# Identity synchronization

> Bring users and groups into Ironchip from Active Directory, Entra ID, LDAP, SCIM, or a CSV file, and find answers to the most common synchronization questions.

URL: https://docs.ironchip.com/en/identidad/administracion/sincronizacion/

Keep the users and groups in the admin console aligned with your directory. This page summarizes the available synchronization methods, explains how to synchronize with SCIM or with a CSV file from the console, and collects the frequently asked questions.

| Source                       | Mechanism                                         | Guide                                                                   |
| ---------------------------- | ------------------------------------------------- | ----------------------------------------------------------------------- |
| On-premises Active Directory | Ironchip AD Connect agent installed in the domain | [AD Connect](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/ad-connect/)   |
| Microsoft Entra ID           | Enterprise application with SCIM provisioning     | [Entra ID](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/entra-id/)       |
| LDAP directory               | `sync-users` command of the Ironchip LDAP proxy   | [LDAP proxy](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/proxy-ldap/)   |
| Other directory              | SCIM credential created in the console            | [SCIM in the console](#scim-in-the-console)                             |
| CSV file                     | Template you upload from the console              | [Synchronize users with a CSV file](#synchronize-users-with-a-csv-file) |

In the console, the **Directory > Synchronization** menu has two options: **CSV**, to synchronize with a file, and **SCIM**, for automatic synchronization.

[Image: Directory > Synchronization menu of the console, with the CSV and SCIM options]

## SCIM in the console

SCIM (System for Cross-domain Identity Management) automatically synchronizes the users and groups of your directory with Ironchip. Any addition, change, or removal in the directory is reflected in the console without managing users by hand. To use it, create a SCIM credential in the console and configure it at the source: [AD Connect](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/ad-connect/), [Entra ID](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/entra-id/), or another SCIM 2.0 compatible system.

1. Go to **Directory > Synchronization > SCIM**. The **Synchronization with SCIM** page has two tabs: **Get started** and **Credentials**.

   [Image: Access to the SCIM section of the console]

2. Open **Credentials** and click **Add credential** to create your company's secret. The list shows each credential with its hint (**Hint**) and date, and you can search by hint.

   [Image: Credentials tab of the SCIM setup with the Add credential button]

3. Copy the secret and store it in a safe place.
4. Configure the source with these values:
   - **Tenant URL**: `https://api.ironchip.com/scim/v2`.
   - **Secret Token**: the secret of the credential you just created. In AD Connect it is called **SCIM synchronization key**.

## Automatic synchronization with LDAP

LDAP synchronization keeps the Ironchip user database up to date from your company's Active Directory. Any change to the users or groups in AD is reflected in the console without managing users by hand. It can also synchronize specific attributes, such as the phone number, so the information is the same in both systems.

To set it up, follow the [AD Connect](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/ad-connect/) guide. The [LDAP proxy](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/proxy-ldap/) also includes a tool to synchronize users from LDAP.

## Synchronization with Entra ID using SCIM

This integration automatically synchronizes your organization's users from Microsoft Entra ID (formerly Azure AD) to the Ironchip console. With the SCIM protocol, any user or group you assign to your enterprise application is provisioned in Ironchip without manual management. You can also map Entra ID user attributes to Ironchip fields.

The process in short:

1. **Configure Ironchip.** Create a SCIM credential in the admin console to get the **Tenant URL** and the **Secret Token** for your company. See [SCIM in the console](#scim-in-the-console).
2. **Provision in Entra ID.** In the Microsoft Entra ID portal, add the Ironchip application and set the credentials under **Provisioning**.
3. **Map attributes.** Define which fields (name, email, groups) are synchronized. Ironchip uses this data to create, update, or deactivate users automatically.
4. **Real-time synchronization.** Any change in the directory, such as deactivating an employee or moving them to another department, is reflected in Ironchip immediately.

The full guide is in [Synchronize users with Entra ID](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/entra-id/).

## Synchronize users with a CSV file

CSV synchronization lets you add as many users as you want with a single file. Go to **Directory > Synchronization > CSV**. The wizard has four steps: **Template download**, **Template upload**, **Sync options**, and **Summary**.

1. Click **Synchronize**, on the right side of the window.
2. In the **Template download** step, read the information in the window. It explains how to fill in the template and that you must not change the `.csv` extension or the column names. Click **Download template**, then **Next**. If you already have a template, you can skip this step.

