<\/div>\n\n\n\n
In WatchGuard Cloud, go to Configure > Directories and Domain ServicesAdd Authentication Domain<\/strong>.<\/p>\n\n\n\n<\/p>\n\n\n
\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Choose WatchGuard Cloud Directory<\/strong>, then click Next.<\/p>\n\n\n\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Confirm that you want to create the directory.<\/p>\n\n\n
\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Create a Group<\/strong><\/p>\n\n\n\nAuthPoint uses groups to control which resources users can access. You must create at least one group before adding users.<\/p>\n\n\n\n
\nOn the Directories and Domain Services<\/strong> page, click your WatchGuard Cloud Directory<\/strong>.<\/li>\n\n\n\nOpen the Groups<\/strong> tab.<\/li>\n\n\n\nClick Add Group<\/strong>.<\/li>\n\n\n\nEnter a Group Name<\/strong> and click Save<\/strong>.\n\nThe group now appears in both the Cloud Directory and AuthPoint.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Prepare Active Directory<\/strong><\/p>\n\n\n\n\nIn your AD server, create example a AuthPoint-Users group.<\/li>\n\n\n\n Add all users who need Windows MFA logon access to this group.<\/li>\n\n\n\n Make sure every user has a valid email address in their AD account.\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Install the AuthPoint Gateway<\/strong>only<\/strong> used for syncing users \u2014 not for RADIUS or LDAP authentication.<\/p>\n\n\n\n\nIn AuthPoint Cloud:\n\nGo to Gateway<\/strong><\/li>\n\n\n\nClick Add Gateway<\/strong><\/li>\n\n\n\nEnter a name and click Save<\/strong><\/li>\n\n\n\nOpen the Gateway tile and click Registration Key<\/strong><\/li>\n\n\n\nClick Save<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n\n\n\t\t\t\n\t\t\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
\nGo to Downloads \u2192 Gateway Installer<\/strong> and download the installer.<\/li>\n\n\n\nRun the installer on any server that:\n\nHas Internet access.<\/li>\n\n\n\n Can reach your AD\/LDAP server.<\/li>\n\n\n\n In this example, the Gateway is installed on the Domain Controller.<\/em><\/li>\n\n\n\nInstall Java<\/strong> before installing the Gateway.\n\nRecommended: Amazon Corretto 11 or 21<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\nPaste the Registration Key<\/strong> into the installer.<\/li>\n\n\n\nClick Install<\/strong>, then Finish<\/strong>.<\/li>\n\n\n\nIn AuthPoint Cloud, check the Gateway status icon.\n\nGreen<\/strong> means the Gateway is online and working.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
\n\n\t\t\t\n\t\t\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Add an LDAP External Identity<\/strong>\nIn AuthPoint Cloud, go to External Identities<\/strong>.<\/li>\n\n\n\nClick Add External Identity<\/strong>.<\/li>\n\n\n\nSelect LDAP Configuration<\/strong>.<\/li>\n\n\n\nEnter a name.<\/li>\n\n\n\n In LDAP Search Base<\/strong>, enter your domain in LDAP format.\n\nExample: domain kita.local<\/em> \u2192 DC=kita,DC=local<\/li>\n<\/ul>\n<\/li>\n\n\n\nEnter the System Account<\/strong> and Passphrase<\/strong>.<\/li>\n\n\n\nEnter your AD domain name<\/strong>.<\/li>\n\n\n\nEnter the server address<\/strong> (IP of your AD server).<\/li>\n\n\n\nChoose LDAPS (636)<\/strong> or LDAP (389)<\/strong>.<\/li>\n\n\n\nLeave the other settings as default.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Connect the External Identity to the Gateway<\/strong><\/p>\n\n\n\n\nGo to Gateway<\/strong>.<\/li>\n\n\n\nClick your Gateway name.<\/li>\n\n\n\n In the LDAP<\/strong> section, select the external identity you created.<\/li>\n\n\n\nClick Save<\/strong>.<\/li>\n<\/ul>\n\n\n\n\n\n\t\t\t\n\t\t\t\t\n\t\t\t\n\t\t\t\tTo test the connection:<\/p>\n\n\n\n
\nGo to External Identities<\/strong>.<\/li>\n\n\n\nClick the menu next to your LDAP identity.<\/li>\n\n\n\n Select Check Connection<\/strong>.<\/li>\n<\/ul>\n\n\n\n
<\/div>\n\n\n
\n
<\/div>\n\n\n\n
Configure Group Sync<\/strong><\/p>\n\n\n\n\nSelect External Identities<\/strong> and from the navigation menu, select Group Sync<\/strong>.<\/li>\n\n\n\nClick Add New Group Sync<\/strong>.<\/li>\n\n\n\nIn LDAP Groups to Sync Users From<\/strong>, select the AD group.<\/li>\n\n\n\nCheck Create new synchronized group<\/strong>.<\/li>\n\n\n\nIn Select an AuthPoint Group to Add Users To<\/strong>, choose the group you created earlier in Directories and Domain Services<\/strong>.<\/li>\n\n\n\nIf you do not<\/strong> want AuthPoint to automatically create mobile tokens or send activation emails, clear those checkboxes.<\/li>\n<\/ul>\n\n\n\n
\n
\n\t\t\t\n\t\t\t\tNotes About Group Design<\/strong><\/p>\n\n\n\nThere is no \u201ccorrect\u201d or \u201cincorrect\u201d method. It depends on:<\/p>\n\n\n\n
\nHow your AD groups are organized<\/li>\n\n\n\n Whether you want to create new AD groups<\/li>\n\n\n\n Which resources you want to protect with MFA<\/li>\n<\/ul>\n\n\n\nStart the Synchronization<\/strong><\/p>\n\n\n\n\nSelect External Identities<\/strong> and from the navigation menu, select Start Synchronization<\/strong>.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\tYour AD users will now appear in the AuthPoint Users<\/strong> list as LDAP<\/strong> type. Depending on your Group Sync settings, users may belong to one or more AuthPoint groups.<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\tIf you left the default Automatically create a mobile token for this user<\/strong> enabled the user also receives email messages to activate a token in the AuthPoint mobile app.Automatically create a mobile token for this user<\/strong>, go to the AuthPoint Users <\/strong>list choose the user and click the three dots menu and select Add New Token<\/strong>.
![\"\"](\"http:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/06\/DDS-1.png\")