{"id":113599,"date":"2024-08-19T01:25:54","date_gmt":"2024-08-19T05:25:54","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=113599"},"modified":"2024-08-22T16:23:13","modified_gmt":"2024-08-22T20:23:13","slug":"adi-use-ad-delegated-authentication","status":"publish","type":"support","link":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication","title":{"rendered":"ADI: Use AD Delegated Authentication"},"content":{"rendered":"\n<p>Extending Active Directory (AD) to the Cloud is even simpler using the delegated authentication capabilities of the JumpCloud Active Directory Integration (ADI).<\/p>\n\n\n\n<p><strong>What is Delegated Authentication?<\/strong><\/p>\n\n\n\n<p>Delegated Authentication uses an external source, like AD, to verify a user\u2019s password.&nbsp;Delegated authentication is different from federated user authentication in 2 key ways:<\/p>\n\n\n\n<ol>\n<li>JumpCloud is the Identity Provider (IdP). The external source is used for password validation only.&nbsp;<\/li>\n\n\n\n<li>The user is not redirected to the external source. Instead, they remain in the JumpCloud login flow and the verification is happening behind the scenes.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"712\" height=\"241\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png\" alt=\"\" class=\"wp-image-113889\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png 712w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7-300x102.png 300w\" sizes=\"(max-width: 712px) 100vw, 712px\" \/><\/figure>\n\n\n\n<p><strong>Why Delegate User Authentication to AD?<\/strong><\/p>\n\n\n\n<p>There are several use cases for which delegated user authentication is required or preferred:<\/p>\n\n\n\n<ul>\n<li><strong>Easier integration deployment<\/strong> &#8211; Install the import agent on a small number of member servers not on all domain controllers (DCs) while still keeping and managing passwords in AD only<\/li>\n\n\n\n<li><strong>Compliance<\/strong> &#8211; Keep the password behind the AD firewall and still extend AD to the cloud using JumpCloud.<\/li>\n\n\n\n<li><strong>Seamless onboarding of existing users to the Cloud<\/strong> &#8211; End users log in to JumpCloud for the first time using their existing corporate email address and AD password.\u00a0No need to reset passwords<\/li>\n\n\n\n<li><strong>SSO without ADFS<\/strong> &#8211; Allow users to use a single secure identity to access their on-premise and Cloud resources without having to use Active Directory Federation Services (ADFS)<\/li>\n<\/ul>\n\n\n\n<p><strong>Important Considerations<\/strong><\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>When upgrading from AD import agent v2.6.0 or lower, you must select <strong>Install New Agent<\/strong> from the Downloads dropdown menu in the ADI Details page to get the connect key, which is required to complete the upgrade of the agent on the AD server.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ul>\n<li>Delegated authentication to AD is supported by JumpCloud AD import agent v3.0 and higher and is supported when the import agent is installed on all AD Domain Controllers (DCs) or on AD member server(s)<\/li>\n\n\n\n<li>To use delegated authentication to AD, the primary import agent must be version\u00a0v3.0 or higher and the status of the ADI delegated authentication setting, <strong>Delegate Password Validation<\/strong>, must be enabled and active<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card warning\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Warning:<\/strong> \n<p>All installed import agents should be the same version to avoid unexpected behavior or the potential for users not being able to log in if the primary agent is switched.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>When upgrading the AD import agent to version 3.0, existing users connected to the domain will not have their log in delegated to AD unless the <strong>Delegated Authority<\/strong> is manually set to <strong>Active Directory<\/strong> for those existing users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ul>\n<li>User portal and SSO logins are delegated to AD when the following are true:\n<ul>\n<li>The delegated authentication setting, <strong>Delegate Password Validation<\/strong>, is enabled and active for the ADI configuration<\/li>\n\n\n\n<li>User has access to the delegation-enabled AD domain, and their <strong>Delegated Authority<\/strong> is set to Active Directory on their user record<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card warning\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Warning:<\/strong> \n<ul>\n<li>Users will <strong>NOT<\/strong> be able to log in if their <strong>Delegated Authority<\/strong> is Active Directory and the status of the delegated authentication setting, <strong>Delegate Password Validation<\/strong>, is pending or disabled in the ADI configuration, all import agent(s) have been deleted, or the ADI integration has been deleted.<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>Users will <strong>NOT<\/strong> be able to log in to the JumpCloud User Portal or SSO apps if they are connected (bound) to multiple delegation-enabled AD domains.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ul>\n<li>Device password reset flow is delegated to AD when the following are true:\n<ul>\n<li>The device is managed by JumpCloud<\/li>\n\n\n\n<li>The delegated authentication setting, <strong>Delegate Password Validation<\/strong>,<strong> <\/strong>is enabled and active for the ADI configuration<\/li>\n\n\n\n<li>User has access to the delegation-enabled AD domain, and their <strong>Delegated Authority<\/strong> is set to Active Directory on their user record<\/li>\n\n\n\n<li><strong>Self-Service Account Provisioning<\/strong> is enabled and<strong> Default Password Sync<\/strong> is disabled in <strong>Devices &gt; Settings<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>On devices, with the configuration above, only the password used during the password reset flow is delegated to AD for validation.&nbsp;The user must set and use a local password or PIN for device logins. Their device login credentials will be managed separately.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ul>\n<li>Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegation is enabled for them<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<ul>\n<li>If the import agent is <strong>installed on DCs<\/strong>, the <strong>password is stored<\/strong> in JumpCloud after the initial log in. The stored password continues to be synced from AD to JumpCloud and from JumpCloud to other resources. The password can be used to log in to resources that don\u2019t support delegated authentication to AD, such as Cloud RADIUS, Cloud LDAP, and devices.<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>If the import agent is <strong>installed on AD member servers<\/strong>, the <strong>password is never stored <\/strong>in JumpCloud.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ul>\n<li>Cloud RADIUS and Cloud LDAP resource log ins cannot be delegated to AD.\u00a0A user must have a password in JumpCloud to be able to access these resources<\/li>\n\n\n\n<li>The delegated authentication setting, <strong>Delegated Password Validation<\/strong>, is enabled by default for the <strong>Manage users and passwords in Active Directory<\/strong> ADI configuration and cannot be disabled<\/li>\n\n\n\n<li>The delegated authentication setting, <strong>Delegated Password Validation<\/strong>, is disabled by default but can be enabled for the <strong>Manage users and passwords in JumpCloud, AD or both<\/strong> configuration<\/li>\n\n\n\n<li>When the JumpCloud AD import agent is installed on DCs, the AD passwords sync to JumpCloud. This means that the password will be saved in both AD and JumpCloud.\u00a0This applies to both ADI configurations: <strong>Manage users and passwords in Active Directory <\/strong>and<strong> Manage users and passwords in JumpCloud, AD or both<\/strong><\/li>\n\n\n\n<li>When the JumpCloud AD import agent is installed on member servers, the AD password does not sync to JumpCloud.