1. Download the Agent

1. Sign in to Zoho Directory. Click Admin Panel from the left menu.
   
2. Go to the Directory Stores tab. Click Add Directory.
   
3. Find Active Directory and click Add.
   
4. On the Download Agent screen:
1. Review the prerequisites.
   
2. Copy the Installation Key displayed there.
   
3. Click Download Agent and wait for the download to complete.
   

2. Install the Agent

1. Execute the downloaded file ZohoDirectory_IdentityConnect.msi to start installation.
   
2. Paste the Installation Key. Upon successful validation, you'll be taken automatically to the setup wizard where you can complete the rest of the installation steps.
   
3. On the Welcome screen, choose your language.
   
4. Read the software license agreement carefully, then accept the terms. Click Continue. Clicking the URL will not auto-redirect you to the page in some legacy systems. In this case, click 🔗 to copy the URL, then paste it in your browser to read the license agreement.
   
        
   
   
5. Open the provided Login URL from a browser.
   
        
   
   
6. Sign in to your Zoho Directory admin account if you haven't already.
   
7. Enter the Verification Code shown in the installer.
   
8. Upon successfully signing in, a confirmation screen with your Zoho account email and display name will appear. Click Continue.
   
        
   
   
9. Once the agent is installed, complete the sync setup in Zoho Directory.
   

   Possible error cases that appear at this step:

   Error	Fix
   The verification code is time-bound and will become invalid after the expiration time (5 minutes).	Click Retry to generate a new code, which you can use to sign in and proceed to configuring your LDAP settings.
   Sometimes, the agent may not be able to contact the Zoho server due to network issue.	Click Retry. If the error persists, contact support.

   
   

3. Configure Sync in Zoho Directory
   

1. Configure LDAP Connection Details
   

1. This is a crucial step where the agent is allowed to connect with Active Directory to fetch data of users and groups for sync.
   
2. Enter your directory info: Domain Name, Domain Controllers, User's Distinguished Name (DN), Password. Make sure they're all valid.
   
        
   
   
3. Enable SSL for a secure connection:
   
4. SSL is recommended, as it safeguards sensitive directory data during transmission.
   
5. To use SSL:
   
1. Your Domain Controller must have a valid SSL certificate issued to its domain.
   
2. You must use the fully qualified domain name (FQDN) in the field dedicated for entering Domain Controller names (e.g., ldap-server-1.zylker.com). Using only the hostname will cause SSL failure.
   
6. Click Next to review the LDAP configurations. If you face the error 'LDAP server goes unreachable,' click Retry to attempt the connection again. Make sure that there's no connectivity issue between the agent machine and LDAP server.

2. Complete Installation
   

1. Click Install to finish setting up the agent. Upon successful installation, the agent will be running.
   Note: Ensure the agent machine maintains continuous network connectivity according to your organization's power-saving or login-based policies.
2. Click  to perform the following actions:
   
1. Change ownership - Switch the Zoho Directory admin account linked to the agent in case the original admin leaves your organization or loses LDAP access.
   
        
   
   
2. Change LDAP settings - Modify your LDAP server details here. After making changes, click Update to save them.
   
3. Go back to the Zoho Directory Admin Panel to complete the remaining setup.
   

3. Configure Sync Options

1. Select Organizational Units (OUs)
   

1. From the Admin Panel, navigate to Active Directory.
   
2. Choose which OUs you want to sync to Zoho Directory.
   
3. Select object types to include:
   
1. Users
   
2. Groups
   
3. Security Groups
   
4. Custom LDAP Query - Enter a valid LDAP query and click Save to sync based on specific LDAP attributes.
   
4. Review the chosen OUs:
   
1. Edit or remove any existing OU preferences.
2. To add more OUs, click Add OUs.
   
3. When you're done, click Add and Continue.
   

2. Map Zoho Directory fields with your LDAP fields

1. This is important for making sure user data is correctly transferred.
   
2. Toggle between User Mapping and Group Mapping.
   
3. Fields will be auto-suggested, but you can map them manually.
   
4. Use the tabs to filter by All Fields, Mapped, or Unmapped fields. For example, you can map the Zoho Directory "Last name" field to your LDAP "Surname" attribute.
   
5. For custom attributes:
   
1. Click Edit next to one of the default attributes displayed.
   
2. Select Custom AD attribute.
   
3. Enter a name for the attribute and save it.
   

3. Define Sync Criteria
   

1. On the SET SYNC CRITERIA screen, specify which users or groups should be included in the sync. Switch to the Groups tab if needed.
   
