Integrate Your On-premises Directory with Zoho Directory Identity Connect
Roles required to perform this action
- Organization admin
- Organization owner
Zoho Directory Identity Connect is an on-premises agent that connects your organization’s Active Directory to Zoho Directory. It enables automated synchronization of users, groups, and directory attributes from your on-premises directory to Zoho Directory, reducing the need for manual user management.
The Identity Connect Agent runs within your network and communicates securely with Zoho Directory to keep directory data up to date based on the sync rules you define, such as organizational units, attributes, and filters.
Identity Connect also supports an optional Password Sync Agent, which can be installed on selected Domain Controllers to capture password changes in Active Directory and sync them to Zoho Directory in near real time. This allows users to continue signing in to Zoho services using their Active Directory credentials.
If you plan to enable password sync, review the Password Sync Agent prerequisites later in this guide.
This guide walks you through installing Identity Connect, configuring directory sync, and optionally setting up password sync agent.
Download and install the Identity Connect Agent on a machine that meets the following requirements
- Supported platforms: 64-bit Windows Server 2008 or later / Windows 10 or later
- LDAP user credentials with read access to your directory
- The agent must be installed on a machine within the same network as your LDAP server (preferably a Domain Controller if you also plan to install the Password Sync Agent)
Download the Agent
- Sign in to Zoho Directory. Click Admin Panel from the left menu.
- Go to the Directory Stores tab. Click Add Directory.
- Find Active Directory and click Add.
- On the Download Agent screen:
- Review the prerequisites.
- Copy the Installation Key displayed there.
- Click Download Agent and wait for the download to complete.
Install the Agent
- Execute the downloaded file ZohoDirectory_IdentityConnect.msi to start installation.
- Paste the Installation Key. Upon successful validation, you'll be taken automatically to the setup wizard where you can complete the rest of the installation steps.
- On the Welcome screen, choose your language.
- Read the software license agreement carefully, then accept the terms. Click Continue. Clicking the URL will not auto-redirect you to the page in some legacy systems, so click 🔗 to copy the URL, then paste it in your browser to read up.
- Open the provided Login URL from a browser.
- Sign in to your Zoho Directory admin account if you haven't already.
- Enter the Verification Code shown in the installer.
- Upon successfully signing in, a confirmation screen with your Zoho account email and display name appears. Click Continue.
- Once the agent is installed, complete the sync setup in Zoho Directory.
Possible error cases that appear at this step:
ErrorFixThe verification code is time-bound and will become invalid after the expiration time (5 minutes).Click Retry to generate a new code, which you can use to sign in and proceed to configuring your LDAP settings.Sometimes, the agent may not be able to contact the Zoho server due to network issue.Click Retry. If the error persists, contact support. Configure Sync in Zoho Directory
Configure LDAP Connection Details
- This is a crucial step where the agent is allowed to connect with Active Directory to fetch data of users and groups for sync.
- Enter your directory info: Domain Name, Domain Controllers, User's Distinguished Name (DN), Password. Make sure they're all valid.
- Enable SSL for a secure connection:
- SSL is recommended, as it safeguards sensitive directory data during transmission.
- To use SSL:
- Your Domain Controller must have a valid SSL certificate issued to its domain.
- You must use the fully qualified domain name (FQDN) in the field dedicated for entering Domain Controller names (e.g., ldap-server-1.zylker.com). Using only the hostname will cause SSL failure.
- Click Next to review the LDAP configurations. If you face the error 'LDAP server goes unreachable,' click Retry to attempt the connection again. Make sure that there's no connectivity issue between the agent machine and LDAP server.
Complete Installation
- Click Install to finish setting up the agent.
- Once you're finished, the agent will run in the background as a tray app. You can select the icon to perform the following actions:
- Change ownership - Switch the Zoho Directory admin account linked to the agent in case the original admin leaves your organization or loses LDAP access.
- Change LDAP settings - Modify your LDAP server details here. After making changes, click Update to save them.
- Go back to the Zoho Directory Admin Panel to complete the remaining setup.
Configure Sync Options
Select Organizational Units (OUs)
- From the Admin Panel, navigate to Active Directory.
- Choose which OUs you want to sync to Zoho Directory.
- Select object types to include:
- Users
- Groups
- Security Groups
- Custom LDAP Query - Enter a valid LDAP query and click Save to sync based on specific LDAP attributes.
- Review the chosen OUs:
- Edit or remove any of those existing OU preferences.
- To add more OUs, click Add OUs.
- When you're done, click Add and Continue.
