Setting up Bitrix24 integration with LDAP/Active Directory

Setting up Bitrix24 integration with LDAP/Active Directory

Imagine: in a company of 200 employees, the HR person adds a new employee to Active Directory, then separately creates an account in Bitrix24, manually adds them to the correct department and groups. When someone leaves—the same process in reverse. Six months later, there are 30 "dead" accounts in Bitrix24, and a new manager has been working for two weeks without CRM access—the request to create an account got lost. Every manual process wastes time and invites errors: forgot to create an account—the person can't work; forgot to disable—a departed employee still has access to CRM and documents. The LDAP integration we configure solves this: a single source of truth—Active Directory—and Bitrix24 synchronizes automatically. We have 8+ years of experience setting up LDAP integrations for on-premise Bitrix24 and guarantee stable operation.

Requirements and limitations

LDAP integration is only available for the on-premise version of Bitrix24. Cloud Bitrix24 does not support direct LDAP connections—for the cloud, use SSO solutions (SAML, OAuth). We strongly recommend using LDAPS (port 636) instead of unencrypted LDAP, as LDAPS reduces the risk of credential interception by a factor of about 100.

Required connection parameters:

Protocol comparison:

The service account should not be a domain administrator. Read rights on objects in the required OUs are sufficient.

How synchronization with Active Directory works

In Bitrix24 admin panel: Settings → LDAP servers → Add. Connection parameters:

• Server—address of the domain controller. For fault tolerance, you can specify multiple servers separated by spaces.
• Base DN—root container for user search. If users are in multiple OUs, configure multiple LDAP connections or use a higher-level Base DN.
• User filter—LDAP filter for selection: (&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))—active users, excluding disabled accounts.
• Field mapping—correspondence of LDAP attributes to Bitrix24 fields: sAMAccountName → login, mail → email, displayName → name, department → department, telephoneNumber → work phone.

All mappings are flexibly configured to your AD schema. We also prepare documentation for each field.

Synchronization of groups and departments

LDAP groups are mapped to Bitrix24 groups. A user added to the Sales group in AD automatically lands in the "Sales department" group in Bitrix24. Mapping is set in the LDAP server settings: group field memberOf, binding to Bitrix24 groups by name or ID.

Departments are synchronized by the department attribute or by OU structure. If AD has OU=Marketing,OU=Users,DC=company,DC=local, users from this container go to the "Marketing" department in Bitrix24.

Why automatic deactivation is important

The key task is to promptly block access for a departed employee. During synchronization, the LDAP connector checks the account status in AD:

• Account disabled (ACCOUNTDISABLE flag in userAccountControl) → user is deactivated in Bitrix24.
• Account deleted from AD → user is deactivated in Bitrix24 at the next synchronization.
• Account moved to the departed OUs → if the OU is not in the Base DN, the user is also deactivated.

Synchronization runs on a schedule via the cron agent of the LDAP module. Recommended interval: every 15-30 minutes. For critical cases (immediate blocking upon termination), manual synchronization or direct deactivation in Bitrix24 can be used.

We provide full schedule configuration and error notifications for synchronization failures.

What's included in the turnkey setup?

• LDAP server connection with encryption (LDAPS/STARTTLS)
• Mapping AD attributes to Bitrix24 profile fields
• Filters for selecting required users and excluding service accounts
• Synchronization of AD groups with Bitrix24 groups and departments
• Automatic deactivation upon blocking/deletion in AD
• Configuration of cron synchronization schedule
• Documentation of settings and synchronization algorithm
• Administrator training (optional)
• Technical support for 2 weeks after launch

How we guarantee stability

We test the integration in a staging environment before moving to production. We provide a verification checklist: all accounts synchronized, deactivation works, groups map correctly. In case of failure, prompt recovery. Our engineers hold 1C-Bitrix certifications and have experience with large domain structures (up to 10,000 users).

We will assess your project and propose a setup timeline from 2 to 5 days depending on complexity. Contact us for a consultation.