2. Select import type: Based on criteria or All users
   
3. If using criteria, define the Field, Relationship, and Value. Click Save and Next.
   

4. Configure Sync Settings

1. Password Sync Agent (Separate installation)
   

1. The main Identity Connect Agent, when coupled with your Active Directory details, allows you to deploy multiple Password Sync Agents (one per Domain Controller) to instantly capture any password change made on these Domain Controllers and securely sync those changes to Zoho Directory.
   
2. Prerequisites to use the Password Sync Agent:
1. Use an LDAP account with Domain Admin-level privileges. The same account credentials provided during the Identity Connect setup will be used for this installation.
   
2. Ensure Powershell remoting (WinRM) is enabled on every Domain Controller where you plan to install the Password Sync Agent. You need not enable WinRM on Domain Controllers where the agent will not be installed. Learn how to enable WinRM
   
3. Ensure SMB (Server Message Block) is enabled on both the machine initiating the installation and the target Domain Controller and is also allowed through the firewall (SMB typically uses port 445). Learn how to detect and enable SMB
   
4. The machine with the Identity Connect Agent must be bound to the Active Directory domain.
   
3. To enable:
   
1. Enable the toggle to sync the user passwords securely from Active Directory to Zoho Directory. (Domain Name is auto-filled based on the info you entered for the Identity Connect Agent installation.)
   
2. Select the Domain Controllers where password sync is needed and make sure all of them meet the exclusive requirements to house this agent.
   
   

   The Zoho Directory Identity Connect agent transfers the Password Sync Agent installer file to the selected Domain Controller over SMB. If SMB is disabled or blocked, the file transfer will fail and the installation cannot proceed.
   The file being transferred is the Password Sync Agent installer MSI file (ZohoDirectory_PasswordSynchronizer.msi), which must be successfully copied from the machine where the Zoho Directory Identity Connect Agent is installed to the selected Domain Controller. SMB is only required during this file transfer stage. Once the installation is complete, SMB is no longer required.
3. Select whether you want to auto-restart the Domain Controllers after installation. Regardless of what you choose, the password sync agent will only take effect after a Domain Controller restart.
   
4. If installation fails, the installer will only display "Installation failed." This is most commonly because one or more of the prerequisites are not available:
   
1. The provided account doesn't have Domain Admin rights
   

   

   If installation fails due to insufficient privileges
   

   The Password Sync Agent installation requires elevated permissions to perform remote operations such as file transfer and command execution on Domain Controllers. If the account configured in the Identity Connect Agent does not have sufficient privileges, the installation may fail.
   

   To resolve this:
   

   1. Open the Identity Connect Agent on the machine where it is installed.
      
   2. Update the directory credentials to an account with Domain Admin privileges.
      
   3. Save the changes and retry installing the Password Sync Agent from the Admin Panel.
      

   
   

   Updating the credentials does not require reinstalling the Identity Connect Agent. If installation continues to fail after verifying permissions, WinRM, and SMB availability, contact Zoho Directory Support for further assistance.
   
2. WinRM is not enabled on the Domain Controller .
   
3. The agent file could not be transferred to the Domain Controller because SMB service is either disabled on one of the machines or blocked by the firewall (port 445).
   
   Note: If a directory-synced user is deleted from Zoho Directory, password changes for that user in Active Directory will not sync unless the user is re-provisioned in Zoho Directory.

2. User Sync Settings
   

1. Configure automated rules for user account handling based on changes in Active Directory.
   

   Setting	What it is for	Options
   Password Notifications	Decide how new users get their initial passwords	Send email OTP to user - The new user will receive an email directly to their registered email address containing an OTP. Send email OTP to admin - Admin will receive the OTP or setup info, which they should then forward to the user manually. Don't notify - No automatic notifications are sent. An admin should manually notify the user and provide them with their login credentials through some other medium on their own.
   Status Sync	Choose how to reflect a user's AD account status changes in Zoho Directory.	Reflect - If disabled in AD, ZD account also gets disabled (and re-enabled if restored). Do nothing - Ignore AD status changes. If Do nothing is selected, the system will no longer manage user status. The When User Leaves Selected OU setting will be disabled and unavailable, as it requires Status Sync to be enabled. Learn more about this interactive behaviour illustrated after the table.
   Mail Notifications	Choose whether you want to send notifications to synced users.	Send - Sends emails to newly synced users and resend invite links to pending users. Don't send - No email notifications are sent to users.
   When User Leaves Selected OU	Define what should happen in Zoho Directory when a user is moved out of a selected/synced AD OU.	Disable - The user's Zoho account is auto-disabled. Do nothing - The user's Zoho account remains active, but will no longer be included in the future sync operations.

