Microsoft Entra ID & Active Directory Integration
Synchronise enterprise identities and security groups, automate user account lifecycle management and apply role-based access controls across Passwordstate.
Integrate Passwordstate with Your Enterprise Identity Platform
Passwordstate integrates with both Microsoft Entra ID and on-premises Active Directory, allowing organizations to align access to privileged information with their existing identity, group membership and authentication policies.
Users and security groups can be synchronised into Passwordstate, enabling administrators to automate account provisioning, deactivate disabled users and assign access through existing enterprise security groups.
Supported Enterprise Identity Platforms
Microsoft Entra ID Integration
Synchronise users and security groups from one or more Microsoft Entra ID tenants into Passwordstate.
Authentication is performed through SAML-based single sign-on, allowing Microsoft Entra ID policies such as multi-factor authentication and Conditional Access to be applied by Microsoft.
Active Directory Integration
Integrate Passwordstate with on-premises Active Directory domains for user synchronisation, security-group integration and domain-based authentication.
Supported environments can use Windows single sign-on, manual Active Directory authentication and additional multi-factor authentication methods.
User and Security Group Synchronisation
Passwordstate can synchronise account and group information from Microsoft Entra ID and Active Directory, reducing the need to manually maintain duplicate identity records.
User Provisioning
Synchronise authorised users into Passwordstate from existing enterprise identity directories.
Security Group Synchronisation
Import and synchronise Active Directory or Entra ID security groups for use in Passwordstate permissions and access policies.
Scheduled Synchronisation
Configure synchronisation intervals ranging from five minutes to daily updates for user accounts and security groups.
Automated User Account Lifecycle Management
Passwordstate can align user account status with the source identity directory, helping administrators keep access current as users join, change roles or leave the organization.
Accounts disabled in Active Directory or Microsoft Entra ID can be automatically disabled in Passwordstate. Administrators can also configure disabled Passwordstate accounts to be purged after a defined period.
- Automatic account deactivation
- Configurable account purging
- Scheduled directory synchronisation
- Reduced manual administration
Role-Based Access Control with Enterprise Security Groups
Security groups imported from Active Directory or Microsoft Entra ID can be used to assign Passwordstate permissions, helping organizations align privileged access with existing business roles and governance structures.
Granular Permissions
Assign appropriate Read, Modify or Administrative access according to a user or group's responsibilities.
Feature and Menu Access
Control which Passwordstate features and menus are available to users based on assigned permissions.
Membership-Based Access
Reflect changes in enterprise security-group membership through scheduled synchronisation.
Microsoft Entra ID Single Sign-On
Users synchronised from Microsoft Entra ID authenticate to Passwordstate through SAML-based single sign-on.
Authentication controls such as Microsoft Entra multi-factor authentication and Conditional Access remain managed and enforced within the organization's Microsoft identity environment.
Entra ID Integration Benefits
- SAML-based single sign-on
- Microsoft-managed MFA policies
- Conditional Access enforcement
- Multiple Entra ID tenant support
- User and security-group synchronisation
Active Directory Authentication
On-premises Active Directory environments can use a range of Passwordstate authentication configurations, including Windows single sign-on, manual domain authentication and supported multi-factor authentication methods.
Windows Single Sign-On
Allow supported domain users to access Passwordstate without manually re-entering their Windows credentials.
Manual Domain Authentication
Require users to enter their Active Directory credentials directly when explicit sign-in is needed.
Additional Authentication Factors
Combine Active Directory authentication with supported MFA options such as Duo, TOTP, HOTP or temporary PIN codes.
See the Passwordstate Authentication Options page for details about supported sign-in and multi-factor authentication methods.
LDAP, LDAPS and Kerberos Support
Passwordstate supports LDAP, LDAP over SSL and Kerberos communication with Active Directory. Configuration can be managed independently for each domain to support different enterprise network architectures.
Non-Trusted Domains
Configure integration for domains without an established trust relationship, supporting more complex enterprise security boundaries.
Workgroup Deployments
Support Passwordstate deployments where the web server is not itself joined to an Active Directory domain.
Identity Integration Benefits
Reduced Administration
Reduce manual user and group maintenance through scheduled directory synchronisation.
Consistent Access Control
Apply Passwordstate permissions using established identity groups and organizational roles.
Faster Access Removal
Automatically disable Passwordstate access when corresponding directory accounts are disabled.
Evaluate Passwordstate
Download a fully functional 30-day trial and integrate Passwordstate with your Microsoft Entra ID or Active Directory environment.
