Directory: people from Entra ID, Active Directory and LDAP

Almost every module works with people: the signature inserts name, job title and phone number, licence management counts seats, MailGuard recognises valid recipients, the archive assigns messages to a person. Those people come from the company directory, not from a second list kept inside Conbool.

Three routes lead there.

Entra ID

For Microsoft 365, Conbool reads the directory through Microsoft Graph. Nothing to install, an administrator grants consent in the Microsoft tenant. See Users and roles.

Local Active Directory through the directory agent

Anyone without Entra ID, or deliberately keeping Active Directory away from the cloud, installs the directory agent on a member server of the domain. The agent reads the directory and reports the people outbound to Conbool.

The direction is what matters: Conbool never calls the agent. The agent keeps no inbound port open, so there is no inbound firewall rule, no reverse proxy and no published domain controller. What the agent reads is defined in Conbool through the scope. Where it reads and how it authenticates stays on the machine on site.

Start at Set up the agent, the Active Directory prerequisites are under Active Directory.

Other LDAP directories

OpenLDAP, 389 Directory Server and relatives are connected by the same agent. Credentials stay next to the agent on the machine, never in Conbool. See LDAP directory.

There is also the direct LDAP connection from Conbool itself. It requires Conbool to reach the directory, which makes it the route for an installation in the company data centre, not for a directory behind the corporate firewall.

What comes from the directory

Per person Conbool keeps email address, first name, surname, display name, job title, department, phone, mobile, office, street, city, state, postal code, country, fax and the secondary addresses, along with the state of the account and the time it last changed in the directory. Which attribute fills which field can be adjusted: Attribute mapping.

The result is visible under Settings, Directory, People in the directory, with the source and the time of the last sync per person.

Groups

Directory groups can serve as the audience for signatures, policies and licences. Nested groups are resolved in full. See Directory groups.