&nbsp;\n<ul>\n<li>In the <strong>Manage users and passwords in Active Directory<\/strong> configuration, this means the password will only be in AD. In this configuration, the user&#8217;s <strong>Password Authority<\/strong> should also be set to <strong>Active Directory<\/strong> to prevent a password from being entered in JumpCloud by either a JumpCloud Admin or the end user<\/li>\n\n\n\n<li>In the <strong><strong>Manage users and passwords in JumpCloud, AD or both<\/strong><\/strong> configuration, this means users imported from AD will not have their AD password stored on their initial login to JumpCloud nor will the password sync from AD to JumpCloud. Any user connected to a delegation-enabled AD domain, ones created in AD and ones created in JumpCloud, with their <strong>Password Authority<\/strong> set to <strong>None (JumpCloud)<\/strong> can have a password set and managed in JumpCloud, and their password will be synced from JumpCloud to AD. This configuration is used when user passwords are managed in JumpCloud<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Avoid users not being able to log in to JumpCloud managed resources when changing the delegated authentication settings<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>Do the following before disabling the ADI delegated authentication setting, <strong>Delegate Password Validation<\/strong>, or disconnecting a user from a delegation-enabled AD domain in the JumpCloud Admin Portal:<\/p>\n\n\n\n<ul>\n<li>Verify the user&#8217;s <strong>Password Authority<\/strong> is set to <strong>None (JumpCloud)<\/strong><\/li>\n\n\n\n<li>Either send the user an activation email or set a password for the user from the user record in admin portal<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ul>\n<li>A warning modal is shown with options to either automatically update the <strong>Delegated Authority<\/strong> for every connected (bound) user or not when the following actions are taken:\n<ul>\n<li>on save after delegated authentication is enabled or disabled in the ADI configuration<\/li>\n\n\n\n<li>an ADI AD domain is deleted<\/li>\n\n\n\n<li>a user is directly connected to (bound) or disconnected from (unbound) a delegation-enabled AD domain<\/li>\n\n\n\n<li>a user is connected to (bound) or disconnected from (unbound) a user group connected (bound) to a delegation-enabled AD domain<\/li>\n\n\n\n<li>when a user group is connected (bound) or disconnected (unbound) from a delegation-enabled AD domain.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>The <strong>Delegated Authority<\/strong> can be updated for multiple users at once from the Users page<\/li>\n\n\n\n<li>A user login to the User Portal and for SSO is always delegated to AD, even if they have a password in JumpCloud, as long as all of following criterion are true:\n<ul>\n<li>their <strong>Delegated Authority<\/strong> is set to <strong>Active Directory<\/strong><\/li>\n\n\n\n<li>they are connected to a delegation-enabled AD domain<\/li>\n\n\n\n<li>the status of the ADI delegated authentication setting, <strong>Delegate Password Validation<\/strong>, in enabled and active for the AD domain<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Delegated authentication can be enabled or disabled on a per user basis from the user details page even if they are not connected to a delegation-enabled AD domain<\/li>\n\n\n\n<li>If an import agent is paused, delegated authentication will still occur.&nbsp;Only the import from AD to JC will be paused<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Configuration Steps Overview<\/strong><\/h2>\n\n\n\n<p>To configure delegated authentication to AD, the main steps you will take are outlined below:<\/p>\n\n\n\n<ol>\n<li>Select your ADI deployment configuration:\n<ul>\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-adi-sync-from-ad-to-jumpcloud\">Manage users, security groups, and passwords in AD<\/a>,&nbsp;or <\/li>\n\n\n\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-adi-two-way-sync\">Manage users, groups and passwords in AD, JumpCloud, or both<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>If not already selected, check the option for <strong>Delegated Password Validation<\/strong>.<\/li>\n\n\n\n<li>Download and install the latest <strong>JumpCloud AD Import Agent<\/strong> from the JumpCloud Admin Portal.<\/li>\n\n\n\n<li>Give users access to ADI.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Enable Delegated Authentication for a New AD Domain<\/strong><\/h2>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>The setting for delegated authentication on the ADI configuration is labeled <strong>Delegated Password Validation<\/strong>.&nbsp;<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-enable-delegated-authentication-for-the-manage-users-and-passwords-in-active-directory-configuration\"><strong>To enable delegated authentication for the Manage users and passwords in Active Directory configuration<\/strong><\/h3>\n\n\n\n<ul>\n<li>No action is required.\n<ul>\n<li><strong>Delegated Password Validation<\/strong> is enabled by default for this configuration and cannot be disabled<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>All new users imported from AD to JumpCloud will automatically have their <strong>Delegated Authority<\/strong> set to Active Directory.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>Users imported prior to the release of Import Agent v3.0 will continue to use the password stored in JumpCloud, unless the <strong>Delegated Authority<\/strong> is manually set to Active Directory.&nbsp;If the import agent is installed on a DC, the password will continue to sync to JumpCloud.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-enable-delegated-authentication-for-the-manage-users-and-passwords-in-jumpcloud-ad-or-both-configuration\"><strong>To enable delegated authentication for the Manage users and passwords in JumpCloud, AD or both configuration<\/strong><\/h3>\n\n\n\n<ol>\n<li>When <a href=\"https:\/\/jumpcloud.com\/support\/configure-adi-two-way-sync\">creating a new AD domain<\/a> in the&nbsp;<a href=\"https:\/\/console.jumpcloud.com\/login\/admin\" target=\"_blank\" rel=\"noreferrer noopener\">JumpCloud Admin Portal<\/a>:\n<ul>\n<li>Check <strong>Delegated Password Validation<\/strong> checkbox in the <strong>Configuration Summary<\/strong> section of the Setup step<br><img decoding=\"async\" width=\"1605\" height=\"727\" class=\"wp-image-114456\" style=\"width: 500px;border:black solid 1px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/New-ADI-domain_2Way-Step3_DelegationEnabled_Focus.png\" alt=\"\"><\/li>\n\n\n\n<li>Download and install the Import and Sync&nbsp;agents<\/li>\n\n\n\n<li>Click <strong>Configure ADI<\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>When updating the configuration for an existing AD domain in the&nbsp;<a href=\"https:\/\/console.jumpcloud.com\/login\/admin\" target=\"_blank\" rel=\"noreferrer noopener\">JumpCloud Admin Portal<\/a>:\n<ul>\n<li>Go to <strong>Directory Integrations &gt; Active Directory<\/strong><\/li>\n\n\n\n<li>Click the domain to which you want to enable delegated password validation<\/li>\n\n\n\n<li>Check <strong>Delegated Password Validation<\/strong> checkbox in the <strong>Integration Details<\/strong> section<br><img decoding=\"async\" width=\"576\" height=\"223\" class=\"wp-image-114459\" style=\"width: 500px;border:black solid 1px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Config-2way-Integration-Details_Partial_DelegationFocus.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Config-2way-Integration-Details_Partial_DelegationFocus.png 576w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Config-2way-Integration-Details_Partial_DelegationFocus-300x116.png 300w\" sizes=\"(max-width: 576px) 100vw, 576px\" \/><\/li>\n\n\n\n<li>Make other configuration changes, if needed<\/li>\n\n\n\n<li>Click <strong>Save<\/strong><\/li>\n\n\n\n<li>Review the confirmation message:<br><img class=\"wp-image-114463\"><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Select the update option.