# Securing the Active Directory Application

Secure the Active Directory application by using the following communication paths based on the operations performed.

SailPoint recommends securing every communication path for the Active Directory application by following the configurations outlined below:

- Source (VA) and Active Directory Domain Controller (for most of the read operations): [TLS Configuration on Virtual Appliances](<https://documentation.sailpoint.com/connectors/microsoft/active_directory/va/help/tls/tls_configuration_on_virtual_appliances.html>) is required to secure this path.
- Source (VA) and IQService (for provisioning and read operations for Skype management): TLS Configuration Between VA and IQService is required to secure this path. For more information, refer to [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/microsoft/active_directory/va/help/iqservice/configuring_tls_and_client_authentication_for_iqservice.html>).
- IQService and Active Directory Domain Controller (for provisioning and read operations for Skype management): TLS configuration between IQService and Active Directory Domain Controller is required to secure this path.

## Securing Communication Path Between IQService and Active Directory Domain Controller / Target System

For IQService to connect using TLS and self-signed certificates, you must install the certificate in Trusted Root Certification Authorities on the IQService host.

To install a certificate, complete the following:

1. Export the server certificate and copy the exported `.cer` file to the IQService host.
2. Double-click the `.cer` file, select **Install Certificate**, and select **Next**.
3. Choose **Place all certificates in the following store** and select **Browse**.
4. Select **Show physical stores**.
5. Expand **Trusted Root Certification Authorities** and select **Local Computer**.
6. Select **OK**.
7. Select **Next**, and then **Finish**.

## Certification for Microsoft Advisory ADV190023

The Active Directory source is certified for the Microsoft [ADV190023 Advisory](<https://msrc.microsoft.com/update-guide/vulnerability/ADV190023>). All source functionality works correctly when LDAP channel Binding and LDAP Signing configuration are enabled on Domain Controller. These settings are only applicable over secure channel using TLS protocol, ensure that TLS is configured.