CalGroups AD Sync Guide

A knowledge base article about CalGroups AD Sync Guide provided by the UC Berkeley IT Service Hub - Knowledge Portal

The CalGroups - AD Sync feature allows you set your CalGroups group to automatically show up as a group in Active Directory.

Some things to know about the feature:

You must already have access to a CalGroups Org or App folder space as an admin
The maximum size of groups eligible to sync is 3500 members. If you need to sync groups larger than 3500, email calnet-admin@berkeley.edu with a separate request
Email calnet-admin@berkeley.edu with a request to enable sync to AD, and include the name of the folder space you want to enable syncing in
We will allow syncing for your admin group, which gives you control over syncing for any group in your folder space
Once you receive confirmation that your group has AD sync enabled, follow the instructions on How to Sync Your CalGroup to AD
Note: Special Purpose Accounts (SPAs) and CalNet Sponsored Guest Accounts do not sync to AD

How to Sync Your CalGroup to AD

More Actions

Edit Provisioning Info

CalGroups - AD Sync

Allow at least 15 minutes for changes that you make in CalGroups to be reflected in AD.

Syncing from CalGroups to AD will be “flat”. That means that synced group in AD will consist of only the direct and indirect members of the group. If you are syncing a nested group, you will NOT see the nested group IDs in the synced AD group.
Your CalGroup’s group ID (not the group name) will be synced to AD as the cn and the samAccountName. By default, the CalGroups group name and ID are the same but you have the ability to edit the CalGroup group ID. If you do so and your group name and group ID are different, please make sure that you’re looking for the group ID and not the group name in AD.
Once your group is synced to AD, you may use it to access resources in AD, like any other AD group.
Syncing will be faster if you create your group and add members before you sync it to AD.
If you change your CalGroups - AD sync to "No" from "Yes", that group will disappear in AD. If you switched the sync back to "Yes", that group will re-appear.
If you delete your group in CalGroups, that group will be deleted entirely in AD also.
Except for Title Code groups, all other official groups are synced to AD.
Note: Special Purpose Accounts (SPAs) and CalNet Sponsored Guest Accounts do not sync to AD.

If you have a group that's already synced, any member you add or delete will be reflected AD. Allow at least 15 minutes for the changes to occur.
As of now, you can sync groups of 350 members or less. Any update that would result in the total group membership to be greater than 350 will fail. For example, if you already have a group that’s synced with 100 members and then add another 400, none of the 400 members you added will be synced. The original members will still be synced, however.

Any group you sync to AD will be visible to anyone with an account in AD. If you need to obfuscate your group name, you can change the CalGroups group ID since it’s the group ID (and not the group name) that syncs to the cn and samAccountName in AD.