<\/li>\n\n\n\n<li>Click <strong>Continue<\/strong>.<\/li>\n\n\n\n<li>When <a href=\"https:\/\/docs.jumpcloud.com\/api\/2.0\/index.html#tag\/Active-Directory\/operation\/activedirectories_post\">adding an ADI for a new AD domain<\/a> using the JumpCloud v2 API:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>curl &#8211;request POST \\<br>&nbsp;&nbsp;&#8211;url https:\/\/console.jumpcloud.com\/api\/v2\/activedirectories \\<br>&nbsp;&nbsp;&#8211;header &#8216;content-type: application\/json&#8217; \\<br>&nbsp;&nbsp;&#8211;header &#8216;x-api-key: REPLACE_KEY_VALUE&#8217; \\<br>  &#8211;header &#8216;x-org-id: REPLACE_ORG_VALUE&#8217; \\<br>&nbsp;&nbsp;&#8211;data &#8216;{&#8220;delegationState&#8221;:&#8221;ENABLED&#8221;,&#8221;domain&#8221;:&#8221;string&#8221;,&#8221;groupsEnabled&#8221;:true,&#8221;useCase&#8221;:&#8221;TWOWAYSYNC&#8221;}&#8217;<\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"4\">\n<li>When <a href=\"https:\/\/docs.jumpcloud.com\/api\/2.0\/index.html#tag\/Active-Directory\/operation\/activedirectories_patch\">updating an existing ADI configuration<\/a> using the JumpCloud v2 API:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card warning\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Warning:<\/strong> \n<p>Users may not be able to log in after this change is made. Changing the delegated authentication setting via the API does not automatically update the <strong>Delegated Authority<\/strong> for users connected to the ADI AD domain. You must update that setting manually for each connected (bound) user. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>Replace <kbd>{id}<\/kbd> with the ID of your ADI instance.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>curl &#8211;request PATCH \\<br>&nbsp;&nbsp;&#8211;url https:\/\/console.jumpcloud.com\/api\/v2\/activedirectories\/{id} \\<br>&nbsp;&nbsp;&#8211;header &#8216;content-type: application\/json&#8217; \\<br>&nbsp;&nbsp;&#8211;header &#8216;x-api-key: REPLACE_KEY_VALUE&#8217; \\<br>  &#8211;header &#8216;x-org-id: REPLACE_ORG_VALUE&#8217; \\<br><br>&nbsp;&nbsp;&#8211;data &#8216;{&#8220;delegationState&#8221;:&#8221;ENABLED&#8221;,&#8221;domain&#8221;:&#8221;string&#8221;,&#8221;groupsEnabled&#8221;:true,&#8221;useCase&#8221;:&#8221;TWOWAYSYNC&#8221;}&#8217;<\/p>\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-enabling-delegated-authentication-for-users\"><strong>Enabling delegated authentication for users<\/strong><\/h2>\n\n\n\n<p>These steps are intended for users who are already connected (bound) to a delegation-enabled AD domain but do not have their <strong>Delegated Authority<\/strong> set to <strong>Active Directory<\/strong>.<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card warning\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Warning:<\/strong> \n<p>Users will <strong>NOT<\/strong> be able to log in to the JumpCloud User Portal or SSO apps if any of the following are true when their <strong>Delegation Authority<\/strong> is set to <strong>Active Directory<\/strong>:<\/p>\n\n\n\n<ul>\n<li>they are connected (bound) to multiple delegation-enabled AD domains.<\/li>\n\n\n\n<li>the status of the ADI delegated authentication setting, <strong>Delegated Password Validation<\/strong>, is <strong>NOT<\/strong> enabled and active.<\/li>\n\n\n\n<li>they are <strong>NOT<\/strong> connected to a delegation-enabled AD domain.<\/li>\n\n\n\n<li>all import agents that support delegation have been deleted.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n<p><strong>Considerations<\/strong><\/p>\n\n\n\n<ul>\n<li>Users must manage their passwords in AD once delegated authentication has been enabled<\/li>\n<\/ul>\n\n\n\n<p><strong>Prerequisites<\/strong><\/p>\n\n\n\n<ul>\n<li>Verify ADI delegated authentication setting, <strong>Delegated Password Validation<\/strong>, is enabled and active on the AD domain to which you will be connecting (binding) the user or to which the user is already connected (bound).<\/li>\n\n\n\n<li>Verify users are not already connected (bound) to a delegation-enabled AD domain.<\/li>\n\n\n\n<li>Verify users do not need access to JumpCloud LDAP integrations and JumpCloud Cloud RADIUS WiFi Networks.<\/li>\n\n\n\n<li>Remind users they will need to log in with their AD login credentials.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-enable-delegated-authentication-for-a-single-user-in-admin-portal\"><strong>To enable delegated authentication for a single user in Admin Portal<\/strong><\/h3>\n\n\n\n<ol>\n<li>Log in to <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to the <strong>USER MANAGEMENT&gt;<\/strong> <strong>Users<\/strong>.<\/li>\n\n\n\n<li>Click the user for whom you want to delegate password validation.<\/li>\n\n\n\n<li>Verify the user is connected to a delegation-enabled domain:\n<ul>\n<li>Click the <strong>Directories<\/strong> tab and see if there is a check next to an ADI domain with the delegation enabled label (Delegation ENABLED).<br><img decoding=\"async\" width=\"356\" height=\"52\" class=\"wp-image-114398\" style=\"width: 300px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label.png 356w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label-300x44.png 300w\" sizes=\"(max-width: 356px) 100vw, 356px\" \/><\/li>\n\n\n\n<li>Select the <strong>User Groups<\/strong> tab<\/li>\n\n\n\n<li>Expand each user group of which the user is a member (bound).<\/li>\n\n\n\n<li>Verify the group gives access to the delegation enabled AD domain.<br><img decoding=\"async\" width=\"652\" height=\"220\" class=\"wp-image-114401\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label-Group-Expansion.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label-Group-Expansion.png 652w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label-Group-Expansion-300x101.png 300w\" sizes=\"(max-width: 652px) 100vw, 652px\" \/><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Select the <strong>Details<\/strong> tab.<\/li>\n\n\n\n<li>Expand <strong>User Security Settings and Permissions<\/strong>.<\/li>\n\n\n\n<li>From the <strong>Delegated Authority<\/strong> dropdown, select <strong>Active Directory<\/strong>.&nbsp;<br><img decoding=\"async\" width=\"848\" height=\"408\" class=\"wp-image-114375\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Details-Delegated-Auth-DropDown.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Details-Delegated-Auth-DropDown.png 848w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Details-Delegated-Auth-DropDown-300x144.png 300w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Details-Delegated-Auth-DropDown-768x370.png 768w\" sizes=\"(max-width: 848px) 100vw, 848px\" \/><\/li>\n\n\n\n<li>Review the confirmation message.<br><img decoding=\"async\" width=\"408\" height=\"454\" class=\"wp-image-114374\" style=\"width: 300px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Delegate-to-AD-Confirmation.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Delegate-to-AD-Confirmation.png 408w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Delegate-to-AD-Confirmation-270x300.png 270w\" sizes=\"(max-width: 408px) 100vw, 408px\" \/><\/li>\n\n\n\n<li>Click <strong>Update Setting<\/strong>.<\/li>\n\n\n\n<li>Click <strong>Save User<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>To enable delegated authentication for multiple users in Admin Portal:<\/strong><\/h3>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to the <strong>USER MANAGEMENT&gt;<\/strong> <strong>Users<\/strong>.<\/li>\n\n\n\n<li>Select the users for whom you want to delegate authentication to AD .<\/li>\n\n\n\n<li>Click the <strong>More Actions<\/strong> dropdown menu.<\/li>\n\n\n\n<li>Click <strong>Set Delegated Authority<\/strong>.<br><img decoding=\"async\" width=\"1422\" height=\"483\" class=\"wp-image-114394\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803.png 1422w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803-300x102.png 300w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803-1024x348.png 1024w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803-768x261.png 768w\" sizes=\"(max-width: 1422px) 100vw, 1422px\" \/><\/li>\n\n\n\n<li>Select <strong>Active Directory<\/strong>.