Business identities from Active Directory

Identity Stack can read business identities directly from your on-premises Active Directory. This works like an custom integration, but you do not build or schedule anything. Identity Stack Agent reads the directory and keeps Identity Stack up to date.

Source	User objects in the OUs that you select, with an optional LDAP filter
Frequency	Every hour
Direction	One way, from Active Directory to Identity Stack. Identity Stack does not write to Active Directory for this feature.
Software	Identity Stack Agent. No other software is necessary.
Linking	Automatic, by sAMAccountName

Requirements

• Identity Stack Agent, enrolled, with the connector service running. Only the primary host reads the directory.
• One domain. Identity Stack reads the domain that the primary host is a member of.
• Read access for the gMSA. The gMSA must be able to read the OUs and the attributes that you configure. See Read access to confidential attributes.
• Users synchronized to Microsoft Entra ID with Microsoft Entra Connect or Microsoft Entra Cloud Sync. Identity Stack uses the on-premises account name from Microsoft Entra ID to link users.

The gMSA does not need Replicating Directory Changes for this feature.

Read access to confidential attributes

The default read access of Authenticated Users is usually sufficient. An attribute that is marked as confidential in your schema is different. An attribute that holds CPR numbers is often confidential.

For each confidential attribute that you map, grant the gMSA security group these permissions on the OUs:

• Read Property
• Control Access

Scope rules

A scope rule selects the accounts for one affiliation type. You make one rule for each affiliation type that you want to read. Each rule has:

• An affiliation type: Employment, Enrollment, Engagement, or Other.
• One or more OUs. The rule includes the accounts in these OUs and in all OUs below them.
• An LDAP filter (optional). The filter limits the accounts further, for example (employeeType=Staff).

Identity Stack examines the rules in the sequence that you give. An account gets the affiliation type of the first rule that it matches. For example, a teacher who is also a student gets Employment if the employment rule is first.

Identity Stack never reads disabled accounts.

Attribute mapping

Business identity field	Default attribute	Required	Values
First name	givenName	Yes	One
Last name	sn	Yes	One
Birth date	None	No	One
Nationality	None	No	One two-letter country code, for example DK
Personal email	None	No	One
Personal phone	None	No	One
Personal number (CPR)	None	No	One
Passport	None	No	One or more
National ID card	None	No	One or more

You can map any attribute that exists in your directory schema and that the gMSA can read. This includes custom schema attributes. It also includes extensionAttribute1 to extensionAttribute15 when the Exchange schema extensions are installed.

Value formats

• CPR number. Use 10 digits, with or without a dash, for example 0101901234 or 010190-1234. The number must be a valid CPR number.
• Passport and national ID card. Use the two-letter code of the issuing country, then the document number, for example DK123456789. Put each document in a separate value of a multi-valued attribute.

Synchronization

Every hour, the agent reads all accounts in scope. Identity Stack then updates its business identities:

• An account that matches a rule for the first time gets a new business identity.
• A changed attribute updates the business identity.
• Identity Stack removes the business identity when the account is deleted, disabled, moved out of the OUs, or no longer matches the filter.
• Identity Stack skips an account with a value that is not valid. The existing business identity of that account does not change. Identity Stack synchronizes all other accounts.
• When the agent is offline, nothing changes and nothing is removed. Synchronization starts again when the agent connects.

Removal is permanent. If the account comes back into scope, Identity Stack makes a new business identity and links it again.

Examples of values that are not valid:

• A CPR number that is not valid
• A passport number without a country code
• An empty first name

Correct the value in Active Directory. The next synchronization reads the corrected value.

Read-only business identities

You cannot change a business identity from Active Directory in Identity Stack. Make the change in Active Directory. This synchronization does not change other business identities, such as the ones that you create manually or that come from an HR integration.

Linking to Microsoft Entra ID users

After each synchronization, Identity Stack links each business identity to a Microsoft Entra ID user. The Microsoft Entra ID user must have the same on-premises account name (sAMAccountName) in the same domain.

• A new account usually gets a link within one or two synchronizations. First, the account must be synchronized to Microsoft Entra ID and Identity Stack.
• The synchronization never removes a link. You can remove or change a link manually.
• A Microsoft Entra ID user can have only one business identity. If the Microsoft Entra ID user already has a business identity from another source, Identity Stack does not link the business identity from Active Directory.

Security and privacy

• The agent only reads from Active Directory for this feature.
• The data goes through the encrypted, authenticated connection of the agent. Nothing is stored on the agent host.
• Identity Stack never writes attribute values to logs. This includes CPR numbers and document numbers.
• Only Identity Stack administrators can see CPR numbers and document numbers.

Configuration

In the first release, Identity Stack configures the synchronization for you. Send this information to support@identitystack.dk:

1. The scope rules, in sequence. For each rule, give the affiliation type, the distinguished names of the OUs, and the LDAP filter (if any).
2. The attribute that holds each field that you want to read.
3. Confirmation that the gMSA can read the OUs and the attributes.