> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope.md).

# Identity solutions

Integrate identity systems for cardholder and operator synchronisation.

Command Centre can **synchronise Cardholder (and Operator) records with a customer's identity directory**, so staff onboarding, offboarding, and access changes flow automatically instead of being entered twice. Four integrations exist, differing by directory and by direction.

| Integration                                                                                                                                                              | Directory                  | Direction                                     | First CC version | Notes                                                                                |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------- | --------------------------------------------- | ---------------- | ------------------------------------------------------------------------------------ |
| [Active Directory Sync](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-features-and-fun.md) | On-prem Microsoft AD       | **Bidirectional** (AD↔CC)                     | v8.20            | The workhorse. Major architecture change at **v8.50** (XML/certificate to REST API). |
| [Entra ID Sync](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/entra-id.md)                                                        | Microsoft Entra ID (cloud) | **Bidirectional** (Entra↔CC)                  | v9.20            | Newest. **v1.0** (AD-SSO auth) vs **v2.0** (Entra-SSO auth, CC v9.40+).              |
| [Okta Sync](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/okta-sync.md)                                                           | Okta (cloud IdP)           | **One-way** (Okta→CC)                         | v8.80            | Group→Access-Group mapping.                                                          |
| [Nexudus](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/nexudus.md)                                                               | Nexudus Spaces (coworking) | **One-way** (Nexudus→CC) + Access events back | v8.30            | Team→Access-Group mapping; sends Access Granted events as Check-Ins.                 |

Separately, [Active Directory Single Sign-On](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-settin.md) lets **operators** log into Command Centre with their Windows/AD credentials. This is an authentication feature, not cardholder sync.

> 🧭 **Where to start**
>
> * **On-prem AD, two-way sync?** → [Active Directory](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory.md).
> * **Cloud / Microsoft 365 / Entra tenant?** → [Entra ID](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/entra-id.md).
> * **Okta or Nexudus?** → [Okta Sync](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/okta-sync.md) / [Nexudus](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/nexudus.md).

## Common building blocks

* **REST API operator + REST Client item.** The modern integrations (AD Sync v8.50+, Entra ID Sync) write to Command Centre through the REST API, using a dedicated CC operator whose privileges cover cardholder configuration.
* **Cardholder Filter / Valid Groups / Valid Containers.** Every sync decides which directory users become cardholders, and what happens to a cardholder when they leave the valid scope (leave / deauthorise / remove).
* **Unique ID mapping.** How a directory user is matched to a cardholder (for example Entra Object ID to cardholder External ID, or a unique PDF as a secondary key).
* **Single Sign-On.** AD SSO (and, from CC v9.40, Entra ID SSO) authenticate the person who launches the sync configuration UI.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.