Configure the Connection settings.

1. In Connection configuration, specify the domain or server (for example, lpadsync) or a domain controller to connect to instead of a domain (for example, lp-adsync-dc01.lpadsync.local)
2. In Credentials, choose one of the following:
   • Login as current user, to log in with current user credentials.
   • Specify credentials:, to add a username and password for a specific user.
3. In Base DN, choose one of the following:
   • Automatically discover from my Base DN, to automatically discover a Base DN. This is the root node under which all of your relevant user and group objects are located.
   • Specify Base DN, to specify a Base DN.
   Note: For optimal performance, it is recommended that all relevant users and their embedded groups be located under the specified Base DN.
4. When finished, click Update settings.

Configure the "When a user in Active Directory is detected" setting.

1. To provision LastPass user accounts with specific actions, choose one of the following options:

   Add the user in the Enterprise Console , but require approval

   Sync users between your Active Directory and LastPass, and place them in a "pending" status (and require manual approval for each) instead of immediately creating an account for each user.

   Automatically create user in LastPass

   Automatically create accounts for every new user, and send them an automated Welcome email containing a temporary password, and instructions to create their individual Master Password.

   Warning: This option must be selected if you are provisioning federated users using the LastPass Business integration with Active Directory Federation Services (AD FS).

   Do nothing

   No action will be taken.

Configure the "When a user in Active Directory is deleted" setting.

2. Free up the user license to be distributed to another user with one of the following options:

   Administratively disable the LastPass account

   The user account will continue to exist within your LastPass Business account, and the user will be unable to log in and use LastPass unless they are re-enabled.

   Remove from Enterprise account, but do not delete user

   Remove them from your LastPass Business account, however, it will convert the account into a LastPass free user, and all vault data within the account will remain accessible to the user.

   Automatically delete their LastPass account

   Completely delete the LastPass account and all of the data within the user's vault.

Configure the "When a user in Active Directory is disabled" setting.

3. Free up the user license to be distributed to another user with one of the following options:

   Administratively disable the LastPass account

   The user account will continue to exist within your LastPass Business account, and the user will be unable to log in and use LastPass unless they are re-enabled.

   Automatically delete their LastPass account

   Completely delete the LastPass account and all of the data within the user's vault.

   Remove from Enterprise account , but do not delete user

   Remove them from your LastPass Business account, however, it will convert the account into a LastPass Free user, and all vault data within the account will remain accessible to the user.

Configure the "When a user in Active Directory is removed from group in filter" setting.

4. The options for this setting decide what will happen to existing LastPass accounts that are not part of the filter group selected on the Sync configuration tab of the LastPass AD Connector. Free up the user license to be distributed to another user with one of the following options:

   Administratively disable the LastPass account

   The user account will continue to exist within your LastPass Business account, and the user will be unable to log in and use LastPass unless they are re-enabled.

   Automatically delete their LastPass account

   Completely delete the LastPass account and all of the data within the user's vault.

   Remove from Enterprise account , but do not delete user

   Remove them from your LastPass Business account, however, it will convert the account into a LastPass Free user, and all vault data within the account will remain accessible to the user.

   Do nothing

   No action will be taken.

5. When finished, click Update settings.

Configure your Sync settings.

1. Configure the following options:

   Sync user's full name from AD

   Sync the full name of each user to appear in LastPass when enabled. By default, LastPass only lists users by their username (that is, email address).

   Create groups in LastPass

   If a group exists in Active Directory but not in LastPass, enabling this option will create these groups in LastPass. If you are creating groups in LastPass based on your Active Directory, any existing groups in LastPass will be removed and replaced with the specified Active Directory Groups.

   Sync search interval

   Force the AD Connector to check for and make changes in a cycle according to the designated time interval (between 5-3600 seconds).

2. In Filter users based on group membership:, set the following:
   • You must specify at least one group within this section in order to proceed with the setup process, even if you do not plan on using groups within LastPass. If a group is not specified, you will encounter a "Login failed" error message.
   • Click Browse and Search to easily navigate within your connected Active Directory groups, and select only the groups that you would like to sync. If you have added user group(s) that you decided you do not want to sync, click to select the group, then click Remove selected groups.
   • Limit which users are added to your business account by specifying a sync filter within the AD Connector. This field should be populated with the DN string of the group you would like to filter. A good source for an accurate DN string is through the use of the ADSI Edit tool. When adding multiple groups to sync filters, use the full DN strings in the following format:

     CN=LastPass,OU=Groups,OU=USA,DC=yourdomain,DC=com|CN=LastPass2,OU=Groups,OU=USA,DC=yourdomain,DC=com

Configure "User memberships" settings.

3. Choose from the following options:

   Sync all group memberships

   Sync all user groups within your Active Directory with your LastPass Business account.

   Use allowlist to filter groups

   Use Browse or Search to locate and select an umbrella group which directly contains the groups to be synced, however, the selected umbrella group itself will not be allowlisted.

   Include nested groups

   Check the box if you want all sub-groups within a group to be included while syncing (for example, if Group A includes Group B and Group B includes Group C, then Groups A, B, and C will be included). This allows you to consolidate user accounts, remove duplicate access, and automatically give site or shared folder access to nested groups.

   Sync only the groups specified in the Filter users section

   Use this setting with extreme caution. This option will only sync users within the groups specified in the Filter users based on group membership. If a user in your Active Directory loses membership in all specified groups, the disable/delete action you specified in your Actions settings is triggered, and could result in disabling or deleting users outside of your selected groups. For this reason, it is highly recommended that you select a group set that includes all users that should be synced to avoid unwanted actions when enabling this setting.

   Note:  Ensure that all relevant users, groups, and sub-groups are all located under the selected Base DN you specified in your Connection settings.

   Do not sync group memberships

   This option will not sync any user groups within your Active Directory with your LastPass Business account.

4. Excluded Groups:

   Use regular expressions to skip subgroups

   If you have enabled the Sync all group memberships, you can create a denylist to ensure specified group(s) will not be synced by entering the regular expression (that is, specific group name in your Active Directory). If there is a match for the given regular expression, then that group (and sub-groups if the "Include nested groups" option is enabled) will not be synced with your LastPass Business account.

5. Additional attributes to sync:

   Comma separated list:

   Specify an Active Directory user attribute name (for example, sAMAccountName) that you would like to sync with your LastPass Business account.

6. When finished, click Update settings.