Active Directory Plugin
Active Directory Plugin integrates Workflow Engine with Microsoft Entra ID through Microsoft Entra Domain Services. It also supports Active Directory Domain Services (AD DS) and compatible LDAP directories. The plugin reads users and direct group membership for command authorization, and it adds workflow operations for managing directory users and groups.
Azure Active Directory is now called Microsoft Entra ID, while Active Directory Domain Services (AD DS) retains its name, as explained in Microsoft's naming guidance. Microsoft Entra ID has no LDAP endpoint, so Active Directory Plugin connects to Microsoft Entra Domain Services over LDAP or LDAPS; it does not call Microsoft Graph.
Where to start
Choose a page by the task you need to complete.
Overview
See how Active Directory Plugin connects WorkflowRuntime, directory groups, and command authorization.
Configure LDAP Sources
Connect Active Directory Plugin to Microsoft Entra Domain Services, AD DS, or another LDAP directory.
Authorize Commands with Directory Groups
Use the ActiveDirectoryGroup rule to restrict a command transition to members of a directory group.
Manage Directory Users and Groups
Use plugin actions, conditions, custom activities, and the direct .NET API for directory operations.
Active Directory Plugin is distributed in the WorkflowEngine.NETCore-ActiveDirectoryPlugin package and requires a license that includes the Active Directory feature. Registration fails when that license feature is absent.
Frequently asked questions
How does Active Directory Plugin integrate with Microsoft Entra ID?
Active Directory Plugin connects by LDAP or LDAPS to Microsoft Entra Domain Services, which receives a one-way synchronization of users and groups from Microsoft Entra ID. The built-in LDAP clients do not call Microsoft Entra ID or Microsoft Graph directly.
Can Active Directory Plugin connect to on-premises Active Directory?
Yes. Active Directory Plugin supports AD DS through the same LDAP configuration used for Microsoft Entra Domain Services. It can also use compatible LDAP directories with custom schema settings.
Does Active Directory Plugin sign users in to my application?
No. Active Directory Plugin supplies directory-backed workflow authorization and directory operations. The host application authenticates the user and passes the user's ActiveDirectoryUser.Name value as the Workflow Engine identity ID when it queries available commands. The built-in presets map that value from the directory cn attribute.
Can Active Directory Plugin connect to more than one directory?
Yes. Active Directory Plugin accepts a list of uniquely named sources. Designer selections include both the group and source, so schemes can refer to groups from different directories.