HELP FILE

Use Directory Integrations for Automated Provisioning

If you determined in Add Users and Admins that an automated provisioning service best suits your organization, let's review each one in detail so that you can make an informed decision about the service you choose.

Note: Feature availability may vary depending on your account type.

Topics in this article:

LastPass Active Directory Connector service

LastPass Provisioning API

Windows Login Integration

Azure Active Directory integration

Okta integration

OneLogin integration

LastPass Active Directory Connector service

The LastPass Active Directory Connector (AD Connector) sync client is a Windows service that is run locally and can be downloaded from the Admin Console within your LastPass Enterprise account. It connects to your Active Directory environment to support a variety of provisioning and management processes in LastPass Enterprise.

Using the Active Directory Connector service, you can:

  • Feed relevant information from your user directory into LastPass.
  • Sync new user profiles to LastPass for automated provisioning of LastPass user accounts.
  • Sync disabled or deleted user profiles to LastPass for automated termination of LastPass user accounts.
  • Create nested groups to manage permissions at the group level.
  • Sync user groups to LastPass for policy designations, Shared Folders, and SAML application assignments.
  • Apply filters based on your groups so that only members of the relevant groups sync to LastPass.
  • Provisioning for a number of cloud-based applications, including Google Apps and Salesforce.com. Once set up, when users are added in your Active Directory, a LastPass account will be created on their behalf. No local provisioning necessary.

Out of the box, the Active Directory Connector will automatically track changes to your Active Directory or LDAP server (e.g., adding a new user, removing/disable existing users, changing user groups for a user, etc.) and invoke appropriate actions for LastPass accounts. Similarly, if you delete or disable a user in Active Directory, the associated LastPass account will also be disabled.
For more information, please see our Active Directory Connector FAQs.

Learn how to get started with setting it up.

LastPass Provisioning API

LastPass exposes a public API that can be used by LastPass Enterprise accounts to create users, deprovision users, and manage groups via a REST web service interface. The LastPass Provisioning API is powerful, and includes many configuration settings that can be customized.

The main difference between this option and the Active Directory Connector is that the LastPass Provisioning API requires some coding on your part to avoid having duplicate actions occur, whereas the ADC requires zero coding or integration.

Learn how to get started with setting it up.

Windows Login Integration

LastPass can invisibly integrate with the standard Windows Login process to automatically create new users and sign existing users in. To do this, we install a DLL that hooks the Windows login flow using sanctioned/standard Windows protocols. When LastPass receive the password, it is instantly hashed and then the hash is used to create the user’s LastPass credentials. LastPass never stores anything on disk and are careful to not leave anything in memory.

With the Windows Login integration, users within the LastPass Enterprise system will be provisioned using their Windows username followed by the @companydomain.com address that your organization uses (e.g., janedoe@lastpass.com). New users to LastPass will be created upon their first login to the Windows domain after setting up the Windows Login integration with LastPass. From that point on, users will log in to the Windows domain as they normally would, and will automatically be logged into LastPass as well.

Learn how to get started with setting it up.

Azure Active Directory integration

LastPass provides an out-of-the-box solution to centrally manage all passwords that are being used and shared throughout the organization, and helps solve for the co-management of work and personal credentials. Using LastPass with your Azure AD user directory as your single sign-on solution can help IT enforce security controls and address the gap left by apps and web services introduced by users that do not support SSO.

Learn how to get started with setting it up.

Okta integration

We’ve partnered with Okta to offer a SCIM API that can be configured for automatic provisioning and deprovisioning of LastPass accounts for easy, secure administration.

Learn how to get started with setting it up.

OneLogin integration

To ease onboarding and management of LastPass, we’ve partnered with OneLogin to allow automated user provisioning and deprovisioning through a SCIM API. Our OneLogin endpoint can be configured for instant creation of LastPass accounts and real-time revocation when employees leave the organization. IT admins benefit from easy, secure administration of LastPass through their OneLogin directory.

Learn how to get started with setting it up.