<br><img decoding=\"async\" width=\"447\" height=\"602\" class=\"wp-image-114395\" style=\"width: 300px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Modal.png 447w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Modal-223x300.png 223w\" sizes=\"(max-width: 447px) 100vw, 447px\" \/><\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>To enable delegated authentication for a single user through the API:<\/strong><\/h3>\n\n\n\n<ol>\n<li><a href=\"https:\/\/jumpcloud.com\/support\/jumpcloud-apis#generating-a-new-api-key\">Generate an API key<\/a> if you do not already have one.<\/li>\n\n\n\n<li>Example curl request:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>curl &#8211;location &#8211;request PUT &#8216;https:\/\/console.jumpcloud.com\/api\/systemusers\/(id}&#8217; \\<br>&#8211;header &#8216;Content-Type: application\/json&#8217; \\<br>&#8211;header &#8216;x-api-key: REPLACE_KEY_VALUE&#8217; \\<br>&#8211;header &#8216;x-org-id: REPLACE_ORG_VALUE&#8217; \\<br>&#8211;data &#8216;{<br>&nbsp;&nbsp;&nbsp;delegatedAuthority&#8221;:{&#8220;name&#8221;: &#8220;ActiveDirectory&#8221;}<br>}&#8217;<\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"3\">\n<li>Example PowerShell request:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>&#8216;https:\/\/console.jumpcloud.com\/api\/systemusers\/{id}?fullValidationDetails=SOME_STRING_VALUE&#8217; -Method PUT -Headers $headers -ContentType &#8216;application\/json&#8217; -Body &#8216;{&#8220;delegatedAuthority&#8221;:{&#8220;name&#8221;: &#8220;ActiveDirectory&#8221;}&#8217;<\/p>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>Replace <kbd>{id}<\/kbd> with the ID of your ADI instance.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-enable-delegated-authentication-for-multiple-users-through-the-api\"><strong>To enable delegated authentication for multiple users through the API<\/strong><\/h3>\n\n\n\n<ol>\n<li><a href=\"https:\/\/jumpcloud.com\/support\/jumpcloud-apis#generating-a-new-api-key\">Generate an API key<\/a> if you do not already have one<\/li>\n\n\n\n<li>Example curl request:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>curl &#8211;request PATCH \\<br>&nbsp;&nbsp;&#8211;url &#8216;https:\/\/console.jumpcloud.com\/api\/v2\/bulk\/users?suppressEmail=SOME_BOOLEAN_VALUE&#8217; \\<br>&nbsp;&#8211;header &#8216;content-type: application\/json&#8217; \\<br>&#8211;header &#8216;x-api-key: REPLACE_KEY_VALUE&#8217; \\<br>&#8211;header &#8216;x-org-id: REPLACE_ORG_VALUE&#8217; \\<br>&#8211;data &#8216;[{<br>&nbsp;&nbsp;&nbsp; &#8220;id&#8221;:{ID},<br>&#8220;delegatedAuthority&#8221;:{&#8220;name&#8221;: &#8220;ActiveDirectory&#8221;}<br>}]&#8217;<\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"3\">\n<li>Example PowerShell request:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>&#8216;https:\/\/console.jumpcloud.com\/api\/systemusers\/{id}?fullValidationDetails=SOME_STRING_VALUE&#8217; -Method PUT -Headers $headers -ContentType &#8216;application\/json&#8217; -Body &#8216;[{&#8220;id&#8221;:{ID},&#8221;delegatedAuthority&#8221;:{&#8220;name&#8221;: &#8220;ActiveDirectory&#8221;}<span>}<\/span>]&#8217;<\/p>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>Replace <kbd>{id}<\/kbd> with the ID of your ADI instance.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-give-users-access-to-delegation-enabled-ad-domains-nbsp\"><strong>Give Users Access to Delegation-enabled AD Domains&nbsp;<\/strong><\/h2>\n\n\n\n<p>These steps are for giving users who are not already connected to a delegation-enabled AD domain access to that AD domain.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-give-user-direct-access-to-a-delegation-enabled-ad-domain\"><strong>To give user direct access to a delegation-enabled AD domain<\/strong><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-adi-configuration\"><strong>From the ADI configuration<\/strong><\/h4>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\"><\/a><a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>Directory Integrations &gt; Active Directory<\/strong>.<\/li>\n\n\n\n<li>Select your AD domain.<\/li>\n\n\n\n<li>Select the <strong>Users<\/strong> tab.<\/li>\n\n\n\n<li>Select the user(s) to whom you want to give access.<\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<br><img decoding=\"async\" width=\"645\" height=\"778\" class=\"wp-image-114370\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png 645w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal-249x300.png 249w\" sizes=\"(max-width: 645px) 100vw, 645px\" \/><\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-user-details-page\"><strong>From the user details page<\/strong><\/h4>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to the <strong>USER MANAGEMENT&gt;<\/strong> <strong>Users<\/strong>.<\/li>\n\n\n\n<li>Click the user for whom you want to enable delegated authentication.<\/li>\n\n\n\n<li>Select the <strong>Directories<\/strong> tab.<\/li>\n\n\n\n<li>Select the AD domain with delegation authentication enabled label (Delegation ENABLED).<br><img decoding=\"async\" width=\"356\" height=\"52\" class=\"wp-image-114398\" style=\"width: 300px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label.png 356w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label-300x44.png 300w\" sizes=\"(max-width: 356px) 100vw, 356px\" \/><\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>Make sure only one AD domain with delegation enabled is selected. Otherwise, users won\u2019t be able to log in.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"6\">\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<br><img decoding=\"async\" width=\"645\" height=\"778\" class=\"wp-image-114370\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png 645w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal-249x300.png 249w\" sizes=\"(max-width: 645px) 100vw, 645px\" \/><\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-give-user-access-to-a-delegation-enabled-ad-domain-through-a-user-group\">To give user access to a delegation-enabled AD domain through a user group<\/h3>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>For dynamic groups, users who meet the conditions set will automatically get access to the delegation-enabled AD domain. You must manually set the <strong>Delegated Authority<\/strong> to<strong> Active Directory<\/strong> for these users.<br>Follow the instructions in section <strong>To give user direct access to a delegation-enabled AD domain<\/strong> for manually enabling delegated authentication to AD for these users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-adi-configuration-0\">From the ADI configuration<\/h4>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>Directory Integrations &gt; Active Directory<\/strong>.<\/li>\n\n\n\n<li>Select your AD domain.<\/li>\n\n\n\n<li>Select the <strong>User Groups<\/strong> tab.<\/li>\n\n\n\n<li>Select the group(s) to which you want to give access.<\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<br><img decoding=\"async\" width=\"645\" height=\"778\" class=\"wp-image-114370\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png 645w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal-249x300.png 249w\" sizes=\"(max-width: 645px) 100vw, 645px\" \/><\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-user-groups-detail-page\">From the user groups detail page<\/h4>\n\n\n\n<ol>\n<li>Log in to <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to the <strong>USER MANAGEMENT&gt;User Groups<\/strong>.<\/li>\n\n\n\n<li>Select the user group to which you want to give access to your delegation-enabled AD domain.<\/li>\n\n\n\n<li>Select the <strong>Directories<\/strong> tab.<\/li>\n\n\n\n<li>Select the AD domain with delegation authentication enabled label (Delegation ENABLED).