1. Important note: There's a crucial interaction between Setting 2 and Setting 4. The When User Leaves Selected OU setting depends on Status Sync. The former is only available if the latter is set to Reflect in Zoho Directory. If you choose to Do nothing with status changes, the system cannot manage user status based on OU membership. Therefore, Setting 4 will be disabled altogether.
   

   For example, let's assume there's a user named Dexter in AD and see how he's affected during sync with these two settings:

   Status Sync	When User Move Out of Selected OU	Action performed on Dexter (in AD)	Result (in ZD)
   Reflect in ZD	Disable in ZD	Dexter is removed from OU but still active in AD	Dexter's Zoho account is disabled (OU rule applies)
   Do nothing	(field gets disabled with Do nothing selected)	Dexter is removed from OU	Dexter's Zoho account remains active but is no longer synced (because Status Sync setting is ignoring status changes, and OU-based handling is off)
2. Reflecting hard deletion of users from Active Directory to Zoho Directory:
   When Zoho Directory Identity Connect is enabled, Active Directory acts as the source for user discovery. If a user is deleted or disabled in Active Directory, the corresponding action in Zoho Directory depends on the configured Status Sync setting.
   

   When Status Sync is set to Reflect, users disabled or removed in Active Directory are disabled in Zoho Directory. If your organization requires users to be completely deleted from Zoho Directory instead of just disabled, contact Zoho Directory Support to enable this configuration for your account. Enabling deletion propagation will permanently remove users in Zoho Directory when they're disabled/deleted in Active Directory.
   

   For step-by-step instructions on deleting users and handling ownership transfers, see How to Delete a User
   

   Note on admin deletion: Each Identity Connect configuration is associated with a Zoho Directory admin. To ensure uninterrupted sync, the system will not allow the deletion or disablement of an owner-admin. You must first use the Change Ownership option in the tray app to transfer dependencies to another admin; only then can the original account be removed. You must reassign ownership to another admin. If you attempt deletion directly, the system will block the action and place them in a "delete-pending" state until all dependencies are cleared.
   
1. Deleting a directory-synced user from Zoho Directory: Deleting a user in Zoho Directory does not remove the user from Active Directory.
   

   Warning on data loss: If "Delete in ZD" is enabled, removing a user from Active Directory will permanently erase their Zoho mail, files, and service data. This data cannot be recovered even if the user is re-synced later from Active Directory.

   COMMON SYNC SCENARIOS AFTER USER DELETION

   The following scenarios illustrate common outcomes based on typical configurations. Actual results depend on sync criteria and status settings.
   

   
   

   Scenario	Action in ZD	Action in AD	Manual Sync Result	Scheduled Sync Result
   Manual re-creation	User deleted	User exists & meets criteria	User appears in "Users to Create"	User is automatically re-created
   Complete removal	User deleted	User deleted	No action	No re-provisioning (user remains deleted)
   Mixed Zoho & AD actions (or) Conflicting actions	User deleted	User deleted User disabled/moved out of synced OU	Depends on Status Sync setting	Depends on Status Sync setting

   
   

3. Schedule Sync
   

1. Set frequency (Daily/Weekly/Monthly) and time of sync. Click Save and Next.
   Changes in Active Directory or Zoho Directory are reflected based on the configured sync schedule and may not appear immediately.

4. Review and Finalize Sync

1. Review and select users from the imported list to add to Zoho Directory. This screen helps you with the following filters:
   
1. New Users - Users found in your directory but not yet in Zoho Directory.
   
2. Users to Update - Existing ZD users whose info will be updated from your directory in the next sync.
   
3. Marked for Activation/Disable - Users who will be activated or disabled based on their status in your directory. Pay attention to this category of users before syncing in order to avoid unintended modifications to their access levels.
   
4. Ignored - Users who do not meet the defined sync criteria.
   
2. Click Add and Continue.
   
3. Review the summary and click Finish to complete the setup. Once installed on multiple Domain Controllers, the Password Sync Agents work together under the same Identity Connect configuration, keeping all password updates in sync without extra manual steps.
   

Troubleshooting the "Disconnected" Status

1. Verify that the machine has active internet connectivity.
2. Ensure the system date and time on the machine are correct.