Directory sync

Directory sync keeps your company's user accounts in step with a corporate directory. It reads the people from Microsoft 365 (Entra ID) or from an LDAP or Active Directory server, and creates, updates and disables the matching accounts in MonoPbx.

Users created by a sync have no password. They sign in through single sign-on, or an administrator gives them a password. Directory sync does not use SCIM.

Before you start

• You need the settings:write permission to add a source, and users:write to run a real sync.
• Decide which department each source feeds. Each source has one target department.
• For Microsoft 365, you need an app registration with the User.Read.All application permission and admin consent.
• For LDAP, you need an account that can read the directory, and the server's certificate authority if it is private.

Add a Microsoft 365 source

1. Choose the sign-in provider that holds the Microsoft app registration. The sync reuses its client secret; the secret is never copied into the source.
2. Enter the department in your directory to sync, if you want only one part of the company. Use one source per department, for example Sales and Support.
3. Choose the MonoPbx department that the new accounts join.

Guest users are not synced.

Add an LDAP or Active Directory source

Only secure connections are allowed. The address must start with ldaps:// and the default port is 636. There is no plain ldap:// and no StartTLS, so the bind password is never sent in clear text.

• The server's certificate is checked against its host name. For a private certificate authority, paste its certificate in the CA certificate field.
• Private network addresses are allowed, because a directory lives on the company network. Loopback and link-local addresses are refused.

Use these search settings for the common directories:

Setting	OpenLDAP	Active Directory
User filter	(&(objectClass=inetOrgPerson)(mail=*))	(&(objectClass=user)(mail=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
Unique id	entryUUID	objectGUID
Mail, first name, last name	mail, givenName, sn	mail, givenName, sn

The search reads all pages of results, so Active Directory's limit of 1000 entries does not cut the list short. An entry is treated as disabled when it is disabled in the directory.

The bind password

The password for the directory account is write-only. It is sealed with your company's key and is never shown, logged or written to the audit log. The source shows only whether a password is stored.

If you change the server address, enter the password again. A stored password is never sent to a different server.

Run a sync

1. Preview the sync first. A preview is a dry run: it reports what would change and changes nothing.
2. Check the preview.
3. Run the sync for real.

Every run is recorded, with its counts and any problems. Look at the run history if an account is not what you expect.

Accounts created by a sync join the source's department. A person whose directory entry is disabled is not created or kept active by the sync.