User Synchronization

User accounts in MyQ X can be created manually or imported from an external identity source. For most managed environments, synchronization is preferable because it keeps user data aligned with the organization’s directory, supports group-based configuration, and reduces ongoing administration.

Plan synchronization together with job detection and user authentication. The username or alias imported into MyQ must match the identity detected in print jobs, while mapped cards, PINs, and other credentials must support the selected authentication methods.

Before configuring a synchronization source:

1. Confirm how MyQ identifies users in incoming print jobs.

2. Decide which users and groups should be imported.

3. Identify the attributes that will populate MyQ usernames, aliases, personal numbers, email addresses, credentials, and other properties.

4. Decide how users will authenticate to MyQ.

5. Determine which system will control user creation, updates, group membership, and deactivation.

Supported Synchronization Sources

MyQ X can import users from the following sources:

MyQ can communicate with up to five LDAP servers simultaneously. Consider this limit when planning multiple LDAP synchronization or authentication sources.

Active Directory

Active Directory synchronization uses LDAP or LDAPS.

MyQ uses sAMAccountName as the username for users synchronized from Active Directory. This mapping cannot be changed. The default mappings also include:

Other properties, including aliases, personal numbers, notes, language, user storage, cards, and PINs, can be mapped where required.

If MyQ detects a user’s print jobs by their user principal name rather than sAMAccountName, map userPrincipalName to the MyQ alias property. MyQ can then associate either identity with the same user account.

User Home Folders

If users have individual home folders, their storage path can be synchronized to the MyQ User Storage property. This allows supported terminal workflows to use the storage location associated with the signed-in user.

Map the appropriate Active Directory attribute containing the complete storage path. Confirm that the resulting path is reachable from the systems and accounts that will use it.

Transforming Attribute Values

Some organizations store several values in one directory attribute. For example, an attribute might contain both a card number and a personal number:

288373;736

MyQ can apply a regular expression transformation during synchronization to extract or reformat the required value.

See Transform User Data with RegEx.

Sensitive Attributes

If cards, PINs, personal numbers, or other sensitive values are stored in Active Directory, review access to the source attributes before synchronizing them.

Standard Active Directory attributes may be readable by authenticated domain users. Where necessary, use appropriately protected attributes and grant read access only to the directory account used by MyQ. Test directory schema or permission changes before applying them in production.

Microsoft Entra ID

MyQ supports two methods of synchronizing Microsoft Entra ID users:

• Microsoft Graph

• LDAPS through Microsoft Entra Domain Services

Use Microsoft Graph when users are managed in Entra ID and LDAP compatibility is not specifically required. This method supports cloud-only and hybrid identities without deploying Microsoft Entra Domain Services.

Use Entra Domain Services only when the deployment specifically requires LDAP access to Microsoft cloud identities. Entra Domain Services is a separate paid Microsoft service and must be configured for Secure LDAP before MyQ can connect to it.

Microsoft Graph Preparation

Before configuring Microsoft Graph synchronization, connect MyQ X to Microsoft Entra ID. The Entra application must have permission to read the required users, groups, and directory attributes.

User Identity

For users synchronized through Microsoft Graph, MyQ uses the user principal name as the username. This cannot be changed.

In hybrid environments, additional on-premises attributes may also be available in Entra ID. If print jobs contain a sAMAccountName-style identity rather than the user’s UPN, map onPremisesSamAccountName to the MyQ alias property.

The attributes available through Microsoft Graph depend on the user and the organization’s identity configuration. Confirm that the required attributes are populated before relying on them for job detection or authentication.

Entra-Joined Devices

On Microsoft Entra-joined Windows devices, the identity submitted with a print job may not match the user’s UPN.

MyQ can create a normalized alias from the user’s Entra display name to help match these jobs. Consider using this option only when testing shows that jobs are identified by the normalized display name rather than by UPN.

Normalized aliases are limited to 20 characters. They may not uniquely identify users who have the same or similar display names. Test the resulting values before using them in production.

Synchronization and Authentication

Synchronization and authentication are separate functions.