<br><img decoding=\"async\" width=\"356\" height=\"52\" class=\"wp-image-114398\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label.png 356w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Domain-Delegation-Enabled-Label-300x44.png 300w\" sizes=\"(max-width: 356px) 100vw, 356px\" \/><\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>Make sure only one AD domain with delegation enabled is selected. Otherwise, users won\u2019t be able to log in.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"6\">\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<br><img decoding=\"async\" width=\"645\" height=\"778\" class=\"wp-image-114370\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png 645w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal-249x300.png 249w\" sizes=\"(max-width: 645px) 100vw, 645px\" \/><\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Remove User Access to Delegation-enabled AD Domains&nbsp;<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-remove-access-for-users-with-a-direct-connection-to-a-delegation-enabled-ad-domain\">To remove access for users with a direct connection to a delegation-enabled AD domain:<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-adi-configuration-1\">From the ADI configuration<\/h4>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>Directory Integrations &gt; Active Directory<\/strong>.<\/li>\n\n\n\n<li>Select your AD domain.<\/li>\n\n\n\n<li>Select the <strong>Users<\/strong> tab.<\/li>\n\n\n\n<li>Deselect the user(s) from whom you want to remove access.<\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-user-details-page-0\">From the user details page<\/h4>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>USER MANAGEMENT&gt;<\/strong> <strong>Users<\/strong><\/li>\n\n\n\n<li>Click the user for whom you want to disable delegated authentication<\/li>\n\n\n\n<li>Select the <strong>Directories<\/strong> tab.<\/li>\n\n\n\n<li>Deselect the AD domain with delegation authentication enabled label (Delegation ENABLED).<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>Make sure only one AD domain with delegation enabled is selected. Otherwise, users won\u2019t be able to log in.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"6\">\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-remove-access-users-connected-to-a-delegation-enabled-ad-domain-through-a-user-group\">To remove access users connected to a delegation-enabled AD domain through a user group<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-user-groups-tab-of-the-user-page\">From the User Groups tab of the User page<\/h4>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>USER MANAGEMENT&gt;<\/strong> <strong>Users<\/strong><\/li>\n\n\n\n<li>Click the user for whom you want to disable delegated authentication.<\/li>\n\n\n\n<li>Select the <strong>User Groups<\/strong> tab.<\/li>\n\n\n\n<li>Deselect the group that is connecting the user the delegation-enabled AD domain.<\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<\/li>\n\n\n\n<li>Select the update option you prefer<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong><\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>If the group from which you removed the user is a dynamic group, you will be prompted to add the user to the exclude list for that group. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-users-tab-of-the-user-group-page\">From the Users tab of the User Group page<\/h4>\n\n\n\n<ol>\n<li>Log in to <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>USER MANAGEMENT&gt;<\/strong> <strong>User Groups<\/strong><\/li>\n\n\n\n<li>Click the user group that is connecting the user the delegation-enabled AD domain.<\/li>\n\n\n\n<li>Select the <strong>Users<\/strong> tab.<\/li>\n\n\n\n<li>Deselect the user(s). <\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<br><img decoding=\"async\" width=\"645\" height=\"778\" class=\"wp-image-114370\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png 645w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal-249x300.png 249w\" sizes=\"(max-width: 645px) 100vw, 645px\" \/><\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong><\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>If the group is a dynamic group and the user still meets the conditions for being a member of that group , you will need to add the user(s) to the exclude list.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-remove-access-for-user-groups-connected-to-a-delegation-enabled-ad-domain\">To remove access for user groups connected to a delegation-enabled AD domain<\/h3>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>For dynamic groups, users who no longer meet the conditions set on the group will automatically lose access to the delegation-enabled AD. You must manually set the <strong>Delegated Authority<\/strong> to<strong> None (JumpCloud)<\/strong> for these users.<br>Follow the instructions in section To remove access for users with direct access to a delegation-enabled AD domain for manually disabling delegated authentication to Active Directory for these users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-adi-configuration-2\">From the ADI configuration<\/h4>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>Directory Integrations &gt; Active Directory<\/strong>.<\/li>\n\n\n\n<li>Select your AD domain.<\/li>\n\n\n\n<li>Select the <strong>User Groups<\/strong> tab.<\/li>\n\n\n\n<li>Deselect the group(s) from which you want to remove access.<\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<br><img decoding=\"async\" width=\"645\" height=\"778\" class=\"wp-image-114370\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png 645w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal-249x300.png 249w\" sizes=\"(max-width: 645px) 100vw, 645px\" \/><\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continue<\/strong><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-from-the-user-groups-detail-page-0\">From the user groups detail page<\/h4>\n\n\n\n<ol>\n<li>Log in to <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>USER MANAGEMENT&gt;User Groups<\/strong> <\/li>\n\n\n\n<li>Select the user group to which you want to give access to your delegation-enabled AD domain.<\/li>\n\n\n\n<li>Select the <strong>Directories<\/strong> tab.<\/li>\n\n\n\n<li>Deselect the AD domain with delegation authentication enabled label (Delegation ENABLED).<\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Read the warning message.<br><img decoding=\"async\" width=\"645\" height=\"778\" class=\"wp-image-114370\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal.png 645w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Update-Delegated-Authority-Modal-249x300.png 249w\" sizes=\"(max-width: 645px) 100vw, 645px\" \/><\/li>\n\n\n\n<li>Select the update option you prefer.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>We recommend automatically updating the settings for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"9\">\n<li>Click <strong>Continu<\/strong>e<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Disabling Delegated Authentication for Users<\/h2>\n\n\n\n<p>These steps are intended for users who are already connected (bound) to a delegation-enabled AD domain and have their <strong>Delegated Authority <\/strong>set to <strong>Active Directory<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Considerations<\/h3>\n\n\n\n<ul>\n<li>Users won\u2019t be able to log in until a password has been set in JumpCloud\n<ul>\n<li>If the import agent is installed on a DC, the users will have a password in JumpCloud. The AD password is synced in this configuration<\/li>\n\n\n\n<li>If the import agent is installed on an AD member server, the users will not have a password in JumpCloud. Passwords are not synced from AD to JumpCloud in this configuration<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisites<\/h3>\n\n\n\n<ul>\n<li>Notify users they will be getting a welcome email with a link to set their password in JumpCloud<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-disable-delegated-authentication-for-a-single-user\">To disable delegated authentication for a single user<\/h3>\n\n\n\n<ol>\n<li>Log in to <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>USER MANAGEMENT&gt;Users<\/strong>.