# How to setup Roles in Active Directory

**URL:** <https://forum.inductiveautomation.com/t/how-to-setup-roles-in-active-directory/34791>\
**Category:** Ignition\
**Created:** [May 15, 2020, 4:59pm UTC](https://forum.inductiveautomation.com/t/how-to-setup-roles-in-active-directory/34791 "2020-05-15T16:59:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jcaudle](https://avatars.discourse-cdn.com/v4/letter/j/35a633/32.png) [@jcaudle](https://forum.inductiveautomation.com/u/jcaudle)\
**Post date:** [May 15, 2020, 4:59pm UTC](https://forum.inductiveautomation.com/t/how-to-setup-roles-in-active-directory/34791/1 "2020-05-15T16:59:54Z")

</div>

I’ve set up Authentication of Users through an AD/Internal Hybrid. I’d like to switch to a full Active Directory User Source and control the roles and assignments in the AD.

I see how to set up the connection: [https://docs.inductiveautomation.com/display/DOC80/Active+Directory+Authentication](https://docs.inductiveautomation.com/display/DOC80/Active+Directory+Authentication)

I do not see how to configure the AD side to be useful in the Roles management… What am I missing?

---

<div class="post-metadata">

**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\
**Post date:** [May 15, 2020, 5:06pm UTC](https://forum.inductiveautomation.com/t/how-to-setup-roles-in-active-directory/34791/2 "2020-05-15T17:06:41Z")

</div>

Roles are whatever AD groups you have. They can’t be managed through Ignition.

---

<div class="post-metadata">

**Author:** ![jcaudle](https://avatars.discourse-cdn.com/v4/letter/j/35a633/32.png) [@jcaudle](https://forum.inductiveautomation.com/u/jcaudle)\
**Post date:** [May 15, 2020, 5:28pm UTC](https://forum.inductiveautomation.com/t/how-to-setup-roles-in-active-directory/34791/3 "2020-05-15T17:28:11Z")

</div>

So my three hundred or so groups in the AD all become assignable roles? How does Ignition know? Does it look in the AD for a group of objects under a specifically named group?

---

<div class="post-metadata">

**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\
**Post date:** [May 15, 2020, 5:36pm UTC](https://forum.inductiveautomation.com/t/how-to-setup-roles-in-active-directory/34791/4 "2020-05-15T17:36:50Z")

</div>

> [@jcaudle](#):
>
> So my three hundred or so groups in the AD all become assignable roles?

It depends how high in the AD subtree you go. If it's at the top, then all groups become assignable roles. All users become potential users.

The User Search Base and Role Search Base settings define where in the subtree to start (They're in the advanced settings)