Directory Sync FAQ

If you're syncing only users and groups, Directory Sync might satisfy your requirements.

If you're syncing objects in addition to users and groups (for example, Google Workspace licenses or shared contacts), you could consider using Directory Sync for the user and group sync and use GCDS for the other objects. However, if you're syncing both users and groups, you must use the same sync tool for both.

Review Compare Directory Sync with GCDS for more information.

Yes. You can use Directory Sync to sync users and groups and GCDS to sync other objects, such as shared contacts. We recommend using one tool to sync users and groups.

No, Directory Sync can't sync user passwords from external directories.

You don't have to do anything. 

Directory Sync retries the process for at least 7 days following the last successful sync. It attempts to restart syncing at least 9 times before canceling the process.

Yes, you can change the name of an external directory group. You need to take some extra steps if you have run a sync after adding the group in the User scope section of Directory Sync with the Suspend user in Google directory box checked. In this scenario, follow the instructions below to change the group name.

Note: If the scenario above doesn't apply to your setup, you can rename the external directory group without these additional steps.

1. Disable the sync.

   For details, go to Activate or deactivate a sync.

2. On the Directory details page, next to User sync, click Edit .
3. Enter the new group name and save the sync configuration.
4. In your external directory, rename the group.
5. In Directory Sync, under User Scope, remove the old group name and save the sync configuration.

If a group defined in the user scope is deleted in the external directory, the user in Google cloud directory remains active or suspended after a sync depending on your Deprovisioning setting. This action continues until you remove the group from the scope of the sync.

If you delete the group in the external directory and add it back with the same name, Directory Sync syncs the group as if it's a new group (because it has a new group ID).

For more information, go to Suspend users not found in the external directory.

Yes, you can use Directory Sync to sync users to a secondary domain.

Make sure the users' email addresses in your external directory match your secondary domain name. If you don't want to make changes to your existing mail attribute, use another attribute and assign the attribute when you set up the user sync. During a sync, Directory Sync creates the users in your Google cloud directory using your secondary domain as the primary mail address.

For more information, go to Replace the domain name for synced users.

No. Directory Sync doesn't sync data for admin users in Google Workspace.

If you need to sync admin users, consider using Google Cloud Directory Sync. For more information, go to About Google Cloud Directory Sync.

To simplify network configuration, we recommend that you create the Virtual Private Cloud (VPC) access connector in the same project as Cloud VPN or Cloud Interconnect. If you want to create the VPC access connector in a different project, use Shared VPC. For more information, go to Shared VPC overview.

Your LDAP server uses the Base DN as the starting point when searching for directory objects, such as users and groups. The narrower the scope of the Base DN, the better it performs when searching.

Examples

We recommend you use objectClass and objectQuery attributes to further narrow down your query. For details, go to Filter on objectCategory and objectClass.

Related topics

• LDAP considerations in ADDS performance tuning
• What Makes a Fast Query?

Yes, you can create up to 50 AD connections. The AD domain must be unique for each connection.

To improve search performance:

• Base DN–Adjust the base DN to make it as specific as possible. For example, if your users or groups are in an organizational unit hierarchy, use the search query to point to the parent of the hierarchy instead of the root organizational unit. Doing so ensures the LDAP search occurs in the specific organizational unit hierarchy instead of the entire directory.
• Scope–Consider the hierarchy level that is included in your LDAP query.

  In this example, your organization unit hierarchy is divided into regions (1st level) and countries (2nd level). If your users and groups are in the APAC organizational unit, set the scope of the LDAP query as One-level so that the query searches only the APAC unit (and not its 2nd level units). If you want to include the 2nd level organizational units in the search, set the scope to Sub-tree.

Related topics

• LDAP considerations in ADDS performance tuning
• What Makes a Fast Query?

Yes, you can only add one Microsoft Azure Active Directory connection.

• User scope–2,000 groups (a character limit of 100,000 in total for all groups)
• Group scope–400 groups (a character limit of 17,000 in total for all groups)