# AD integration direction needed **URL:** \ **Category:** Ignition\ **Created:** [March 12, 2018, 6:54pm UTC](https://forum.inductiveautomation.com/t/ad-integration-direction-needed/17331 "2018-03-12T18:54:52Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![tbackus](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tbackus/32/5091_2.png) [@tbackus](https://forum.inductiveautomation.com/u/tbackus)\ **Post date:** [March 12, 2018, 6:54pm UTC](https://forum.inductiveautomation.com/t/ad-integration-direction-needed/17331/1 "2018-03-12T18:54:52Z")
We are quickly growing the number of Ignition servers in our company and need to explore AD integration. The requirement is for me to have several Security Groups created, then allow that security group access to the server. Individuals will be placed in the proper AD security group and will have access to Ignition functions based on that Security Group Assignment on the server. IE: Buffalo\_Admin users will get admin access to the Buffalo Ignition server but not Hot Springs. And Global\_Admin will be allowed access to every Ignition server. Can this be done? Can someone guide me to which type of AD integration I need" AD - AD/Hybrid - AD/Internal In the Example of a Buffalo Ignition server, I assume I would make an Admin Role on the server, then Assign Buffalo\_Admin and Global\_Admin AD security groups to that Admin Role?? Any guidance is appreciated. ---
**Author:** ![Vince](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@Vince](https://forum.inductiveautomation.com/u/Vince)\ **Post date:** [March 13, 2018, 2:28pm UTC](https://forum.inductiveautomation.com/t/ad-integration-direction-needed/17331/2 "2018-03-13T14:28:01Z")
You can use AD Hybrid. It is easier to implement. 2 possibles way: 1- Have on user group in AD. All the users that need to access any of the Ignition server must be member of this group. The users list will be the same for all Ignition server BUT you can still control the access because the roles are savec locally in Ignition database (one per server). 2- Have one user group in AD per Ignition server. This way, the list on users will be different for each Ignition server. ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [March 13, 2018, 3:40pm UTC](https://forum.inductiveautomation.com/t/ad-integration-direction-needed/17331/3 "2018-03-13T15:40:57Z")
> [@Vince](#): > > You can use AD Hybrid. It is easier to implement. Easier to implement, harder to maintain if you have a separate IT group. We use straight AD here. > [@tbackus](#): > > In the Example of a Buffalo Ignition server, I assume I would make an Admin Role on the server, then Assign Buffalo\_Admin and Global\_Admin AD security groups to that Admin Role?? You are correct, sir! We also use a designer role to further limit gateway access. ---
**Author:** ![Vince](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@Vince](https://forum.inductiveautomation.com/u/Vince)\ **Post date:** [March 13, 2018, 3:53pm UTC](https://forum.inductiveautomation.com/t/ad-integration-direction-needed/17331/4 "2018-03-13T15:53:18Z")
You are right. My mistake. I meant AD Internal is easier. ---
**Author:** ![tbackus](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tbackus/32/5091_2.png) [@tbackus](https://forum.inductiveautomation.com/u/tbackus)\ **Post date:** [March 13, 2018, 7:26pm UTC](https://forum.inductiveautomation.com/t/ad-integration-direction-needed/17331/5 "2018-03-13T19:26:32Z")
Thank you both. I ended up doing pure AD. What I was stuck on was the fact that I then had to go into the gateway, Configure, Gateway Settings, and hand type in the appropriate AD Security group name into the Gateway Config Role, Status Page Role, Designer Role, Etc. Seems a bit clunky to me (shouldn’t it query the AD for a dropdown), but once it’s setup properly will be a lot easier to manage as we start adding more servers. Thanks again!! ---
**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\ **Post date:** [March 14, 2018, 1:33am UTC](https://forum.inductiveautomation.com/t/ad-integration-direction-needed/17331/6 "2018-03-14T01:33:26Z")
We did AD Hybrid for a few years but are switching to pure AD. It was harder to setup on the IT side (big IT org) but now we can transfer role maintenance responsibility out of Ignition and needs no special training. ---
**Author:** ![krowland](https://avatars.discourse-cdn.com/v4/letter/k/a587f6/32.png) [@krowland](https://forum.inductiveautomation.com/u/krowland)\ **Post date:** [November 22, 2024, 7:52pm UTC](https://forum.inductiveautomation.com/t/ad-integration-direction-needed/17331/7 "2024-11-22T19:52:55Z")
Would you be open to a phone call to discuss lessons learned from using AD?