   [Image: Template download step with the Download template button]

3. Fill in the template with the users you want to synchronize.
4. In the **Template upload** step, drag the completed template to the indicated area, or click the area to select the file from your computer.

   [Image: Template upload step with the area to drop the CSV file]

5. When the template has loaded correctly, click **Next**. Use **Back** to return to the previous step.

   [Image: Template upload step with the CSV file selected and the Next button]

6. In the **Sync options** step, choose which group receives the users and how to treat users that are not in the new data:
   - **Delete them from the selected group.** If a user in the group is not in the new data, the user is removed from the selected group.
   - **Also delete them from the platform.** The user is also deleted from the platform.
   - **Enable invitation to Ironchip for the synchronized users.** Turns on Ironchip protection for the synchronized users. If you leave it cleared, the synchronized users are not protected by Ironchip.

   If you choose a default group (`AllUsers`, `Personal-Group`), the console warns you that you are about to update the company user group with new user data and that this can permanently remove users from the company. Confirm the warning to continue.

   [Image: Sync options step with the selected group and the synchronization options]

7. Click **Next**.
8. In the **Summary** step, review the final synchronization summary:
   - The imported template: `{filename}.csv`.
   - The group the synchronized users are added to.
   - Whether the synchronized users are protected by Ironchip.
   - What happens to a user in the group who is not in the new data: the user stays in the group or is removed, depending on what you chose.

   [Image: Summary step with the synchronization summary and the confirmation checkbox]

9. Select **I have read the synchronization summary and understand the implications.** and click **Add**. If you're unsure, go back to the previous screens with **Back**.

:::caution[Irreversible actions]
Read the messages the console shows at each step carefully. Deleting a user from the platform permanently removes their data, keys, and access, and it cannot be undone.
:::

When the process ends, the main screen lists the synchronizations: the updated group, the file name, the date, the status, and the number of synchronized users out of the total in the file. This way you can see at a glance whether anything failed.

[Image: List of CSV synchronizations with the group, file, date, and status of each]

## MFA integrations

Ironchip integrates with third-party MFA systems to add a layer of security when you use external services to authenticate. You create HTTP-MFA integrations in the console, under **Applications > MFA integrations**: first you create the integration and then you create a service of that type. See [Applications](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/#create-an-http-mfa-integration).

## Frequently asked questions

### What methods are there to integrate Ironchip with Active Directory?

There are four:

- **AD Connect agent:** the most common method for on-premises AD. It synchronizes users and groups automatically and in real time.
- **Direct LDAP:** no local agent, with periodic synchronization. It is for LDAP directories that are not Windows-based.
- **Entra ID with SCIM or the native connector:** for cloud or hybrid environments.
- **AD with Windows logon:** the agent adds Ironchip as an additional credential provider on top of AD. See [Windows logon](https://docs.ironchip.com/en/identidad/integraciones/puestos/windows-logon/).

### What is the difference between integrating AD over LDAP and with AD Connect?

- **AD Connect:** installs software on the network and synchronizes in real time. It is ideal for on-premises AD and supports complex groups and advanced attributes.
- **Direct LDAP:** needs no agent and synchronizes periodically (pull). It is simpler and works for LDAP directories that are not Windows-based, or when you can't install software on the server.

### The console shows fewer users than Active Directory

The most common causes are:

- Child groups that are not synchronized: the agent may not synchronize all the members of nested subgroups.
- Incorrect configuration of the group with automatic invitation (`Autoinvite`) in Ironchip. See [Automatic invitation](https://docs.ironchip.com/en/identidad/administracion/invitacion-automatica/).

To resolve it, write to support with the name of the affected group so they can verify the agent version and the configuration.

### How are nested Active Directory groups (child groups) handled?

When you set up synchronization, state explicitly whether the members of child groups are synchronized. The child group must be linked to the corresponding Ironchip group. Child groups you add after the initial configuration may need a manual adjustment.

### How do I update the AD Connect agent?

The update requires a joint technical session between Ironchip and your IT team. Ironchip validates the update before the session. Write to [support@ironchip.com](mailto:support@ironchip.com) to coordinate it.

### Can I migrate the Ironchip configuration between AD environments?

Yes, but it requires prior coordination with the Ironchip technical team. The process includes:

1. Exporting the source configuration.
2. Validating the compatibility of the new AD.
3. Configuring the connector.
4. Verifying the synchronization.
5. Keeping a coexistence period if the migration is gradual.