> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Microsoft Entra ID Domain Services Integration

> Deploy Microsoft Entra Domain Services and connect it to Syteca as an LDAP target, so Entra ID accounts can be used to log in to the Management Tool.

This guide deploys Microsoft Entra Domain Services (formerly Azure Active Directory Domain Services) and connects it to Syteca as an [LDAP target](/docs/administration/integrations/ldap-targets), so Entra ID accounts can log in to the Management Tool.

<Note>
  This is a different integration path from [SSO with Azure](/docs/administration/integrations/sso-azure) — that page covers SAML-based single sign-on. This page covers LDAP-based directory integration instead. See Microsoft's [tutorial on creating a Microsoft Entra Domain Services managed domain](https://learn.microsoft.com/en-us/entra/identity/domain-services/tutorial-create-instance) for further background.
</Note>

## 1. Create a resource group

<Steps>
  <Step title="Sign in to the Azure portal">
    Go to [portal.azure.com](https://portal.azure.com).
  </Step>

  <Step title="Open Resource groups">
    Search for and open **Resource groups**.
  </Step>

  <Step title="Create a resource group">
    Click **Create**, select a **Subscription**, enter a **Resource group name**, select a **Region**, and click **Review + create**, then **Create**.
  </Step>
</Steps>

## 2. Create a Microsoft Entra Domain Service

<Steps>
  <Step title="Open Microsoft Entra Domain Services">
    Search for and open **Microsoft Entra Domain Services**.
  </Step>

  <Step title="Start creation">
    Click **Create**.
  </Step>

  <Step title="Configure the instance">
    Select the **Resource group** created above, a **DNS domain name** (this must be a verified custom domain, configurable under Azure's **Domain Names** service), a **Region**, and a **SKU** (**Enterprise** for larger environments, **Standard** for smaller ones).
  </Step>

  <Step title="Create and wait">
    Click **Review + create**, then **Create**, and wait for deployment to complete.
  </Step>
</Steps>

## 3. Confirm the domain is running

Open **Microsoft Entra Domain Services** and confirm the domain shows as running.

## 4. Configure Secure LDAP (LDAPS)

<Note>
  **IN SAAS ONLY:** use a trusted certificate from an official certificate authority instead of the self-signed certificate described below.
</Note>

### Create and export a certificate

<Steps>
  <Step title="Generate a self-signed certificate">
    On any Windows computer, run in PowerShell:

    ```powershell theme={"system"}
    $dnsName="mydomain.com"
    $lifetime=Get-Date

    New-SelfSignedCertificate -Subject *.$dnsName `
      -NotAfter $lifetime.AddDays(365) -KeyUsage DigitalSignature, KeyEncipherment `
      -Type SSLServerAuthentication -DnsName *.$dnsName, $dnsName
    ```

    <Note>
      OpenSSL, Keytool, MakeCert, or a certificate from a public or enterprise CA can be used instead.
    </Note>
  </Step>

  <Step title="Open the Certificates snap-in">
    Run `mmc`, select **File > Add/Remove Snap-in**, choose **Certificates**, click **Add**, select **Computer account**, then **Local computer**, and click **Finish**.
  </Step>

  <Step title="Export the certificate with its private key (PFX)">
    Under **Certificates (Local Computer) > Personal > Certificates**, right-click the certificate, select **All Tasks > Export**, choose **Yes, export the private key**, deselect **Enable certificate privacy**, set a password, and save as a `.pfx` file.
  </Step>

  <Step title="Export the certificate without the private key (CER)">
    Repeat the export, this time selecting **No, do not export the private key** and format **Base-64 encoded X.509 (.CER)**.
  </Step>
</Steps>

### Enable Secure LDAP and trust the certificate

<Steps>
  <Step title="Enable Secure LDAP">
    In Microsoft Entra Domain Services, open the domain, select **Settings > Secure LDAP**, and click **Enable**.
  </Step>

  <Step title="Upload the PFX certificate">
    Select **Enable Allow secure LDAP access over the internet**, upload the `.pfx` file, enter its password, and click **Save**.
  </Step>