Map Zoho Directory fields with your LDAP fields
- This is important for making sure user data is correctly transferred.
- Toggle between User Mapping and Group Mapping.
- Fields will be auto-suggested, but you can map them manually.
- Use the tabs to filter by All Fields, Mapped, or Unmapped fields. For example, you can map the Zoho Directory "Last name" field to your LDAP "Surname" attribute.
- For custom attributes:
- Click Edit next to one of the default attributes displayed.
- Select Custom AD attribute.
- Enter a name for the attribute and save it.
Define Sync Criteria
- On the SET SYNC CRITERIA screen, specify which users or groups should be included in the sync. Switch to the Groups tab if needed.
- Select import type: Based on criteria / All users
- If using criteria: Define Field, Relationship, and Value. Click Save and Next.
Configure Sync Settings
Password Sync Agent (Separate installation)
- The main Identity Connect Agent, when coupled with your Active Directory details, allows you to deploy multiple Password Sync Agents (one per Domain Controller) to instantly capture any password change made on these Domain Controllers and securely sync those changes to Zoho Directory.
- Prerequisites to use the Password Sync Agent:
- Use an LDAP account with Domain Admin-level privileges. The same account credentials provided during the Identity Connect setup will be used for this installation.
- Ensure Powershell remoting (WinRM) is enabled on every Domain Controller where you plan to install the Password Sync Agent. You need not enable WinRM on Domain Controllers where the agent will not be installed. Learn how to enable WinRM
- Ensure SMB (Server Message Block) is enabled on both the machine initiating the installation and the target Domain Controller and is also allowed through the firewall (SMB typically uses port 445). Learn how to detect and enable SMB
- The machine with the Identity Connect Agent must be bound to the Active Directory domain.
- To enable:
- Enable the toggle to sync the user passwords securely from Active Directory to Zoho Directory.
- (Domain Name is auto-filled based on the info you entered for the Identity Connect Agent installation.)
- Select the Domain Controllers where password sync is needed and make sure all of them meet the exclusive requirements to house this agent.
The Zoho Directory Identity Connect agent transfers the Password Sync Agent installer file to the selected Domain Controller over SMB. If SMB is disabled or blocked, the file transfer will fail and the installation cannot proceed.
The file being transferred is the Password Sync Agent installer MSI file (ZohoDirectory_PasswordSynchronizer.msi), which must be successfully copied from the machine where the Zoho Directory Identity Connect Agent is installed to the selected Domain Controller. SMB is only required during this file transfer stage. Once the installation is complete, SMB is no longer required. - Select whether you want to auto-restart the Domain Controllers after installation. Regardless of what you choose, the password sync agent takes effect only after a Domain Controller restart.
- If installation fails, the installer will only display Installation failed. Most usual causes are when one or more of the prerequisites are not available:
- The provided account doesn't have Domain Admin rightsIf installation fails due to insufficient privilegesThe Password Sync Agent installation requires elevated permissions to perform remote operations such as file transfer and command execution on Domain Controllers. If the account configured in the Identity Connect Agent does not have sufficient privileges, the installation may fail.To resolve this:
- Open the Identity Connect Agent on the machine where it is installed.
- Update the directory credentials to an account with Domain Admin privileges.
- Save the changes and retry installing the Password Sync Agent from the Admin Panel.
Updating the credentials does not require reinstalling the Identity Connect Agent. If installation continues to fail after verifying permissions, WinRM, and SMB availability, contact Zoho Directory Support for further assistance. - Open the Identity Connect Agent on the machine where it is installed.
- WinRM is not enabled on the Domain Controller .
- The agent file could not be transferred to the Domain Controller because SMB service is either disabled on one of the machines or blocked by the firewall (port 445).
