Identity & Access Management

On-prem Active Directory: Permissions

Customers need to set up a webhook based on their on-premise Active Directory (AD) environment to perform actions from Atomicwork. This guide explains the process, required permissions, and endpoint configuration.

Understanding the webhook requirement

The webhook must be provided by the customer according to their AD setup.
The endpoint and API vary for each customer.
The webhook requires access control, meaning specific permissions need to be granted to Atomicwork.

Steps to configure the webhook

Step 1: Identify the webhook endpoint

Determine the appropriate endpoint within your AD environment. This typically follows Microsoft's documented process for setting up webhooks with external services.

Step 2: Grant necessary API permissions

To enable Atomicwork to interact with AD for provisioning or synchronization tasks:

Grant access to the Inbound Provisioning API in Microsoft Entra ID.
Configure API permissions to allow external services, such as Atomicwork, to provision users and sync data securely.
Follow Microsoft's access control guidelines.

Permission	Description	Workflows / Actions	Permission type
User.ReadWrite	Read and update the signed-in user's profile	Allows users to manage their own account data, such as profile updates. Useful for self-service portals.	Delegated
User.Read.All	Read all user profiles in the directory	Required for reporting, auditing, or apps that list users. Needed for read-only access across organization users.	Application
User-LifeCycleInfo.ReadWrite.All	Read and write user lifecycle info, such as hire date	Enables automation of onboarding and offboarding processes. Required for HR integrations.	Application
User-Mail.ReadWrite.All	Read and write access to all users' mailboxes	Used for migration tools, compliance archiving, or automated email access by apps or services.	Application
User-PasswordProfile.ReadWrite.All	Reset passwords and manage user password settings	Required for password reset workflows, helpdesk tools, or automation of account recovery processes.	Application
User-Phone.ReadWrite.All	Read and update users' phone numbers	Enables management of MFA contact info, user phone sync from HR systems, or mobile-based workflows.	Application
User.EnableDisableAccount.All	Enable or disable user accounts	Critical for access control automation, such as disabling leavers or suspending compromised accounts.	Application
User.ManageIdentities.All	Manage user identities and federated or external identities	Used in B2B/B2C apps, federated identity systems, or hybrid AD setups. Enables complex identity tasks.	Application

Field	Value
On-prem AD attribute	`parentDistinguishedName`
API attribute	`urn:microsoft:onprem.distinguishedName`

On-prem Active Directory: Permissions

Understanding the webhook requirement

Steps to configure the webhook

Step 1: Identify the webhook endpoint

Step 2: Grant necessary API permissions

On-prem Active Directory: Permissions

Understanding the webhook requirement

Steps to configure the webhook

Step 1: Identify the webhook endpoint

Step 2: Grant necessary API permissions

Step 3: Configure the webhook and synchronization settings

Step 4: Provide endpoint details to Atomicwork

Step 5: Test and validate

Additional resources

On-prem AD permissions for Atomicwork

Additional permissions for removing users from Azure AD

Configure OU-specific provisioning