  <Step title="Trust the CER certificate on the Application Server">
    Copy the `.cer` file to the computer running Syteca Application Server, right-click it, select **Install Certificate**, choose **Local Machine**, select **Place all certificates in the following store**, choose **Trusted Root Certification Authorities**, and finish the wizard.
  </Step>
</Steps>

### Resolve the domain name

<Steps>
  <Step title="Copy the Secure LDAP external IP address">
    In Microsoft Entra Domain Services, open the domain, select **Settings > Properties**, and copy the **Secure LDAP external IP address**.
  </Step>

  <Step title="Add a hosts file entry">
    On the Application Server computer, open `C:\Windows\System32\drivers\etc\hosts` and add the IP address and DNS domain name.

    <Note>
      Only needed if there's no other DNS resolution between the Application Server and the Entra domain.
    </Note>
  </Step>
</Steps>

### Open the firewall for LDAPS

<Steps>
  <Step title="Open the domain's resource group">
    In Azure, open the resource group the domain was deployed in.
  </Step>

  <Step title="Open the network security group">
    Click the **Network security group** resource (for example, the default `aadds-nsg`).
  </Step>

  <Step title="Add an inbound rule for port 636">
    Select **Settings > Inbound security rules**, click **Add**, set **Destination port ranges** to `636`, and click **Add**.
  </Step>
</Steps>

## 5. Create a Microsoft Entra ID user

<Steps>
  <Step title="Open Users">
    In the Azure portal, open the **Users** page.
  </Step>

  <Step title="Add a new user">
    On **All users**, click **New user**, enter a **User principal name**, **Domain**, **Display name**, and a password (or select **Autogenerate password**), then click **Review + create**, then **Create**.
  </Step>

  <Step title="Sign in and set a password">
    Sign in to the Azure portal as the new user and change the password when prompted.
  </Step>
</Steps>

<Note>
  If a user's password was changed *before* Microsoft Entra Domain Services was deployed, it must be changed again afterward before that account can be used in Syteca.
</Note>

## 6. Add the LDAP target to the Management Tool

<Steps>
  <Step title="Open LDAP Targets">
    Log in to the Management Tool as a user in the default **Administrators** group, click **Configuration**, and select the **LDAP Targets** tab.
  </Step>

  <Step title="Add the target">
    Click **Add** and enter:

    * **LDAP Path**: `LDAP://ldaps.mydomain.com:636/DC=mydomain,DC=com`
    * **Domain NetBIOS Name**: `mydomain`
    * **User**: the Entra ID user's email address
    * **Password**: that user's password
  </Step>

  <Step title="Add the Entra ID user to the Management Tool">
    On the **Users** page, click **Add User**, then **Add Active Directory User / User Group**, search for and select the new Entra ID user, and click **Next**.
  </Step>

  <Step title="Complete the user setup">
    Finish [adding the user](/docs/administration/users/users#add-a-user), granting at least the [administrative Management Tool Access permission](/docs/administration/users/administrative-permissions).
  </Step>

  <Step title="Verify login">
    Confirm the new Entra ID user can log in to the Management Tool.
  </Step>
</Steps>

<Frame caption="An LDAP target configured for a Microsoft Entra Domain Services connection.">
  <img src="https://mintcdn.com/syteca/0FlD-vkHsBA1azVX/images/administration/integrations/entra-id-ldap-target.png?fit=max&auto=format&n=0FlD-vkHsBA1azVX&q=85&s=99f1e38d2f307e71a0099643e4fcff7c" alt="LDAP Targets tab with an Entra ID Domain Services target configured" width="1482" height="284" data-path="images/administration/integrations/entra-id-ldap-target.png" />
</Frame>

## Related

<CardGroup cols={2}>
  <Card title="LDAP targets" icon="folder-tree" href="/docs/administration/integrations/ldap-targets">
    General LDAP target configuration.
  </Card>

  <Card title="Azure SSO" icon="microsoft" href="/docs/administration/integrations/sso-azure">
    The SAML-based alternative to this LDAP integration.
  </Card>

  <Card title="User management" icon="users" href="/docs/administration/users/users">
    Adding and permissioning Active Directory users.
  </Card>
</CardGroup>