Use directory integrations for automated provisioning in LastPass
If you determined that an automated provisioning service best suits your organization, let's review each one in detail so that you can make an informed decision about the service you choose. Please note that there is no limitation for the amount of users you can add to your account.
Feature availability may vary depending on your account type.
LastPass Active Directory Connector service
The LastPass Active Directory Connector (AD Connector) sync client is a Windows service that is run locally and can be downloaded from the Admin Console within your LastPass Enterprise or Identity account. It connects to your Active Directory environment to support a variety of provisioning and management processes in LastPass Enterprise or Identity accounts.
Using the Active Directory Connector service, you can:
- Feed relevant information from your user directory into LastPass.
- Sync new user profiles to LastPass for automated provisioning of LastPass user accounts.
- Sync disabled or deleted user profiles to LastPass for automated termination of LastPass user accounts.
- Create nested groups to manage permissions at the group level.
- Sync user groups to LastPass for policy designations, Shared Folders, and SAML application assignments.
- Apply filters based on your groups so that only members of the relevant groups sync to LastPass.
- Provisioning for a number of cloud-based applications, including Google Apps and Salesforce.com. Once set up, when users are added in your Active Directory, a LastPass account will be created on their behalf. No local provisioning necessary.
Out of the box, the Active Directory Connector will automatically track changes to your Active Directory or LDAP server (e.g., adding a new user, removing or disabling existing users, changing user groups for a user, etc.) and invoke appropriate actions for LastPass accounts. Similarly, if you delete or disable a user in Active Directory, the associated LastPass account will also be disabled.
For more information, please see our Active Directory Connector FAQs.
Federated login using Active Directory
LastPass Enterprise account admins can set up and configure federated login so that users can utilize their organization's Active Directory account to log in to LastPass without ever having to create a second Master Password.
LastPass Provisioning API
LastPass exposes a public API that can be used by LastPass Enterprise accounts to create users, deprovision users, and manage groups via a REST web service interface. The LastPass Provisioning API is powerful, and includes many configuration settings that can be customized.
Note: The LastPass Provisioning API does not support managing groups for pre-configured SSO (Cloud) apps in the SSO & MFA Admin Console.
The main difference between this option and the Active Directory Connector is that the LastPass Provisioning API requires some coding on your part to avoid having duplicate actions occur, whereas the ADC requires zero coding or integration.
Azure Active Directory integration
LastPass provides an out-of-the-box solution to centrally manage all passwords that are being used and shared throughout the organization, and helps solve for the co-management of work and personal credentials. Using LastPass with your Azure AD user directory as your single sign-on solution can help IT enforce security controls and address the gap left by apps and web services introduced by users that do not support SSO.
We’ve partnered with Okta to offer a SCIM API that can be configured for automatic provisioning and deprovisioning of LastPass accounts for easy, secure administration.
To ease on-boarding and management of LastPass, we’ve partnered with OneLogin to allow automated user provisioning and deprovisioning through a SCIM API. Our OneLogin endpoint can be configured for instant creation of LastPass accounts and real-time revocation when employees leave the organization. IT admins benefit from easy, secure administration of LastPass through their OneLogin directory.