> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-v8-50-what-s-new.md). # Active Directory Sync v8.50 changes Understand the REST API architecture and operator model introduced with Active Directory Sync v8.50. The current AD Sync generation, rebuilt on the REST API. | Attribute | Value | | ------------- | --------------------------------------------------------------------------------------------- | | Status | Current | | Introduced in | CC v8.50 | | Config model | REST API (forward compatible with all later CC versions) | | Service | **Gallagher Active Directory Sync Service** (renamed from *FT Active Directory Sync Service*) | | Auth | AD Single Sign-On to authorize the config UI | | Relationship | Replaces the v8.40 XML/certificate generation | ## What's new 1. **Fully REST-API based.** Persists and is compatible with CC v8.50 and higher. Because the REST interface is forward-compatible (functionality is added, never removed), CC version is no longer a compatibility concern. 2. **AD SSO login.** Only accounts authorized in **both** AD and CC can open the AD Sync UI; no manual login. ![The renamed "Gallagher Active Directory Sync Service" shown running in the Windows Services list](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-e2541dbca86cd26ccbf3ebac63a97a0b7657cc7f%2FSECHUB-AD-SYNC-17-gallagher-ad-sync-service.png?alt=media) ## The two operator groups (v8.50+) The v8.50 model **requires two operator groups**. Keeping them separate preserves auditability (who changed a cardholder: AD Sync versus a human operator). | Operator account | In Active Directory | In Command Centre | Purpose | | ---------------------------------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | **REST API operator** (CC REST operator) | — | Assigned to the REST Client item; privileges to configure cardholders | The account AD Sync uses to create/modify cardholders in CC | | **AD Sync UI operator** (Authorising Operator Group) | Domain User; delegated AD attribute view/edit; "Replicating Directory Changes" | Operator configured to log in via SSO; needs **no** CC privileges beyond SSO login | The account used to log in to the AD Sync UI; also used for CC→AD replication | The AD Sync UI operator's Domain User account must also have **Local Admin** on the machine running the AD Sync UI. ![The two-operator AD Sync architecture — REST API operator + AD Sync Service writing to Command Centre, and a Domain User + AD Sync UI operator driving the AD Sync GUI](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-da1eb5556088746ef40a9a8b026e492ca0807d7d%2FSECHUB-AD-SYNC-15-two-operator-architecture.png?alt=media) ![AD Sync UI Credentials tab showing the two credentials — AD Operator (Active Directory Domain Credential) and CC REST Operator (Command Centre REST API Credential)](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-224ea585601fc366670cf010c98dd8100b48c9b4%2FSECHUB-AD-SYNC-18-credentials-two-operators.png?alt=media) *** 🔗 **Related** * [Sync v8.50 - Installation Supporting Document](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-v8-50-installati.md). The install order. * [Sync v8.50 - Priority Requirements](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-v8-50-priority-r.md). What must be in place first. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-v8-50-what-s-new.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.