<\/li>\n\n\n\n<li>Click the users for whom you want to disable delegated authentication to AD.<\/li>\n\n\n\n<li>Select to <strong>None<\/strong> from the <strong>Delegated Authority<\/strong> dropdown menu.<\/li>\n\n\n\n<li>Review the confirmation message.<br><img decoding=\"async\" width=\"405\" height=\"365\" class=\"wp-image-114377\" style=\"width: 300px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Remove-Delegation-Confirmation.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Remove-Delegation-Confirmation.png 405w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-User-Remove-Delegation-Confirmation-300x270.png 300w\" sizes=\"(max-width: 405px) 100vw, 405px\" \/><\/li>\n\n\n\n<li>Click <strong>Update Setting<\/strong><\/li>\n\n\n\n<li>Click <strong>Save<\/strong><\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-disable-delegated-authentication-for-a-multiple-users\">To disable delegated authentication for a multiple users<\/h3>\n\n\n\n<ol>\n<li>Log in to <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>USER MANAGEMENT&gt;Users<\/strong>.<\/li>\n\n\n\n<li>Select the users for whom you want to disable delegated authentication to AD.<\/li>\n\n\n\n<li>Click the <strong>More Actions<\/strong> dropdown menu.<\/li>\n\n\n\n<li>Click <strong>Set Delegated Authority<\/strong>.<br><img decoding=\"async\" width=\"1422\" height=\"483\" class=\"wp-image-114394\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803.png 1422w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803-300x102.png 300w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803-1024x348.png 1024w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Menu-Option--e1723897804803-768x261.png 768w\" sizes=\"(max-width: 1422px) 100vw, 1422px\" \/><\/li>\n\n\n\n<li>Select <strong>None<\/strong>.<br><img decoding=\"async\" width=\"447\" height=\"602\" class=\"wp-image-114395\" style=\"width: 300px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Modal.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Modal.png 447w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Users-Set-Delegated-Auth-Modal-223x300.png 223w\" sizes=\"(max-width: 447px) 100vw, 447px\" \/><\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Disable Delegated Authentication for a Domain<\/h2>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>The setting for delegated authentication on the ADI configuration is labeled <strong>Delegated Password Validation<\/strong>.&nbsp;<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Considerations<\/h3>\n\n\n\n<ul>\n<li>Users won\u2019t be able to log in until a password has been set in JumpCloud\n<ul>\n<li>If the import agent is installed on a DC, the users will have a password in JumpCloud. The AD password is synced in this configuration<\/li>\n\n\n\n<li>If the import agent is installed on an AD member server, the users will not have a password in JumpCloud. Passwords are not synced from AD to JumpCloud in this configuration<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisites<\/h3>\n\n\n\n<ul>\n<li>Notify users they will be getting a welcome email with a link to set their password in JumpCloud<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-disable-delegated-authentication-for-the-manage-users-and-passwords-in-active-directory-configuration\">To disable delegated authentication for the <strong>Manage users and passwords in Active Directory<\/strong> configuration<\/h3>\n\n\n\n<p><strong>Delegated Password Validation<\/strong> cannot be disabled for this configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-to-disable-delegated-authentication-for-the-manage-users-and-passwords-in-jumpcloud-ad-or-both-configuration\">To disable delegated authentication for the <strong>Manage users and passwords in JumpCloud, AD or both <\/strong>configuration<\/h3>\n\n\n\n<ol>\n<li>Log in to <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>Directory Integrations &gt; Active Directory<\/strong>.<\/li>\n\n\n\n<li>Click the domain to which you want to enable delegated password validation.<\/li>\n\n\n\n<li>Uncheck <strong>Delegated Password Validation<\/strong> checkbox in the Integration Details section.<br><img decoding=\"async\" width=\"1124\" height=\"556\" class=\"wp-image-114390\" style=\"width: 300px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Config-Settings.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Config-Settings.png 1124w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Config-Settings-300x148.png 300w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Config-Settings-1024x507.png 1024w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI-Config-Settings-768x380.png 768w\" sizes=\"(max-width: 1124px) 100vw, 1124px\" \/><\/li>\n\n\n\n<li>Make other configuration changes, if needed.<\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Review the confirmation message and select the appropriate update option.<br><img decoding=\"async\" width=\"1362\" height=\"1004\" class=\"wp-image-114378\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI_2way_DelegationDisabled_Warning.png\" alt=\"\" srcset=\"https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI_2way_DelegationDisabled_Warning.png 1362w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI_2way_DelegationDisabled_Warning-300x221.png 300w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI_2way_DelegationDisabled_Warning-1024x755.png 1024w, https:\/\/ti-1.jumpcloud.com\/wp-content\/uploads\/2024\/08\/ADI_2way_DelegationDisabled_Warning-768x566.png 768w\" sizes=\"(max-width: 1362px) 100vw, 1362px\" \/><\/li>\n\n\n\n<li>Click <strong>Continue<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Auditing and Troubleshooting<\/h2>\n\n\n\n<p>Use Directory Insights to audit and troubleshoot changes and actions related to delegated authentication. See <a href=\"https:\/\/jumpcloud.com\/support\/troubleshoot-adi\">Troubleshoot: Active Directory Integration (ADI)<\/a> for detailed troubleshooting guidance.<\/p>\n\n\n\n<div class=\"wp-block-wpdatatables-wpdatatables-gutenberg-block\">\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-281\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"3\"\n           data-rows=\"7\"\n           data-wpID=\"281\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                            <th class=\"wpdt-cell wpdt-bold wpdt-bc-41C8C3\"\n                                    data-cell-id=\"A1\"\n                data-col-index=\"0\"\n                data-row-index=\"0\"\n                style=\" width:15.445321307779%;                padding:10px;\n                \"\n                >\n                                Event                <\/th>\n                                            <th class=\"wpdt-cell wpdt-bold wpdt-bc-41C8C3\"\n                                    data-cell-id=\"B1\"\n                data-col-index=\"1\"\n                data-row-index=\"0\"\n                style=\" width:32.919954904171%;                padding:10px;\n                \"\n                >\n                                Description                <\/th>\n                                            <th class=\"wpdt-cell wpdt-bold wpdt-bc-41C8C3\"\n                                    data-cell-id=\"C1\"\n                data-col-index=\"2\"\n                data-row-index=\"0\"\n                style=\" width:51.63472378805%;                padding:10px;\n                \"\n                >\n                                Delegated Authentication  Specific Information                <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                            <td class=\"wpdt-cell wpdt-bold wpdt-align-left wpdt-merged-cell \"\n                 colspan=\"1\"  rowspan=\"2\"                 data-cell-id=\"A2\"\n                data-col-index=\"0\"\n                data-row-index=\"1\"\n                style=\"                padding:10px;\n                \"\n                >\n                                