# User Source vs Identity Provider with Active Directory **URL:** \ **Category:** Ignition\ **Created:** [November 17, 2022, 5:24pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643 "2022-11-17T17:24:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Jeremiah\_Brown1](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@Jeremiah\_Brown1](https://forum.inductiveautomation.com/u/Jeremiah_Brown1)\ **Post date:** [November 17, 2022, 5:24pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643/1 "2022-11-17T17:24:46Z")
Hello, I'm new to Ignition and trying to understand the difference between a User Source and Identity Provider. Has anyone used either option with MS Active Directory and what kind of issues did you run into? In this case the Ignition gateway will be at a remote site but the AD server is at the corporate office. I'm thinking the best option might be to use the default User Source and be done with it. Thoughts? Thanks, JB ---
**Author:** ![craigb](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@craigb](https://forum.inductiveautomation.com/u/craigb)\ **Post date:** [November 17, 2022, 5:35pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643/2 "2022-11-17T17:35:13Z")
For what its worth, our Ignition install is cloud hosted and our MS AD is a corporate located server. We experience no issues at all. ---
**Author:** ![Jeremiah\_Brown1](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@Jeremiah\_Brown1](https://forum.inductiveautomation.com/u/Jeremiah_Brown1)\ **Post date:** [November 17, 2022, 5:47pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643/3 "2022-11-17T17:47:39Z")
Good to know. Is your AD connection setup as a User Source or an Identity Provider? ---
**Author:** ![craigb](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@craigb](https://forum.inductiveautomation.com/u/craigb)\ **Post date:** [November 17, 2022, 6:04pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643/4 "2022-11-17T18:04:37Z")
We have it set as a AD/Internal Hybrid user source. It pulls in all users (filtered) from the AD then in the ignition gateway user roles are manually added, or removed. This way is preferred for us as users are not automatically granted access. ---
**Author:** ![witman](https://avatars.discourse-cdn.com/v4/letter/w/d2c977/32.png) [@witman](https://forum.inductiveautomation.com/u/witman)\ **Post date:** [November 17, 2022, 6:15pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643/5 "2022-11-17T18:15:15Z")
As long as corporate AD server is reachable from remote site, this shouldn't be a problem. We have multiple locations with AD/Internal Hybrid user source like @craigb mentioned using a central AD server. ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [November 17, 2022, 7:37pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643/6 "2022-11-17T19:37:17Z")
I recommend soft fallover mode to the default database and leave the Administrator account in there. That way you have a way in if the AD setup fails or you lock yourself out somehow (especially during configuration). You can also use the default user source to create and manage accounts for non-AD members such as contractors. ---
**Author:** ![Jeremiah\_Brown1](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@Jeremiah\_Brown1](https://forum.inductiveautomation.com/u/Jeremiah_Brown1)\ **Post date:** [November 17, 2022, 8:40pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643/7 "2022-11-17T20:40:11Z")
Thanks for all the responses. Are any of the AD Internal/Hybrid systems being used with Azure Active Directory? ---
**Author:** ![witman](https://avatars.discourse-cdn.com/v4/letter/w/d2c977/32.png) [@witman](https://forum.inductiveautomation.com/u/witman)\ **Post date:** [November 17, 2022, 11:47pm UTC](https://forum.inductiveautomation.com/t/user-source-vs-identity-provider-with-active-directory/66643/8 "2022-11-17T23:47:09Z")
Yes, the Internal/Hybrid AD accounts I mentioned are through MS365.