The Microsoft Active Directory App allows administrators to integrate Incident IQ with a local AD server. This allows districts to automatically populate and update user data in iiQ directly from their AD server.
The following guide is designed to provide step-by-step instructions on the following:
How to install the Microsoft AD App
Downloading the correct integration files and creating an AD user
Configuring the AD executable
Creating an automated scheduled task to sync user data
Installation
Before beginning the installation process, you will need to ensure you have the following:
Ability to create and edit user permission in your active directory.
A machine that runs .NET Framework v.4.5.1 or higher and has network access to your district’s AD server.
Begin by selecting Incident IQ Apps > Browse on the left navigation bar.
Click on the Microsoft Active Directory App (v2) and select Install.
Step one of the installation process provides an overview of how installing the Microsoft Active Directory app will affect your Incident IQ installation. Select Continue once you are ready to proceed to step two.
The first phase of step two will ask you to assign a default role for users that have not already been given a group mapping. By default, this is set to Guest unless otherwise changed. Once you have assigned the default role, select Continue.
In the second phase of step two, you will be asked to assign a default location for users who have not already been assigned a group mapping. Once you have set the default location, select Continue.
You may change any section by clicking on any of the checked settings. Click Continue when you are ready to proceed.
In step three, you will be asked to review all the changes about to be made to your Incident IQ site. Before moving on, please remember that it cannot be stopped after the installation begins. Once you have completed your review, select Install App to start the integration process.
Once the installation has been completed, you can create an active directory user.
Creating an Active Directory User
Once you’ve installed the Microsoft AD app in Incident IQ, you will need to create a new user in your Active Directory. This user will need the following roles assigned to it:
Replicating directory changes.
Replicating directory changes in the filtered set.
Replicating directory changes all.
Read.
Important Note: You will need to complete this step before proceeding. If you are unfamiliar with granting these specific permissions to a user, please refer to the following Microsoft help guide on Giving Users Replicating Directory Changes Permissions.
Configuring and Downloading the Executable
Now you will need to download the application for the AD-iiQ sync. This application will need to be downloaded on a machine with network access to reach an AD server (you can run it on the AD server itself, but that’s not a requirement). The app’s machine must also have the .NET Framework v4.5.1 or higher.
You can download this file from the Microsoft Active Directory (v2) app in Incident IQ. To access this file, select Incident IQ Apps > Manage on the left navigation bar.
On the Installed Apps tab, find Microsoft Active Directory (v2) and click on Manage.
This will take you to the app Overview tab. You must click on Enable User Login and Enable User Sync to enable the integration app. Once these have been allowed, click Save.
Next, you will need to configure and then download the executable file. To do so, begin by clicking on the Sync Executable tab.
From here, you will need to input the following information to configure your executable download:
AD Username
AD Password
AD Domain
AD Server IP
Group OU Searches (Optional)
User OU Searchers (Optional)
Additional AD Attributes to copy (Optional)
Once you enter your configuration information, click Download Executable to download the connector app. Please note that you will want to download this connector app to a device that has access to your AD server and runs overnight.
After downloading the connector file, you will want to run a manual sync to test the connection and download user data to Incident IQ. To do this, run the IncidentIQ.Connectors.MicrosoftAd application (ignore the CONFIG and PDB files in this case.) In the connector app window that appears, click Run now.
If the app runs successfully, a user data packet will be sent to Incident IQ that can then be used to run a system sync.
Creating a Scheduled Sync Task
To schedule the sync to occur automatically, you’ll need to create a task in Windows Task Manager. You can do so by searching for Administrative Tools and selecting Task Scheduler. This will open the Task Scheduler window.
In the Task Scheduler window, start by clicking on Action > Create Basic Task...
This will open the Create Basic Task Wizard. At the very least, you will need to provide a name for the new task. You can also add a task if desired. Once complete, click Next.
In the next step, you will be asked to select when this task should Trigger. We recommend running it daily (overnight) for the most accurate user data. Please ensure you set the task to run regardless of whether a user is logged in or not on the server. Once complete, click Next.
For the next step, you will need to specify what action the task will take when running. Select Start a Program and then click on Next.
When specifying the action to perform, locate the file IncidentIQ.Connectors.MicrosoftAd.exe in the Program/script file browser. Supply the argument -usersync in the Add arguments field. And finally, you will need to indicate the path you unzipped the files to in the Start in field. Once complete, click Next.
In the final step, you may review your task’s settings. Once you have completed your review, check the Open the Properties dialog for this task when I click Finish option and then click Finish.
In the properties pop-up window, begin by selecting Run whether user is logged on or not. Additionally, you will also need to check Run with highest privileges. Failure to check both options can prevent the connector from processing requests.
Mapping User Roles and Locations
You will want to log back into the Incident IQ Microsoft Active Directory app to set your user roles and location mappings. These will indicate automatic role and location assignments for users during system syncs. You can find these settings in the Role Mappings and Location Mappings tabs.
You will want to set a default Role and Location for users immediately. These settings will act as fallback options if a user account does not match any custom mappings you set down in these tabs. We recommend using the following for these options:
Default Role: You will want to set this to Guest during your initial setup. Once all of your custom mappings have been completed and user roles verified, you will likely want to set this to No Access instead.
Default Location: You will likely want to either use the Central/District Office location for this or create another specific location (such as Unassigned).
You may use groups, OU fragments, location names, or any combination when mapping roles and locations. Please note that you do not have to map locations and roles using the same method.
The custom mappings section allows you to specify your user groups or OUs you wish to utilize for mapping users to their respective roles. Please note, when using OUs, you will want to structure them in the same format as the examples below:
OU=Staff and Faculty
OU=Students
OU=IT Staff
---
Hannah Bailey - Director, Customer Engagement