User Sync Settings
- Configure automated rules for user account handling based on changes in Active Directory.SettingWhat it is forOptionsPassword NotificationsDecide how new users get their initial passwordsSend email OTP to user - The new user will receive an email directly to their registered email address containing an OTP.Send email OTP to admin - Admin will receive the OTP or setup info, which they should then forward to the user manually.Don't notify - No automatic notifications are sent. An admin should manually notify the user and provide them with their login credentials through some other medium on their own.Status SyncChoose how to reflect a user's AD account status changes in Zoho Directory.Reflect - If disabled in AD, ZD account also gets disabled (and re-enabled if restored).Do nothing - Ignore AD status changes.If Do nothing is selected, the system will no longer manage user status. The When User Leaves Selected OU setting will be disabled and unavailable, as it requires Status Sync to be enabled. Learn more about this interactive behaviour illustrated after the table.Mail NotificationsChoose whether you want to send notifications to synced users.Send - Sends emails to newly synced users and resend invite links to pending users.Don't send - No email notifications are sent to users.When User Leaves Selected OUDefine what should happen in Zoho Directory when a user is moved out of a selected/synced AD OU.Disable - The user's Zoho account is auto-disabled.Do nothing - The user's Zoho account remains active, but will no longer be included in the future sync operations.Important note: There's this crucial interaction between Setting 2 and Setting 4. The When User Leaves Selected OU setting depends on Status Sync. The former is only available if the latter is set to Reflect in Zoho Directory. If you choose to Do nothing with status changes, the system cannot manage user status based on OU membership. Therefore, Setting 4 will be disabled altogether.
- For example, let's assume there's a user named Dexter in AD and see how he's affected during sync with these two settings:Status SyncWhen User Move Out of Selected OUAction done on Dexter (in AD)Result (in ZD)Reflect in ZDDisable in ZDDexter is removed from OU but still active in ADDexter's Zoho account is disabled (OU rule applies)Do nothing(field gets disabled with Do nothing selected)Dexter is removed from OUDexter's Zoho account remains active but is no longer synced (because Status Sync setting is ignoring status changes, and OU-based handling is off)
Schedule Sync
- Set frequency (Daily/Weekly/Monthly) and time of sync. Click Save and Next.
Review and Finalize Sync
- Review and select users from the imported list to add to Zoho Directory. This screen helps you with filters:
- New Users - Users found in your directory but not yet in Zoho Directory.
- Users to Update - Existing ZD users whose info will be updated from your directory in the next sync.
- Marked for Activation/Disable - Users who will be activated or disabled based on their status in your directory. Pay attention to this category of users before syncing in order to avoid unintended modifications to their access levels.
- Ignored - Users who do not meet the defined sync criteria.
- Click Add and Continue.
- Review the summary and click Finish to complete the setup. Once installed on multiple Domain Controllers, the Password Sync Agents work together under the same Identity Connect configuration, keeping all password updates in sync without extra manual steps.
At this point, you're done with the Identity Connect setup. The system will now automatically sync your AD users and groups to Zoho Directory based on the rules you have defined.
Additionally, you will be able to view the detailed status of both the Identity Connect Agent and the Password Sync Agent in the following formats:
Identity Connect Agent
Domain controller(s): The Domain Controllers the agent is configured to sync with.
Agent version: The current version of the agent.
Device name: The name of the machine where the agent is installed.
Status: Connected / Disconnected.
Last sync: The timestamp of the last successful sync.
Password Sync Agent
This
section lists each Domain Controller and its password sync status. All
agents listed here belong to the same Identity Connect set-up, making it
easier to monitor multiple Domain Controllers from one place.
Status: Connected / Disconnected. Restart the Domain Controllers that are "Disconnected"
Installation status: Installation initiated / Installation complete / Installation failed /
Uninstallation initiated / Uninstallation complete / Uninstallation
failed.
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho Writer?
Create. Review. Publish.
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Configure provisioning for AWS Identity Center with Zoho Directory
User provisioning with AWS Identity Center enables you to provision and deprovision users in AWS Identity Center from Zoho Directory Admin Panel, enabling you to use Zoho Directory as a single source of truth. Prerequisites An Application admin role ...Add Microsoft Entra ID to Zoho Directory
Prerequisites: Roles required to perform this action : Organization Owner Organization Admin Add Entra ID to Zoho Directory Using API Using SCIM Using API In Microsoft Entra ID: Sign in to Microsoft Entra admin center. In the left panel, click Entra ...Import users to Zoho Directory from other cloud identity solutions
Transferring user information from one identity provider to another can be tedious, and requires utmost care and effort, since even one mistake can lead to data breaches or loss. Zoho Directory provides you with different ways to import your users. ...AWS Identity Center for Zoho Directory
Prerequisites An Application admin role in AWS Identity Center account. AWS account root user permissions. Configure SAML in Zoho One /Directory 1. If you're a Zoho One user: Sign in to Zoho One , then click Directory in the left menu. Go to ...Zoho Directory Sync Tool - Troubleshooting
Prerequisites Roles required to perform this action: Organization Owner Organization Admin Troubleshooting This document contains error messages you may encounter when you're setting up and using the Zoho Directory Sync Tool, and the methods to ...
New to Zoho LandingPage?
Zoho LandingPage Resources