After you create a directory, you can view and modify the users and groups selected for sync from the Users and Groups tabs on the directory's Sync Settings page.

Keep the following considerations in mind while adding groups.

  • As a best practice, add and sync a small number of groups to begin with. After the initial setup, you can add more groups.
  • When groups are added and synced, group names are synced to the directory. Users that are members of the group are not synced to the directory until the group is entitled to an application or the group name is added to an access policy rule.
    Note: You can override this restriction by enabling the Sync Group Members to the Directory When Adding Group option in the Identity & Access Management > Setup > Preferences page.
  • When you sync a group, any users that do not have Domain Users as their primary group in Active Directory are not synced.

Keep the following considerations in mind while adding users:

  • Because members in groups do not sync to the directory until the group is entitled to applications or added to an access policy rule, add all users who need to authenticate before group entitlements are configured.
  • The Bind user that you specified in the Bind Details section is not synced to the Workspace ONE Access service by default. If you want to sync the Bind user, enter the Bind user DN on the Users tab. After the directory is synced, set the role for the Bind user if required.

Procedure

  1. Navigate to the Identity & Access Management > Manage > Directories page.
  2. Click the directory you want to update.
  3. Click Sync Settings, then select the Groups tab.
    The page displays the group DNs that you added previously and the number of groups in each group DN that are selected for sync.
  4. Click Select to see the list of groups under a group DN and select or deselect groups as needed.
  5. To add more group DNs, follow these steps.
    1. In the Specify the group DNs row, click + and specify the group DN. For example, CN=users,DC=example,DC=company,DC=com.
      Tip: Entering a high-level DN such as the Base DN to search under is not recommended, as search will take a long time. Try to enter a more specific DN to search under.
      Important: Specify group DNs that are under the Base DN that you entered in the Base DN text box in the Add Directory page. If a group DN is outside the Base DN, users from that DN will be synced but will not be able to log in.
    2. If you want to select all the groups under the group DN, click Select All.
      If groups are added or deleted to the group DN in Active Directory after the directory is created, the changes are reflected in subsequent syncs.
    3. If you want to select specific groups under the group DN instead of selecting all of them, click Select, make your selections, and click Save.
      When you click Select, all the groups found in the DN are listed. You can narrow the results or search for specific groups by entering a search term in the search box.
    4. Select or deselect the Sync nested group members option, as needed.
      The Sync nested group members option is enabled by default. When this option is enabled, all the users that belong directly to the group you select as well as all the users that belong to nested groups under it are synced when the group is entitled. Note that the nested groups are not synced; only the users that belong to the nested groups are synced. In the Workspace ONE Access directory, these users will be members of the parent group that you selected for sync.

      If the Sync nested group members option is disabled, when you specify a group to sync, all the users that belong directly to that group are synced. Users that belong to nested groups under it are not synced. Disabling this option is useful for large Active Directory configurations where traversing a group tree is resource and time intensive. If you disable this option, ensure that you select all the groups whose users you want to sync.

  6. Click Save.
  7. Click the Users tab and select the users to sync.
    1. In the Specify the user DNs row, click + and enter the user DNs. For example, CN=username,CN=Users,OU=myUnit,DC=myCorp,DC=com.
      Important: Specify user DNs that are under the Base DN that you entered in the Base DN text box in the Add Directory page. If a user DN is outside the Base DN, users from that DN will be synced but will not be able to log in.
    2. (Optional) To exclude users, create filters to exclude users based on attribute chosen. You can create multiple exclude filters.
      You select the user attribute to filter by and the query filter to apply to the value you define.
      Option Description
      Contains Excludes all users who match the attribute and value set. For example, name contains Jane excludes users named "Jane".
      Does not contain Excludes all users except for those who match the attribute and value set. For example, telephoneNumber does not contain 800 includes only users with a telephone number that includes "800".
      Begins with Exclude all users where the attribute value begins with the specified characters. For example, employeeID begins with ACME0 excludes all users that have an employee ID that includes "ACME0" at the beginning of their ID number.
      Ends with Exclude all users where the attribute value ends with the specified characters. For example, mail ends with example1.com excludes all users that have an email address that ends in "example1.com".
    The value is case-insensitive. Do not use the following symbols in the value string.
    • Asterisk *
    • Caret ^
    • Parentheses ( )
    • Question mark ?
    • Exclamation point !
    • Dollar sign $