Integrate Cloud Voice with Active Directory

Linking Cloud Voice to Active Directory (AD) lets your directory become the source of truth for user accounts. The connection runs over the Lightweight Directory Access Protocol (LDAP), and once it is in place you can build rules that turn AD users, organizational units, and groups into extensions automatically. This page walks through establishing the connection.

Requirements

• Operating system: Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, or 2019.
• Phone system: firmware version 84.23.0.24 or later, on the Ultimate Plan (UP).

Before you begin

Confirm that the phone system can reach your Active Directory over LDAP. On the firewall in front of the directory, open the ports that carry LDAP(S) queries from the phone system so the directory can answer them:

• TCP/UDP 389 for LDAP
• TCP/UDP 636 for LDAPS (strongly recommended)

Caution

Prefer LDAPS. Plain LDAP sends the directory queries and the administrator account credentials across the network unencrypted, so anyone who can capture that traffic could read them. Use LDAPS (port 636) whenever your directory supports it, and fall back to LDAP only on a fully trusted network.

Collect these details from Active Directory ahead of time:

• The IP address of the network segment where the Active Directory Domain Controller lives.
• The Distinguished Name (DN) of the directory node where searches should begin.
• The username and password of an AD domain account. The username must be supplied as a Distinguished Name (DN) or a User Principal Name (UPN), and the account needs full read access to the target directory so it can read directory data during synchronization.

Tip

To find a node’s DN or an account’s DN/UPN, turn on View > Advanced Features in Active Directory Users and Computers. Right-click the node or account, then open Properties > Attribute Editor and read the distinguishedName (or userPrincipalName) value.

Set up the connection

1. Sign in to the phone system portal and go to Integrations > Collaboration.

2. Find the Active Directory (AD) service and click Integrate.

3. Under Connect to Active Directory Domain, complete the following fields.

   Setting	Description
   Host IP	The IP address of the network where the Active Directory Domain Controller resides.
   Protocol	The communication protocol: LDAP for unencrypted traffic, or LDAPS for LDAP secured with SSL/TLS.
   Port	The port used to reach Active Directory. Defaults are 389 for LDAP and 636 for LDAPS; enter a different value if your directory listens on a custom port.
   Base DN	The distinguished name of the entry that anchors directory searches. For example, to search from the organizational unit sales in the domain localdirectory.com, enter OU=sales,dc=localdirectory,dc=com.

   Note

   • On Windows Server 2016 and later, LDAPS requires Active Directory Certificate Services (AD CS).
   • You can switch the protocol later if your needs change.

4. Under Administrator Account Authorization, supply the AD domain account credentials.

   Setting	Description
   Administrator Logon Username	The account username, given as either a fully distinguished name (DN) or a User Principal Name (UPN). Examples: DN cn=Administrator,cn=Users,dc=localdirectory,dc=com; UPN Administrator@localdirectory.com.
   Administrator Password	The password that goes with the username.

5. Click Save. A dialog confirms that the integration succeeded.

   

6. Click Yes to dismiss the dialog.

Result

On the integration page, Status now reads “Connected”, confirming that the phone system is talking to Active Directory.

What to do next

Create synchronization rules to bring the AD users, organizational units, and groups you want into the phone system. For details, see:

• Synchronize Active Directory Users to Cloud Voice
• Synchronize Active Directory Organizational Units to Cloud Voice
• Synchronize Active Directory Groups to Cloud Voice