# Integrate Cloud Voice with Active Directory

Linking Cloud Voice to Active Directory (AD) lets your directory become the source of truth for user accounts. The connection runs over the Lightweight Directory Access Protocol (LDAP), and once it is in place you can build rules that turn AD users, organizational units, and groups into extensions automatically. This page walks through establishing the connection.

## Requirements

- **Operating system**: Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, or 2019.
- **Phone system**: firmware version `84.23.0.24` or later, on the Ultimate Plan (UP).

## Before you begin

Confirm that the phone system can reach your Active Directory over LDAP. On the firewall in front of the directory, open the ports that carry LDAP(S) queries from the phone system so the directory can answer them:

- TCP/UDP 389 for LDAP
- TCP/UDP 636 for LDAPS (**strongly recommended**)

:::caution
Prefer LDAPS. Plain LDAP sends the directory queries and the administrator account credentials across the network unencrypted, so anyone who can capture that traffic could read them. Use LDAPS (port 636) whenever your directory supports it, and fall back to LDAP only on a fully trusted network.
:::

Collect these details from Active Directory ahead of time:

- The IP address of the network segment where the Active Directory Domain Controller lives.
- The Distinguished Name (DN) of the directory node where searches should begin.
- The username and password of an AD domain account. The username must be supplied as a Distinguished Name (DN) or a User Principal Name (UPN), and the account needs full read access to the target directory so it can read directory data during synchronization.

:::tip
To find a node's DN or an account's DN/UPN, turn on **View > Advanced Features** in *Active Directory Users and Computers*. Right-click the node or account, then open **Properties > Attribute Editor** and read the `distinguishedName` (or `userPrincipalName`) value.
:::

## Set up the connection

1. Sign in to the phone system portal and go to **Integrations > Collaboration**.
2. Find the **Active Directory (AD)** service and click **Integrate**.
3. Under **Connect to Active Directory Domain**, complete the following fields.

   | Setting | Description |
   |---------|-------------|
   | Host IP | The IP address of the network where the Active Directory Domain Controller resides. |
   | Protocol | The communication protocol: **LDAP** for unencrypted traffic, or **LDAPS** for LDAP secured with SSL/TLS. |
   | Port | The port used to reach Active Directory. Defaults are 389 for LDAP and 636 for LDAPS; enter a different value if your directory listens on a custom port. |
   | Base DN | The distinguished name of the entry that anchors directory searches. For example, to search from the organizational unit `sales` in the domain `localdirectory.com`, enter `OU=sales,dc=localdirectory,dc=com`. |

   :::note
   - On Windows Server 2016 and later, LDAPS requires Active Directory Certificate Services (AD CS).
   - You can switch the protocol later if your needs change.
   :::

4. Under **Administrator Account Authorization**, supply the AD domain account credentials.

   | Setting | Description |
   |---------|-------------|
   | Administrator Logon Username | The account username, given as either a fully distinguished name (DN) or a User Principal Name (UPN). Examples: DN `cn=Administrator,cn=Users,dc=localdirectory,dc=com`; UPN `Administrator@localdirectory.com`. |
   | Administrator Password | The password that goes with the username. |

5. Click **Save**. A dialog confirms that the integration succeeded.

   ![Confirmation dialog reporting that the Active Directory integration completed](/images/pbx/integration-ok.png)

6. Click **Yes** to dismiss the dialog.

## Result

On the integration page, **Status** now reads "Connected", confirming that the phone system is talking to Active Directory.

![Integration page with a Connected status shown for Active Directory](/images/pbx/ad-integration-success.png)

## What to do next

Create synchronization rules to bring the AD users, organizational units, and groups you want into the phone system. For details, see:

- [Synchronize Active Directory Users to Cloud Voice](/pbx/integrations/ad/synchronize-active-directory-users-to-cloud-voice-cloud-voice/)
- [Synchronize Active Directory Organizational Units to Cloud Voice](/pbx/integrations/ad/synchronize-active-directory-organizational-units-to-cloud-voice-cloud-voice/)
- [Synchronize Active Directory Groups to Cloud Voice](/pbx/integrations/ad/synchronize-active-directory-groups-to-cloud-voice-cloud-voice/)