Skip to content

Active Directory Permissions Reference

Summary

SailPoint Entro requires a single read-only LDAP bind account. The account must be able to enumerate users, groups, computers, and basic attributes. No administrative or write privileges are needed.

The bind is targeting a Global Catalog, or a Domain Controller if GC can't be reached.

Required Roles / Access

  • Directory read access to:

    • CN=Users,DC=<domain>

    • CN=Computers,DC=<domain>

    • Any OU structures containing user/group objects

  • Ability to read these attributes:

    • member, memberOf, sAMAccountName, userPrincipalName, lastLogon, objectSID, objectGUID, userAccountControl, servicePrincipalName

  • If searching ACLs, the account must be able to read security descriptor metadata where allowed via LDAP.