System requirements

Before you use Directory Sync, ensure you meet the following prerequisites and requirements.

Google account requirements

A Google Cloud or Cloud Identity account with:

• A super administrator or the Directory Sync Admin role in the Google Admin console

  For details, go to Prebuilt administrator roles.

• The Connector Admin role (that gives full access to data connectors) or a Data Connectors role in Google Cloud.

If you want help managing Directory Sync, you can give another admin the Manage Directory Sync Settings privilege in the Admin console. If you need another admin to be able to view but not update settings, you can give the Read Directory Sync Settings privilege to the admin.

External directory requirements

Use Directory Sync to connect with external directories (LDAP directories or cloud identity providers) and sync user and group data to your Google cloud directory. Directory Sync supports Microsoft Active Directory (AD) and Microsoft Azure Active Directory (Azure AD).

AD prerequisites

• A network connection between Google Cloud and your AD server. For details, go to Supported network connections.
• If your AD server is located on premises or hosted outside a Google Cloud environment, you need a connection between Google Cloud and the server using Cloud VPN or Cloud Interconnect.

AD requirements

• AD must support LDAPv3.
• An authorized username and password that has read access to your AD server (to read user and group objects).
• The following information from the AD server:
  • Host and port number
  • DNS server to resolve your AD host
  • TLS client certificate to encrypt data transfer between the AD server and Directory Sync
    

Azure AD requirements

A Microsoft admin account with the Global Administrator role.