Active Directory Integration Guide

Linking Cloud Voice to your on-premises Active Directory (AD) lets the phone system draw its user list straight from the directory you already maintain. Once connected, Cloud Voice pulls in AD users, organizational units, and groups, provisions extensions for them automatically, and lets those users sign in to the Cloud Voice App with the same domain credentials they use elsewhere.

This guide walks through setting up the integration and keeping it running day to day.

What you need first

Confirm the following before you begin:

• Directory server: Active Directory running on Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, or 2019.
• Cloud Voice firmware: version 84.23.0.24 or newer.
• Cloud Voice plan: the Ultimate Plan (UP).

Caution

Both the firmware version and the Ultimate Plan are hard requirements. If either one is not met, the Active Directory option will not appear in the phone system, so check them first before you spend time on setup.

What the integration does

• One-way directory sync: Cloud Voice mirrors your AD users, organizational units (an organizational unit, or OU, is a container Active Directory uses to group objects such as users or departments), and groups into its own directory. The sync flows in a single direction, from Active Directory into Cloud Voice: any change you make to a synced object in Active Directory is carried over automatically, so the two stay aligned without manual re-entry.
• Automatic extension provisioning: as users are brought across from AD, Cloud Voice creates and assigns an extension for each one, giving them immediate access to the system’s unified communications (UC) features such as calling, voicemail, and messaging.
• Domain-account sign-in: synced users log in to the Cloud Voice App with their existing AD domain accounts, so there are no separate voice credentials to distribute or manage.

Caution

Because the sync is one-way, Active Directory is the source of truth. Do not edit synced users, organizational units, or groups directly in Cloud Voice: your changes can be overwritten by the next synchronization. Make the change in Active Directory instead, or pause the sync first (see Pause synchronization) if you need a local edit to hold.

Set up the integration

Work through these topics in order to connect a directory and define what gets synchronized:

1. Connect Cloud Voice to Active Directory, establish the LDAP connection between the phone system and your directory.
2. Synchronize AD users, choose which users to bring in; Cloud Voice creates matching extensions and keeps them current.
3. Synchronize AD organizational units, map selected OUs to Cloud Voice organizations or extension groups.
4. Synchronize AD groups, sync the groups you want into Cloud Voice extension groups.
5. Enable domain-account sign-in, let synced users open the Cloud Voice App with their AD credentials.

Note

LDAP stands for Lightweight Directory Access Protocol. It is the standard way applications read from and write to a directory service, and it is how Cloud Voice talks to Active Directory. You provide the directory server address and an account that is allowed to read it during step 1.

Manage the integration

After the integration is live, use these topics to control when and how synchronization happens:

• Schedule automatic synchronization, Cloud Voice syncs at 00:30 daily by default; adjust the time to suit your maintenance window.
• Run a synchronization manually, push a new rule or recent AD changes through right away instead of waiting for the schedule.
• Pause synchronization, temporarily hold the sync so incoming AD updates don’t overwrite your current data.
• Disable the integration, switch the integration off for troubleshooting while keeping its configuration intact.
• Disconnect the integration, remove the current directory link entirely, for example before integrating with a different directory.

Tip

For a temporary stop, such as troubleshooting, use Disable: it turns the integration off but keeps all your settings, so you can switch it back on without rebuilding anything. Reach for Disconnect only when you are moving to a different directory.

Caution

Disconnecting removes the directory link and its configuration. If you reconnect later you will have to set up the connection and synchronization rules again from scratch, so use Disable instead whenever you only need to pause the integration for a while.