Active Directory

Cloud Security (InsightCloudSec) supports using Microsoft Active Directory authentication as a valid authentication server. For details on configuring Microsoft Entra ID for use with Cloud Security (InsightCloudSec), review Microsoft Entra ID.

Prerequisites

Before getting started you will need to have the following

• A functioning Cloud Security (InsightCloudSec) platform
• Appropriate Cloud Security (InsightCloudSec) permissions (Domain Admin or Org Admin)
• Administrative credentials to your Active Directory instance

For questions or issues reach out to us through the Customer Support Portal .

Active Directory Authentication Server Setup

Refer to the steps outlined below to create an Active Directory Authentication Server:

1. Navigate to Settings > User Management and select the Authentication Servers tab.

2. Click the Add Server button to launch the form.

3. Complete the Create Authentication Server form as follows:

   • Nickname: Provide a nickname for the Active Directory server.
   • Select Server Type: Select Active Directory from the drop-down server type menu.
   • Global Scope Checkbox: Select the Global Scope checkbox if you want to use this server across all of your Organizations.
     • Learn more about Organizations.
   • Server Host/ IP: the server hostname or IP for the Active Directory.
     • This is often represented as ‘dc.yourdomain.com’. Do not include any protocol or port information here.
   • Port Number: Provide the Port number (the port for which your Active Directory instance is configured).
     • Port ‘389’ is the default Active Directory port.
     • If your Active Directory is configured to use SSL, the default port is ‘636’.
     • If your Active Directory instance has been configured to use any other port, supply that value here.

4. Configuration continued

   • Secure Server Checkbox: Select the Secure Server checkbox if your Active Directory instance has been configured to use SSL.

     • Provide an Admin Username - enter the Distinguished Name (DN) of a user account with ‘bind’ privileges. The DN is usually represented as CN=Your Name,OU=YourOrganization,DC=YourCompanyName,DC=Com.
     • Provide the corresponding password for the given Admin username

   • Base User DN: The Base User DN is the search string applicable to where user accounts are situated within the directory.

     • Usually, this looks something like CN=Users,DC=YourCompanyName,DC=Com.
     • It is important here to provide the most specific possible search string. A search string of DC=YourCompanyName,DC=Com might work depending on how the directory was configured but will result in inefficient lookups which are taxing to the Active Directory instance and could result in timeouts while users attempt to authenticate.

   • UPN Suffix: If you have configured your Active Directory instance to use a User Principal Name, or your domain is configured to use explicit UPN names, supply the UPN suffix value.

     • This will preclude users from being able to authenticate into Cloud Security (InsightCloudSec) using implicit suffixes, even if the Active Directory instance is configured to allow that.

5. Click Submit once you have completed the form.
   • Cloud Security (InsightCloudSec) will verify that the credentials you submitted are correct and that the account provided has the required ‘bind’ privilege.
   • If an error message appears, check that the values you entered are correct for the Active Directory instance in which you are trying to authenticate.