Directory management

Account management without leaving the service desk. Search for a user, change their licence, lock or unlock them, delegate a mailbox, reset their password.

Distinct from the LDAP connector, which authenticates and resets passwords. This one is about administering accounts.

Category	Directory
Authentication	Client credentials
Reaches	Your identity provider
Needs an agent	Depends on the provider
Demo mode	Yes, on by default

Capabilities

directory.searchUsers, directory.getUser, directory.setLicense, directory.setAccountEnabled, directory.delegateInbox, directory.resetPassword

Which lights up the directory page, gated by the module.directory module and the directory.view and directory.manage permissions.

Demo mode is on by default

Unusually, this connector ships with demoMode set to true.

Locking an account, resetting a password and opening somebody else’s mailbox are not things to do by accident while you are still setting the connector up.

Explore the workflow against built-in sample data, then turn demo mode off when the real credentials are in.

Registering the application

The exact steps depend on your provider. For Microsoft Entra, which is the most common:

1. Entra admin centre, Applications, App registrations, New registration. Name it Plugboard directory.

2. Note the Application (client) ID.

3. API permissions, Microsoft Graph, Application permissions. Add only what you will use:

   Permission	For
   User.Read.All	Search and read users
   User.ReadWrite.All	Lock, unlock and update
   Directory.ReadWrite.All	Licence assignment
   Mail.ReadWrite or full_access_as_app	Inbox delegation
   UserAuthenticationMethod.ReadWrite.All	Password reset

4. Grant admin consent.

5. Certificates and secrets, New client secret. Copy the Value.

Caution

This is a powerful application registration. Password reset and mailbox delegation are effectively account takeover capabilities. Grant only the permissions matching the actions you actually intend to use, and review the registration when you review anything else.

Configuring it in Plugboard

Admin, Connectors, Active Directory, Configure.

Settings

Field	Default	Value
tenantDomain		Your primary domain, for example school.nsw.edu.au
demoMode	true	Use built-in demo data, making no live API calls

Credentials

Field	Value
clientId	The application (client) id
clientSecret	The client secret value

Save and test, then turn demoMode off.

What you can do from the desk

Action	Notes
Search for a user	By name or username
See assigned licences	And what each one is
Change a licence	Assign or remove
Lock or unlock	Enable or disable sign-in
Delegate a mailbox	Grant another person access to an inbox
Reset a password	Subject to your provider’s policy

Every action can be ticketed

Before performing any of these, you can link it to an existing submission or ticket, or create a new one.

This is the feature that makes the whole thing defensible. “Please give Sarah access to Tom’s mailbox while he is on leave” becomes a ticket with a requester, an approver, a timestamp and an action, rather than a Teams message and a change nobody can account for six months later.

Use it. One extra click, and the change is accounted for instead of unexplained.

Auditing

Every directory action is written to the audit log with who did it, to whom, and what changed. That is separate from, and in addition to, your identity provider’s own audit trail.

Permissions

Permission	Allows
directory.view	Search and read accounts
directory.manage	Everything that changes something

Split these across roles. Plenty of technicians should be able to look somebody up without being able to reset their password. See roles and permissions.

Troubleshooting

Symptom	Cause
Sample users appear	demoMode is still on
401 on test	Wrong secret, or the Secret ID was copied instead of the Value
403 on a specific action	The matching Graph permission was not granted, or consent was not given
Search works, licence change fails	Directory.ReadWrite.All is missing
Password reset fails	UserAuthenticationMethod.ReadWrite.All is missing, or the target is an administrator, which Entra protects separately
Mailbox delegation fails	The mail permission is missing, or the mailbox is not in this tenant
Actions do not appear at all	module.directory is off, or your role lacks directory.manage