I do have a third party product (Jira) that has Active Directory integration via LDAP.

I want to enable Jira administrators to edit group memberships and have them syncronized inside Active Directory.

This currently works but I needed to use a Domain Administrator service account in order to do this.

The question is how can I do this without giving the entire Domain Administrator permission to the service account.


You can delegate administration to your service account in order to allow it to edit group membership, without giving it full Domain Admin rights. This can be done for a single group, for all groups in give OU, or for all groups in the whole domain,


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.