For customers not using SSO, does your application support directory integration for user accounts?
Explanation
When Single Sign-On is not in play, this asks whether your application can tie into directory services such as Active Directory or LDAP for managing user accounts.
Directory integration allows organizations to manage user accounts centrally in their existing directory service rather than maintaining separate user accounts in each application. This provides several benefits:
- Centralized user management: When users join or leave an organization, their access can be granted or revoked in one place
- Consistent password policies: The organization's password requirements are applied uniformly
- Reduced administrative overhead: No need to manage separate user databases for each application
- Better security: Faster deprovisioning of access when employees leave
The security assessment is asking this because directory integration is considered a security best practice. Without it, organizations face challenges like:
- Orphaned accounts when users leave the organization
- Inconsistent password policies across applications
- Manual user management processes that are error-prone
- Difficulty maintaining compliance with access control requirements
When answering this question, you should clearly state whether your application supports directory integration, which specific directory services you support (e.g., Microsoft Active Directory, Azure AD, LDAP, Okta, etc.), and briefly explain how the integration works.
Example Responses
Example Response 1
Yes, our application supports directory integration for user accounts We provide integration with Microsoft Active Directory, Azure AD, and LDAP This allows customers to manage user accounts, authentication, and authorization through their existing directory services Our application synchronizes with these directory services to create, update, and deactivate user accounts automatically based on changes in the customer's directory This ensures consistent access control and simplifies user management for our customers.
Example Response 2
Yes, our application supports multiple directory integration options for user account management We offer native connectors for Microsoft Active Directory, LDAP, Azure AD, and Google Workspace Our directory synchronization runs every 30 minutes to ensure user account changes are reflected promptly in our application Additionally, we support just-in-time (JIT) provisioning where user accounts can be automatically created upon first login based on directory information Customers can configure attribute mapping to control how directory information is used within our application.
Example Response 3
No, our application currently does not support directory integration for user accounts We maintain our own user database where accounts must be manually created and managed through our administrative interface While we recognize the benefits of directory integration and have it on our product roadmap for implementation within the next 6 months, we currently mitigate related risks by providing API endpoints that allow customers to automate user provisioning and deprovisioning through custom scripts or third-party identity management tools We also support bulk user import/export via CSV files to simplify account management.
Context
- Tab
- Product
- Category
- Authentication, Authorization, and Account Management
Related questions
- Does your solution support single sign-on (SSO) protocols for user and administrator authentication?
- For customers not using SSO, does your solution support local authentication protocols for user and administrator authentication?
- For customers not using SSO, can you enforce password/passphrase complexity requirements (provided by the institution)?
- For customers not using SSO, does the system have password complexity or length limitations and/or restrictions?
- For customers not using SSO, do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support?
- Does your organization participate in InCommon or another eduGAIN-affiliated trust federation?

