[Skip to content](https://www.innguma.com/en/resources/faq/active-directory/#contenido)

Frequently asked questions

# Does Innguma integrate with Active Directory?

**Short answer** 

Yes. Innguma integrates with the organisation's Active Directory: each person signs in with their corporate account, and additions and removals are managed centrally, from the same directory the company already uses for its other tools. Access to watch information therefore follows the same identity processes that the IT department applies to any other corporate application.

## What is Active Directory, and what does integrating with it mean?

Active Directory is Microsoft’s directory service, which many organisations run on their own servers to manage accounts, groups and credentials. Its cloud equivalent is Microsoft Entra ID, and many companies combine both: Microsoft calls hybrid identity having a common user identity to authenticate and authorise against resources both on premises and in the cloud, maintained through provisioning and synchronisation[\[1\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-1).

Integrating an application with the directory means that the application stops managing its own passwords and trusts the corporate identity. Single sign-on lets each person sign in once with a single set of credentials and open the applications assigned to them without identifying themselves again[\[2\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-2).

## What is the difference between single sign-on and provisioning?

They are two distinct pieces that are often confused. Microsoft summarises it this way: standards such as SAML or OIDC resolve sign-in, but access also requires the account to exist in the application, and automatic provisioning covers creating, maintaining and deleting those identities when each person’s situation changes[\[3\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-3).

| Mechanism | What it resolves | Usual standard |
| --- | --- | --- |
| Single sign-on | The person authenticates with their corporate identity | SAML 2.0, from OASIS[\[4\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-4), or OpenID Connect, an authentication protocol built on OAuth 2.0[\[5\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-5) |
| Provisioning | Creating, updating and deactivating accounts in the application | SCIM, the IETF’s HTTP protocol for managing identities across domains (RFC 7644, September 2015)[\[6\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-6) |
| Provisioning on first access | Creating the account the first time the person signs in | Attributes sent during authentication (for example, in SAML)[\[3\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-3) |
| Hybrid synchronisation | Aligning the local directory with the cloud one | The identity provider’s synchronisation tools[\[1\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-1) |

The specific mechanism and protocol used with Innguma are agreed with each organisation’s IT team during set-up.

## Why do removals matter so much in a watch platform?

Because a watch concentrates strategic information: which competitors are followed, which technologies matter, which internal comments accompany each signal. An account that remains active after its holder has left, perhaps for a competitor, is a concrete risk. Microsoft highlights, as a benefit of automatic provisioning, the immediate withdrawal of identities from applications when someone leaves the organisation[\[3\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-3).

Spain’s National Security Framework follows the same logic: Royal Decree 311/2022 requires access to systems to be controlled (Article 17) and configured to grant only the minimum privileges necessary (Article 20), and it develops the access control measures in its Annex II[\[7\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-7). Managing additions and removals from a single directory makes those principles easier to meet.

## What does the integration bring to Innguma?

-   **Corporate sign-in.** Each person accesses Innguma with the same identity they use in the rest of their tools.
-   **Centralised additions.** Giving access to someone new is part of the usual joining process in the directory.
-   **Centralised removals.** Access is withdrawn from the same directory in which the person’s departure is managed.
-   **A single point of control.** The IT department governs access to Innguma with the policies it already applies to other applications.

The systems that support Innguma’s managed watch services are certified under the ENS at MEDIUM level (certificate 34/5704/24/05039, OCA Global, valid until June 2028)[\[8\]](https://www.innguma.com/en/resources/faq/active-directory/#ref-8).

## What should you prepare with the IT team?

1.  Which directory the organisation uses: on premises, in the cloud or hybrid.
2.  Which directory group will give access to Innguma, so that a new user is added by adding them to that group.
3.  Who approves each addition, and who periodically checks that no unnecessary access remains.
4.  Which corporate policies the identity provider already applies, such as multi-factor authentication, and whether they affect access.
5.  Who reviews the newsletter recipient lists when someone changes area or leaves.
6.  A trial with a small group before opening access to the rest.

## Sources and references

1.  \[1\] [Microsoft Learn. What is hybrid identity with Microsoft Entra ID?](https://learn.microsoft.com/en-us/entra/identity/hybrid/whatis-hybrid-identity)
2.  \[2\] [Microsoft Learn. What is single sign-on in Microsoft Entra ID?](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/what-is-single-sign-on)
3.  \[3\] [Microsoft Learn. What is automated app user provisioning in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/user-provisioning)
4.  \[4\] [OASIS. Security Assertion Markup Language (SAML), specifications repository, including version 2.0](https://docs.oasis-open.org/security/saml/)
5.  \[5\] [OpenID Foundation. How OpenID Connect Works](https://openid.net/connect/)
6.  \[6\] [IETF. RFC 7644, System for Cross-domain Identity Management: Protocol. 2015](https://www.rfc-editor.org/rfc/rfc7644)
7.  \[7\] [Royal Decree 311/2022, of 3 May, regulating Spain's National Security Framework (ENS). Spain's Official State Gazette (BOE)](https://www.boe.es/buscar/act.php?id=BOE-A-2022-7191)
8.  \[8\] [ENS certificate of Innguma (PDF)](https://www.innguma.com/certificados/ens.pdf)

## Related

- [Who can see each piece of information in Innguma?](https://www.innguma.com/en/resources/faq/permissions/)
- [What does Innguma's ENS certification cover?](https://www.innguma.com/en/resources/faq/ens/)
- [Where can I check Innguma's certificates?](https://www.innguma.com/en/resources/faq/verify-certificates/)
- [How long does it take for the platform to be up and running?](https://www.innguma.com/en/resources/faq/onboarding-time/)

- [Request a demo](https://www.innguma.com/en/demo/)
- [Back to the FAQ](https://www.innguma.com/en/resources/faq/#faq-seguridad)