> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-user-accounts-re.md).

# Active Directory Sync user account requirements

Configure service and domain account permissions for Active Directory cardholder synchronization.

Configure the **minimum** permissions for cardholder synchronisation.

> ⚠️ These changes should only be done by an authorised domain administrator.

Both **AD → CC** and **CC → AD** use two accounts:

* **Account 1 — the Sync Service account:** only **Local user-level** privileges, plus **local administrative** rights so the service can reach the local certificate store. Add a local user to the **Administrators** group and set the service to run as it.
* **Account 2 — the AD Operator account (LDAP connection):** a **Domain User**. For **AD→CC**, grant **Replicating Directory Changes (RPC)** at the **root** of the AD tree. For **CC→AD**, delegate **Property-specific** permissions to the user.

**SQL access consideration** (when the CC SQL DB and the Sync Service are on different machines): a **local** service account can only use **SQL authentication** for read-only DB access; a **domain** account that is also in the **Administrators** group can use **Windows authentication**.

![Adding the AD Sync service account to the local Administrators group (Computer Management)](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-cd12984ecec1e571ad66cca2fde40b7b89b7205d%2FSECHUB-AD-SYNC-08-service-account-local-admin.png?alt=media)

![Setting the FT Active Directory Sync Service to log on as the created service account (Services > Log On tab)](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-b5514f688715b07d340eab0018124aebc575bde3%2FSECHUB-AD-SYNC-09-service-log-on-account.png?alt=media)

![Granting the AD Sync operator the "Replicating Directory Changes" permission (Allow) on the domain object's Security tab](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-5ad25b595cca9fbd10835abdb913da40c4dcc7a7%2FSECHUB-AD-SYNC-10-replicating-directory-changes.png?alt=media)

## CC → AD delegation (Delegation of Control Wizard)

![Delegation of Control Wizard — "Create a custom task to delegate" selected](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-d12cbb6104dbc8ec0c780674b39c75bb0925ff29%2FSECHUB-AD-SYNC-11-delegate-custom-task.png?alt=media)

![Delegation wizard — scoping the task to "User objects" only](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-ef28ee2286b083b78af58e13aa9b58d2964227d5%2FSECHUB-AD-SYNC-12-delegate-user-objects.png?alt=media)

![Delegation wizard — Property-specific permissions with Read/Write ccCSN and Read/Write ccardID selected](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-15605231280c4538bf4bbf532f3bd13056e78943%2FSECHUB-AD-SYNC-13-delegate-property-specific-cccsn.png?alt=media)

***

🔗 **Related**

* [Sync - Features and Functions](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-features-and-fun.md). What AD Sync does.
* [Sync v8.50 - Priority Requirements](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-v8-50-priority-r.md). Operator and REST requirements on v8.50+.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-user-accounts-re.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.