Is there a way to use Azure AD as an LDAP Data Source?

[Karl Dietrich]

Hello there, 

I wonder if you could configure Azure and ServiceNow in such a way that you would be able to use the Azure AD as a Data Source. I do not have much experience with Azure / Azure AD, so I do not know if that is even theoretical possible. 

Normally you define an LDAP oder LDAPS Server and then you are able to browse the Directory or import the Data, but what do you do if you only have Azure and no on-premise AD? Can you just exchange Certificates and configure the LDAPS Connection? And if so how do you do it?

Thanks in advance for your answers :).

Best regards

Karl

[ersureshbe]

Can you clarify location, company is coming with the user data or separately. If it coming with user data you can control insert and update with Transform script.

Incase  location, company is not coming with user data, you should create the import set table depends your data flow you control location and company control one import set if required create one more import set table to handle this.

Regards,

Suresh.

[Richard Hine]

Karl,

Azure AD is not a hierarchical database like AD, it is in effect a flat database, so you cannot use it as an LDAP source in the same way.

As others have said, you can have it provision users and groups, but your reference data such as company, cost centre and location will need to come from elsewhere.

The MS Article on doing it starts here https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/servicenow-tutorial. I wouldn't say it covers everything and it is not really up to date (It still mentions ServiceNow Express!) but it can get you started.

Company and Cost Centre usually come from an ERP solution, ServiceNow often ends up being the master source for locations in many Enterprises anyway.

Thanks and Regards,

Richard

[Karl Dietrich · Accepted solution]

Hi Richard,

thank you, your answer led me to the right path for the solution. So you can add the Azure AD not directly as an LDAP Server in ServiceNow but what you can do is to do it via an Active Directory Domain Service Domain. 

This is the MS Guide on how to do it:

With this I could successfully configure an LDAPS Connection and read Out the Directory. 

Best regards,

Karl