> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/identity-providers.md).

# Identity Providers

{% hint style="danger" %}
**Please note**: To use the new functionality, you must [update the Enginsight Loggernaut component](/docs/manual/english/installation-and-configuration/updates/enginsight-siem.md#updating-loggernaut) to **version 2.14.0 or later**.
{% endhint %}

***

Identity providers allow you to connect Enginsight to your Active Directory via LDAP or directly to Microsoft Entra ID.

This allows you to provide the SIEM with user and group information for analysis and further processing. You can also block Microsoft Entra ID ("Azure") users directly from within the Enginsight platform.

***

<i class="fa-compass">:compass:</i> Navigate to **SIEM** → **Identity Providers** to show a list of all identity providers. If you have not added an identity provider yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2F3ZKXukflQ0fN11lw3NP5%2Fenginsight-screenshot-siem-advanced%20settings-identity%20providers.jpg?alt=media&amp;token=8553ff2a-6b35-4698-b7f9-ae20789bf4c4" alt=""><figcaption></figcaption></figure>

The [identity provider overview](#identity-providers-overview) provides information such as:

* which directory service is connected through an identity provider.
* whether the replication of user and group information was successful.
* whether an identity provider is active.

You can also [add new identity providers](#add-identity-provider) and enable or disable existing identity providers.

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Further Actions for List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the respective item. Alternatively, select the checkbox in the table header to select all list items.

The number of selected list items is now shown next to the search field.

The <i class="fa-slider">:slider:</i> **Actions** menu also appears in the upper-right corner. Click it to expand the respective submenu. The following actions are available:

<table><thead><tr><th width="209.06640625">Action</th><th>Description</th></tr></thead><tbody><tr><td>Delete</td><td><p>Delete all selected objects.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Delete</strong> and confirm the prompt that appears by clicking <strong>Delete Irretrievably</strong>.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: Deleted items cannot be recovered.</p></div></td></tr><tr><td>Enable</td><td><i class="fa-eye">:eye:</i> This action is only available if all selected objects are inactive.<br><br>Enable all inactive objects.</td></tr><tr><td>Disable</td><td><i class="fa-eye">:eye:</i> This action is only available if all selected objects are active.<br><br>Disable all active objects.</td></tr></tbody></table>

***

## Identity Providers: Overview

The identity provider overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2Fw7vbruaVnAlyIsi4jWHc%2Fenginsight-screenshot-siem-advanced%20settings-identity%20providers%20overview.jpg?alt=media&amp;token=392b9c8e-c1e7-4d4c-a4ce-ad72f51965c8" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="200.03125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td><p>Shows the custom name of the identity provider, an additional description if provided, the date and time it was created, and the date and time it was last edited.</p><p></p><p>If replication is enabled, it also indicates whether replication was successful (<i class="fa-circle-check" style="color:green;">:circle-check:</i>) or unsuccessful (<i class="fa-circle-exclamation" style="color:red;">:circle-exclamation:</i>), how many users are included in the replication, and when the replication was last performed.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of an identity provider to navigate to the respective <a href="#identity-provider-edit-view">edit view</a>. Here you can adjust configured settings and delete the identity provider.</p></td></tr><tr><td>Type</td><td>Shows the source to which the identity provider connects and/or the type of connection.</td></tr><tr><td>Enabled</td><td>Shows whether an identity provider is active and the selected directory service is therefore connected to Enginsight.<br><br>An enabled identity provider is indicated by a green <strong>check</strong> icon <i class="fa-circle-check" style="color:green;">:circle-check:</i>. Disabled identity providers are indicated by a red <strong>circle</strong> icon <i class="fa-circle" style="color:red;">:circle:</i>.</td></tr></tbody></table>

***

## Adding an Identity Provider

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Add Identity Provider** in the upper-right corner to [add a new identity provider](/docs/manual/english/platform-usage/siem/advanced-settings/identity-providers/add-identity-provider.md).

***

## Identity Provider: Edit View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the name of an identity provider to navigate to the respective edit view. Here you can adjust [configured settings](/docs/manual/english/platform-usage/siem/advanced-settings/identity-providers/add-identity-provider.md#general-settings), view detailed information about replicated users, and delete the identity provider.

### Testing the Connection

<i class="fa-computer-mouse">:computer-mouse:</i> Click **Test Connection** in the upper-right corner to test the connection to the respective directory service. In the window that opens, confirm the message by clicking **Test Connection** to start the test.

<div align="left"><figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FIDEos8tdEkkOBDzljwGt%2Fenginsight-screenshot-siem-advanced%20settings-identity%20providers-test%20connection.jpg?alt=media&amp;token=5d488959-38fe-4a88-a06b-e771f3f44dec" alt="" width="375"><figcaption></figcaption></figure></div>

### Replication

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-layer-group">:layer-group:</i> **Replication** in the upper-right corner to view a list of all replicated users and whether they are active ( <i class="fa-circle-check" style="color:green;">:circle-check:</i> ) or blocked ( <i class="fa-circle" style="color:$primary;">:circle:</i> ).

<i class="fa-computer-mouse">:computer-mouse:</i> Click a replicated user to view additional details about that user as stored in the respective directory service.

### Refresh

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-arrows-rotate">:arrows-rotate:</i> **Refresh** in the upper-right corner to manually synchronize with the respective directory service.

{% hint style="info" %}
Automatic synchronization with the respective directory service is performed every 24 hours.
{% endhint %}

### General Actions

The following actions are available:

<table><thead><tr><th width="200.39453125">Option</th><th>Description</th></tr></thead><tbody><tr><td>Save Changes</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Save Changes</strong> after adjusting any settings.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Unsaved changes cannot be recovered.</p></div></td></tr><tr><td>Back</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Back</strong> to return to the list overview.</td></tr><tr><td>Remove</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Remove</strong>, then confirm the prompt that appears to delete the object that you are editing.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Deleted objects cannot be recovered.</p></div></td></tr></tbody></table>

***

## Further Resources

**Knowledge Base**

* [How do I create an identity provider for Microsoft Entra ID in the Enginsight SIEM?](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-create-an-identity-provider-for-microsoft-entra-id-in-the-enginsight-siem)

***