Microsoft Entra ID
Connect with the consent of your Microsoft 365 administrator. The domain must be one of your tenant's verified domains.
Directory connectors
Directory connectors: your users, kept in sync on their own
Quarantine users do not have to be typed in. Connect your directory once, preview the changes, choose who is included and apply. SecuraWall keeps the list up to date, for up to 50,000 users per customer.
Monthly per domain · No long contracts · No automatic charges
Directory connectionsacme.example3Connections
1,577Users synchronized
1Need attention
10:42Last synchronization
Microsoft 365Active1,240 users · Synchronizing every 5 minutes
Active DirectoryActive312 users · Synchronizing every 5 minutes
ZimbraSync issue25 users · Last synchronization failed; accounts kept
Add connectionRecent activity
Add a connection
Choose where your users are.
Microsoft 365, Exchange Server, Google Workspace, Zimbra, Carbonio or any other LDAP directory. Up to 10 connections per customer and 50,000 users per connection.
Add connectionChoose where your users are.Microsoft 365Continue with MicrosoftExchange ServerThrough Active DirectoryGoogle WorkspaceContinue with GoogleZimbraAdministration APICarbonioAdministration APIOther directoryLDAP / OpenLDAP
Sources
Eight ways to bring your users.
Google Workspace
Connect with the consent of your Google Workspace administrator; users come from your Google directory.
Active Directory
Read from your domain controllers with LDAP and StartTLS (encrypted connections only), with paged searches for large directories and a reader account without Domain Admin rights.
LDAP and OpenLDAP
Any LDAP directory with StartTLS, with the search base and filter you choose and optional alias and status attributes.
Zimbra
Users are read through the Zimbra administration interface.
Carbonio
Users are read through the Carbonio administration interface, page by page.
CSV file
Upload a list of names and addresses: a quick start for small teams.
Manual entry
Add or change single users by hand, for example a shared mailbox.
Connector features
What each connector reads, and how users sign in.
SecuraWall reads names, addresses and whether an account is active, never passwords or mail. Connection details are stored encrypted and never shown again. A user removed from the directory loses access within 30 minutes; the quarantined mail is kept.
| Source | How it connects | What is read | How users sign in |
|---|---|---|---|
| Microsoft 365 / Entra ID | Consent of a Global Administrator (User.Read.All); the domain must be a verified domain of the tenant | Name, address, aliases, whether the account is enabled; guests are skipped | Continue with Microsoft |
| Google Workspace | Consent of a Google Workspace administrator (read-only user directory) | Name, address, aliases, suspended or archived | Continue with Google |
| Active Directory · Exchange | LDAP v3 with StartTLS required (TCP 389, TLS 1.2 or later); a reader account, no Domain Admin rights | Name, address, proxyAddresses, disabled accounts | Corporate password, checked live, never stored |
| LDAP / OpenLDAP | LDAP v3 with StartTLS required; search base and filter you choose | Name, address, optional alias and status attributes | Corporate password, checked live |
| Zimbra · Carbonio | HTTPS administration API (7071 / 6071) | Name, address, aliases, account status | Corporate password; MFA challenges are not bypassed |
| CSV · Manual | File upload (up to 100 users) or one by one | Address, name, aliases, quota | A password the system emails; changed at first sign-in |
From connection to an up-to-date list.
- 01
Connect
Choose the source and give SecuraWall access to read your users.
- 02
Preview and choose
See who will be added, changed or removed before anything is saved, and select the users to include.
- 03
Apply and stay in sync
Users are written in batches of 500 with visible progress. Afterwards the list is refreshed every 5 minutes; directories with more than 5,000 users every 15 minutes.
Preview and choose
See every change before it is saved.
The preview lists new accounts, accounts already imported and conflicts, with status filters and search. A storage summary shows whether the selection fits the customer maximum before anything is applied.
Directory previewMicrosoft 365All · 1,252Selected · 1,240ActiveDisabled · 12Conflict · 0
| Name | Address | Action | |
|---|---|---|---|
| Emily Johnson | emily.johnson@acme.example | New account | |
| Michael Smith | m.smith@acme.example | Already imported | |
| Former Employee | former@acme.example | Disabled |
Customer maximum4,096 MiBAlready allocated1,840 MiBThis selection1,500 MiBLeft after Apply756 MiB
Apply selected usersSelect all activeClear selection
Active Directory and LDAP
Encrypted connections only.
Plain LDAP is refused. The certificate is checked against the system trust, your own CA or a pinned fingerprint, and "Test connection" checks everything before you save. Exchange Server has a ready-made filter for mailbox users.
Active Directory connectionStartTLS · TCP 389Published Active Directory hostnamedc1.acme.exampleSearch base DNOU=Staff,DC=acme,DC=exampleDirectory reader accountsvc-securawall@acme.examplePassword••••••••••••
Filter(&(objectClass=user)(objectCategory=person))
Certificate validationSystem trustCustomer CA certificatePinned server certificate (SHA-256)
SaveTest connection
Microsoft 365 and Google Workspace
No password is typed into SecuraWall.
A Global Administrator signs in with Microsoft and grants read-only consent; the domain must be a verified domain of the tenant. Google Workspace works the same way with a Google administrator. Users then sign in to their quarantine with "Continue with Microsoft" or "Continue with Google".
Microsoft 365 connectionacme.exampleSTEP 1 · DONEGlobal Administrator sign-inacme.example is a verified domain of the tenantDone
STEP 2Administrator consentApplication permission: User.Read.All (read only)Connect Microsoft
Continue with Microsoft; no password is entered here.
Sign-in and passwords
Password resets stay with your IT team.
Users from a directory are referred to your IT team when they forget a password. Accounts added manually or from a CSV file can reset their quarantine password themselves.
My quarantineLanguage: English ▾Signed in as: emily.johnson@acme.examplePersonal storage: 3.2 / 25 MiB · 13%Included aliases: info@acme.example
| Message | Reason | Score | Action | |
|---|---|---|---|---|
| Your parcel is waiting for customs paymentnotice@delivery-example.net · 09:41 | Phishing | 14.2 | ViewReport to IT | |
| Weekly offers for younews@shop-example.com · 08:12 | Spam and bulk mail | 7.9 | ViewRelease | |
| Quote_114.isosales@vendor-example.org · Yesterday | Blocked file type | 2.1 | ViewRelease | |
| Urgent payment todayceo@acme-example.net · Yesterday | Business email compromise | 11.0 | ViewReport to IT |
Release and report selectedMy rulesDelivery history
Questions about directory connectors
How many users can we connect?
Up to 50,000 quarantine users per customer.
Which package includes the quarantine and directory connectors?
Email Security. Backup MX does not filter mail, so it has no quarantine.
Can we see the changes before they are applied?
Yes. Every connection shows a preview of new, changed and removed users, and you choose what is applied.