Adding two Ms Active Directory’s

[Dan Wright]

We are looking to onboard another area of the business on to JSD but they’re on a separate domain.
There is a trust between the current domain and this new one, but does JSD allow us to connect to two Microsoft Active Directories to sync users and also maintain the internal option?

Thank you all in advance

[Nic Brough -Adaptavist- · Accepted solution]

Yes - go to Admin -> Users -> Directories.  You can add a loads of directories in there.

Just be aware of how Atlassian stuff processes them.  When a user or group definition is requested, the system looks in each directory in turn, and it stops dead on the first hit.  This can have an impact if you have directories with duplicate user IDs, as it will use the first one it finds.  It also means that if your directories are large, you probably want to place the largest one first on the list and go in descending order for optimal speed (assuming there are no duplicate groups or users)

This includes the ability to be a bit more sneaky.  I have a client who has an AD with over 200,000 users in it (many are clients to be fair, with minimal access, but at least every account is in one place).  200k users synchronising into their Atlassian systems is a silly amount of processing when they only need a couple of thousand in there, so they set up three directories.  All the same AD domain, the single one with 200k, but each had a different AD filter, so one only looked at users with "UK developer" as an OU, a second with "US developer" and so-on  (Rules over simplified here because you don't need to see the mess in their AD)

[Dan Wright]

Nic thank you very much for this, really appreciate you spending the time responding.