.
2
Open the Certificates snap-in
Run
mmc, select File > Add/Remove Snap-in, choose Certificates, click Add, select Computer account, then Local computer, and click Finish.3
Export the certificate with its private key (PFX)
Under Certificates (Local Computer) > Personal > Certificates, right-click the certificate, select All Tasks > Export, choose Yes, export the private key, deselect Enable certificate privacy, set a password, and save as a
.pfx file.4
Export the certificate without the private key (CER)
Repeat the export, this time selecting No, do not export the private key and format Base-64 encoded X.509 (.CER).
Enable Secure LDAP and trust the certificate
1
Enable Secure LDAP
In Microsoft Entra Domain Services, open the domain, select Settings > Secure LDAP, and click Enable.
2
Upload the PFX certificate
Select Enable Allow secure LDAP access over the internet, upload the
.pfx file, enter its password, and click Save.3
Trust the CER certificate on the Application Server
Copy the
.cer file to the computer running Syteca Application Server, right-click it, select Install Certificate, choose Local Machine, select Place all certificates in the following store, choose Trusted Root Certification Authorities, and finish the wizard.Resolve the domain name
1
Copy the Secure LDAP external IP address
In Microsoft Entra Domain Services, open the domain, select Settings > Properties, and copy the Secure LDAP external IP address.
2
Add a hosts file entry
On the Application Server computer, open
C:\Windows\System32\drivers\etc\hosts and add the IP address and DNS domain name.Only needed if there’s no other DNS resolution between the Application Server and the Entra domain.
Open the firewall for LDAPS
1
Open the domain's resource group
In Azure, open the resource group the domain was deployed in.
2
Open the network security group
Click the Network security group resource (for example, the default
aadds-nsg).3
Add an inbound rule for port 636
Select Settings > Inbound security rules, click Add, set Destination port ranges to
636, and click Add.5. Create a Microsoft Entra ID user
1
Open Users
In the Azure portal, open the Users page.
2
Add a new user
On All users, click New user, enter a User principal name, Domain, Display name, and a password (or select Autogenerate password), then click Review + create, then Create.
3
Sign in and set a password
Sign in to the Azure portal as the new user and change the password when prompted.
If a user’s password was changed before Microsoft Entra Domain Services was deployed, it must be changed again afterward before that account can be used in Syteca.
6. Add the LDAP target to the Management Tool
1
Open LDAP Targets
Log in to the Management Tool as a user in the default Administrators group, click Configuration, and select the LDAP Targets tab.
2
Add the target
Click Add and enter:
- LDAP Path:
LDAP://ldaps.mydomain.com:636/DC=mydomain,DC=com - Domain NetBIOS Name:
mydomain - User: the Entra ID user’s email address
- Password: that user’s password
3
Add the Entra ID user to the Management Tool
On the Users page, click Add User, then Add Active Directory User / User Group, search for and select the new Entra ID user, and click Next.
4
Complete the user setup
Finish adding the user, granting at least the administrative Management Tool Access permission.
5
Verify login
Confirm the new Entra ID user can log in to the Management Tool.
An LDAP target configured for a Microsoft Entra Domain Services connection.
Related
LDAP targets
General LDAP target configuration.
Azure SSO
The SAML-based alternative to this LDAP integration.
User management
Adding and permissioning Active Directory users.