Sync newly created AD account immediately

hi all,

I can see the API to sync the directory requires a username be given (as per, to sync that specific user.

The scenario I have though is this, an AD user has just been created and I want to sync this user into Duo immediately (rather than wait 24hrs). Via the GUI you can achieve this by hitting the ‘sync directory now’ button for your configured active directory, but how do we achieve this programmatically?

What are others doing to solve this?

If the username you specify doesn’t already exist in Duo, but matches the value of the source directory attribute you configured as the username attribute for the sync, it will create the user.

  1. Create new user kav in AD and make the user a member of the group configured in the Duo AD sync.
  2. Run an individual sync from the Admin Panel or with the Admin API for username kav.
  3. Sync finds kav in the source AD directory and imports that new user into Duo. The API response indicates the user was added and includes the new user’s Duo values.

From the AD Sync info linked from the description of the sync user API endpoint:

When initiated, the individual user sync verifies that each specified user is a member of a group currently synced with Duo and then imports information for that user into Duo. If a specified user doesn’t already exist in Duo, the sync creates them using the information imported from the source directory.

If you don’t know the new username though, you can’t specify it during an individual sync. If that’s your use case, you might be interested in a delta sync (to only import changes, as opposed to a full sync). Please contact your Duo Account Executive or Customer Success Manager (if you have one) or Duo Support (if you don’t) to add your support for the delta sync feature request, or for the feature request for management of full sync via Admin API (if that interests you as well).

Ah amazing, thank you Kristina! That makes sense :slight_smile:

Regarding the delta sync via API, I asked support for it as a feature request already.

1 Like