user_login_attempt                <\/td>\n                                            <td class=\"wpdt-cell wpdt-align-left wpdt-merged-cell \"\n                 colspan=\"1\"  rowspan=\"2\"                 data-cell-id=\"B2\"\n                data-col-index=\"1\"\n                data-row-index=\"1\"\n                style=\"                padding:10px;\n                \"\n                >\n                                Logs every time a user tries to log in to a JumpCloud managed resources                <\/td>\n                                            <td class=\"wpdt-cell wpdt-align-left wpdt-ff-000000 wpdt-wrap-text\"\n                                    data-cell-id=\"C2\"\n                data-col-index=\"2\"\n                data-row-index=\"1\"\n                style=\"                padding:10px;\n                \"\n                >\n                                JSON includes a new field \u201cpassword_delegated_authority\u201d in the auth_context when the user\u2019s login is delegated to AD for authentication                <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                                    <td class=\"wpdt-cell \"\n                                    data-cell-id=\"C3\"\n                data-col-index=\"2\"\n                data-row-index=\"2\"\n                style=\"                padding:10px;\n                \"\n                >\n                                <div data-type-content=\"wpdt-html-content\">\n<p dir=\"ltr\" style=\"line-height: 1.2;margin-top: 0pt;margin-bottom: 0pt;text-align: left\"><span style=\"font-size: 9pt;font-family: 'Courier New',monospace;color: #000000;background-color: transparent;font-weight: 400;font-style: normal;font-variant: normal;text-decoration: none;vertical-align: baseline\">\"auth_context\": {<\/span><\/p>\n<p dir=\"ltr\" style=\"line-height: 1.2;margin-top: 0pt;margin-bottom: 0pt;text-align: left\"><span style=\"font-size: 9pt;font-family: 'Courier New',monospace;color: #000000;background-color: transparent;font-weight: 400;font-style: normal;font-variant: normal;text-decoration: none;vertical-align: baseline\">&nbsp;&nbsp;&nbsp;&nbsp;\"auth_methods\": {<\/span><\/p>\n<p dir=\"ltr\" style=\"line-height: 1.2;margin-top: 0pt;margin-bottom: 0pt;text-align: left\"><span style=\"font-size: 9pt;font-family: 'Courier New',monospace;color: #000000;background-color: transparent;font-weight: 400;font-style: normal;font-variant: normal;text-decoration: none;vertical-align: baseline\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"password\": {<\/span><\/p>\n<p dir=\"ltr\" style=\"line-height: 1.2;margin-top: 0pt;margin-bottom: 0pt;text-align: left\"><span style=\"font-size: 9pt;font-family: 'Courier New',monospace;color: #000000;background-color: transparent;font-weight: 400;font-style: normal;font-variant: normal;text-decoration: none;vertical-align: baseline\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"success\": true<\/span><\/p>\n<p dir=\"ltr\" style=\"line-height: 1.2;margin-top: 0pt;margin-bottom: 0pt;text-align: left\"><span style=\"font-size: 9pt;font-family: 'Courier New',monospace;color: #000000;background-color: transparent;font-weight: 400;font-style: normal;font-variant: normal;text-decoration: none;vertical-align: baseline\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<\/span><\/p>\n<p dir=\"ltr\" style=\"line-height: 1.2;margin-top: 0pt;margin-bottom: 0pt;text-align: left\"><span style=\"font-size: 9pt;font-family: 'Courier New',monospace;color: #000000;background-color: transparent;font-weight: 400;font-style: normal;font-variant: normal;text-decoration: none;vertical-align: baseline\">&nbsp;&nbsp;&nbsp;&nbsp;},<\/span><\/p>\n<p dir=\"ltr\" style=\"line-height: 1.2;margin-top: 0pt;margin-bottom: 0pt;text-align: left\"><span style=\"font-size: 9pt;font-family: 'Courier New',monospace;color: #000000;background-color: transparent;font-weight: 400;font-style: normal;font-variant: normal;text-decoration: none;vertical-align: baseline\">&nbsp;&nbsp;&nbsp;&nbsp;\"<span style=\"background-color: #00ffff\">password_delegated_authority<\/span>\": \"ActiveDirectory\"<\/span><\/p>\n<p style=\"text-align: left\">&nbsp;<\/p>\n<p dir=\"ltr\" style=\"line-height: 1.2;margin-top: 0pt;margin-bottom: 0pt;text-align: left\"><span style=\"font-size: 9pt;font-family: 'Courier New',monospace;color: #000000;background-color: transparent;font-weight: 400;font-style: normal;font-variant: normal;text-decoration: none;vertical-align: baseline\"> &nbsp;},<\/span><\/p>\n<\/div>                <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                            <td class=\"wpdt-cell wpdt-bold wpdt-align-left wpdt-merged-cell \"\n                 colspan=\"1\"  rowspan=\"2\"                 data-cell-id=\"A4\"\n                data-col-index=\"0\"\n                data-row-index=\"3\"\n                style=\"                padding:10px;\n                \"\n                >\n                                association_change                <\/td>\n                                            <td class=\"wpdt-cell wpdt-align-left wpdt-merged-cell \"\n                 colspan=\"1\"  rowspan=\"2\"                 data-cell-id=\"B4\"\n                data-col-index=\"1\"\n                data-row-index=\"3\"\n                style=\"                padding:10px;\n                \"\n                >\n                                Logs every time two resources are associated (bound) or disassociated (unbound).                <\/td>\n                                            <td class=\"wpdt-cell wpdt-align-left\"\n                                    data-cell-id=\"C4\"\n                data-col-index=\"2\"\n                data-row-index=\"3\"\n                style=\"                padding:10px;\n                \"\n                >\n                                Logged when a user is associated (bound) or disassociated (unbound) to a delegation-enabled AD domain.                <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                                    <td class=\"wpdt-cell wpdt-align-left\"\n                                    data-cell-id=\"C5\"\n                data-col-index=\"2\"\n                data-row-index=\"4\"\n                style=\"                padding:10px;\n                \"\n                >\n                                Logged when a user group is associated (bound) or disassociated (unbound) to a delegation-enabled AD domain.                <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                            <td class=\"wpdt-cell wpdt-bold wpdt-align-left\"\n                                    data-cell-id=\"A6\"\n                data-col-index=\"0\"\n                data-row-index=\"5\"\n                style=\"                padding:10px;\n                \"\n                >\n                                user_delegated_authority_update                <\/td>\n                                            <td class=\"wpdt-cell wpdt-align-left\"\n                                    data-cell-id=\"B6\"\n                data-col-index=\"1\"\n                data-row-index=\"5\"\n                style=\"                padding:10px;\n                \"\n                >\n                                Logs when a change is made to the Delegated Authority setting on the User record.                <\/td>\n                                            <td class=\"wpdt-cell wpdt-align-left\"\n                                    data-cell-id=\"C6\"\n                data-col-index=\"2\"\n                data-row-index=\"5\"\n                style=\"                padding:10px;\n                \"\n                >\n                                This event is specific to the delegated authentication functionality.                <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                            <td class=\"wpdt-cell wpdt-bold wpdt-align-left\"\n                                    data-cell-id=\"A7\"\n                data-col-index=\"0\"\n                data-row-index=\"6\"\n                style=\"                padding:10px;\n                \"\n                >\n                                activedirectory_domain_delegated_password_change                <\/td>\n                                            <td class=\"wpdt-cell wpdt-align-left\"\n                                    data-cell-id=\"B7\"\n                data-col-index=\"1\"\n                data-row-index=\"6\"\n                style=\"                padding:10px;\n                \"\n                >\n                                Logs when the delegated authentication setting Delegated Password Validation in the ADI configuration is changed                <\/td>\n                                            <td class=\"wpdt-cell wpdt-align-left\"\n                                    data-cell-id=\"C7\"\n                data-col-index=\"2\"\n                data-row-index=\"6\"\n                style=\"                padding:10px;\n                \"\n                >\n                                This event is specific to the delegated authentication functionality.                <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Next Steps<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-haven-t-installed-the-import-agent-yet\">Haven&#8217;t installed the import agent yet?<\/h3>\n\n\n\n<p>Check out the step-by-step configuration guides<\/p>\n\n\n\n<ul>\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-adi-sync-from-ad-to-jumpcloud\">Configure ADI: Manage users, security groups, and passwords in AD<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-adi-two-way-sync\">Configure ADI: Manage users, groups&nbsp;and passwords in either, or both, AD and JumpCloud<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-ready-to-use-adi\">Ready to use ADI?<\/h3>\n\n\n\n<p>Read the <a href=\"https:\/\/jumpcloud.com\/support\/use-the-Active-Directory-Integration\">Using and Managing the ADI<\/a> article next.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-want-additional-assistance-from-jumpcloud-nbsp\"><strong>Want additional assistance from JumpCloud?&nbsp;<\/strong><\/h3>\n\n\n\n<p>If you\u2019re having issues with getting JumpCloud\u2019s ADI working, try the <a href=\"https:\/\/jumpcloud.com\/support\/troubleshoot-adi\">Troubleshooting Guide<\/a>. JumpCloud now offers myriad professional services offerings to assist customers with implementing and configuring JumpCloud. If you\u2019re looking for assistance with Migrating from AD, or to integrate AD with JumpCloud, we recommend you reach out to JumpCloud\u2019s Professional Services team on the following page: <a href=\"https:\/\/jumpcloud.com\/professional-services\">Professional Services &#8211; JumpCloud<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Extending Active Directory (AD) to the Cloud is even simpler using the delegated authentication capabilities of the JumpCloud Active Directory [&hellip;]<\/p>\n","protected":false},"author":205,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2904,2855,2954],"support_tag":[],"coauthors":[2839],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>ADI: Use AD Delegated Authentication - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn how to configure JumpCloud&#039;s ADI to use Delegated Authentication for Active Directory password validation.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ADI: Use AD Delegated Authentication - JumpCloud\" \/>\n<meta property=\"og:description\" content=\"Learn how to configure JumpCloud&#039;s ADI to use Delegated Authentication for Active Directory password validation.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-22T20:23:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"joyjaswinski\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication\",\"url\":\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication\",\"name\":\"ADI: Use AD Delegated Authentication - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/ti-1.jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#primaryimage\"},\"image\":{\"@id\":\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png\",\"datePublished\":\"2024-08-19T05:25:54+00:00\",\"dateModified\":\"2024-08-22T20:23:13+00:00\",\"description\":\"Learn how to configure JumpCloud's ADI to use Delegated Authentication for Active Directory password validation.\",\"breadcrumb\":{\"@id\":\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ti-1.jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/ti-1.jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"ADI: Use AD Delegated Authentication\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ti-1.jumpcloud.com\/#website\",\"url\":\"https:\/\/ti-1.jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/ti-1.jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ti-1.jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/ti-1.jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/ti-1.jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/ti-1.jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/ti-1.jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ADI: Use AD Delegated Authentication - JumpCloud","description":"Learn how to configure JumpCloud's ADI to use Delegated Authentication for Active Directory password validation.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication","og_locale":"en_US","og_type":"article","og_title":"ADI: Use AD Delegated Authentication - JumpCloud","og_description":"Learn how to configure JumpCloud's ADI to use Delegated Authentication for Active Directory password validation.","og_url":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication","og_site_name":"JumpCloud","article_modified_time":"2024-08-22T20:23:13+00:00","og_image":[{"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Written by":"joyjaswinski"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication","url":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication","name":"ADI: Use AD Delegated Authentication - JumpCloud","isPartOf":{"@id":"https:\/\/ti-1.jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#primaryimage"},"image":{"@id":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png","datePublished":"2024-08-19T05:25:54+00:00","dateModified":"2024-08-22T20:23:13+00:00","description":"Learn how to configure JumpCloud's ADI to use Delegated Authentication for Active Directory password validation.","breadcrumb":{"@id":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#primaryimage","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/08\/Snag_112d8c7.png"},{"@type":"BreadcrumbList","@id":"https:\/\/ti-1.jumpcloud.com\/support\/adi-use-ad-delegated-authentication#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ti-1.jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/ti-1.jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"ADI: Use AD Delegated Authentication"}]},{"@type":"WebSite","@id":"https:\/\/ti-1.jumpcloud.com\/#website","url":"https:\/\/ti-1.jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/ti-1.jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ti-1.jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/ti-1.jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/ti-1.jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ti-1.jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/ti-1.jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/support\/113599"}],"collection":[{"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/users\/205"}],"version-history":[{"count":2,"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/support\/113599\/revisions"}],"predecessor-version":[{"id":114825,"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/support\/113599\/revisions\/114825"}],"wp:attachment":[{"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/media?parent=113599"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=113599"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=113599"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/ti-1.jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=113599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}