Browse documentation
Directory sync
Directory sync brings users and groups in from Active Directory, so you're not retyping your staff list into JOATOS and maintaining it twice.
It's an optional module and is off by default — switch it on under Settings → Modules, then configure it at Settings → Directory Sync.
This is sync, not single sign-on. It brings people in; it does not let them sign in with their AD password. There's no SSO login yet, so synced users still have JOATOS credentials.
Setting it up
- Add one or more domain controller sources.
- Browse and pick the groups or OUs to bring in. It's selective on purpose — you rarely want every object in the directory.
- Map AD attributes to JOATOS attributes, so names, emails and other fields land where you expect.
- Sync now to run it immediately, or leave it to its schedule.
A sync history records each run, which is where to look when someone expected to appear and hasn't.
What synced users look like
- They appear under Organization → Users with an AD badge, so you can tell at a glance who came from the directory.
- They arrive portal-only, like any other new user. Directory sync doesn't grant console access — that stays a deliberate decision. See Access levels.
- Users deprovisioned in AD are flagged, so you can act on leavers rather than discovering them later.
Notes & tips
- Sync a narrow set of groups first and widen it once you're happy. Pulling in a large directory creates a lot of accounts you then have to look at.
- A flagged deprovisioned user isn't removed automatically. Treat the flag as a to-do list.