Microsoft Entra ID can be used only as the source of user data while users authenticate through another method. Alternatively, the Entra connection can also be assigned as the authentication server for synchronized users.

When Entra ID is used for authentication, users authenticate with their Microsoft identities and are subject to the authentication policies configured for those accounts.

Other Sources

Google Workspace

Google Workspace synchronization uses Google’s Secure LDAP service. Secure LDAP must be enabled in Google Admin, and MyQ must be configured as an LDAP client.

Each MyQ server instance requires the appropriate client certificate. Plan for certificate renewal and allow for possible delays while changes to LDAP client permissions propagate through Google Workspace.

OpenLDAP

OpenLDAP uses the standard LDAP synchronization source.

Default OpenLDAP limits may restrict a query to a maximum number of entries or impose a query time limit. Review these settings before synchronizing a large directory.

When OpenLDAP is also used for authentication, the full login identity required by the directory can be synchronized as an alias. If users require a shorter identity for terminal login, plan an additional alias mapping.

Novell and Lotus Domino

Novell uses the standard LDAP synchronization workflow.

Lotus Domino synchronization is intended for existing legacy deployments. It is not available for new deployments unless explicitly enabled.

CSV

CSV import can be used when:

• No supported directory connection is available.

• Users need to be imported once rather than synchronized regularly.

• An external system can generate a recurring import file.

• Additional values must be added to users synchronized from another source.

For example, a CSV import can supplement LDAP-synchronized accounts with aliases that are not available in the directory.

When combining CSV with another synchronization source, plan how existing users will be matched and which source will control each property. Incorrect matching can create duplicate accounts or update the wrong users.

Validate User Lifecycle Behavior

Synchronization can create and update users, change group membership, change default accounting groups, and deactivate accounts. Test these effects before treating an identity source as authoritative for MyQ users.

A user can disappear from synchronization results because:

• The account was deleted or disabled in the source.

• The user was moved outside the selected synchronization scope.

• A directory filter no longer matches the user.

• The synchronization account can no longer read the user or a required directory branch.

• A connection or directory query failed.

• The synchronization configuration was changed incorrectly.

A missing user in the synchronization result does not therefore always mean that the user has left the organization.

Synchronization-Source Ownership

When several sources are used, decide which source owns each user population and which source is allowed to update existing accounts.

Document:

• Which source creates each group of users.

• Which source controls usernames and aliases.

• Which source controls group membership.

• Which source controls cards, PINs, and other imported credentials.

• Which source is allowed to deactivate users.

• How users present in more than one source will be matched.

For complex environments, see Multi-domain and Multi-tenant Environments.

Deactivating Missing Users

The Deactivate missing users option deactivates previously synchronized users who are no longer present in the source results.

Initially leave this option disabled. Enable it only after confirming that the Base DN, filters, permissions, connection, and imported population are correct.

Use particular caution when combining Deactivate missing users with Ignore synchronization source. With both options enabled, the synchronization can affect users created or imported by other sources when they are not present in the current synchronization result.

Use this combination only when the current source is intended to be authoritative for all affected users.

Username Changes

When a username changes in the source, MyQ must be able to associate the new identity with the existing account. Otherwise, synchronization can create a second user.

Where username changes are expected, map a stable and unique personal number and use it to pair users. Verify that the selected value:

• Is present for every synchronized user.

• Is unique across all sources.

• Does not change when the username changes.

• Is never reassigned to another person.

Test a representative username change before relying on this behavior in production.

Validate the Initial Synchronization

Test synchronization with a limited population before importing the complete production directory.

1. Use a test group, organizational unit, Base DN, or source filter.

2. Include representative users with the required attributes and group memberships.

3. Keep automatic deactivation of missing users disabled.

4. Run the synchronization manually.

5. Review the synchronization log and any reported conflicts.

6. Verify usernames, aliases, personal numbers, email addresses, cards, PINs, language, and user storage as applicable.

7. Verify imported groups, group memberships, and default accounting groups.

8. Send test jobs from representative client and driver environments.

9. Test user authentication if the identity source will also be used as an authentication server.

10. Test a username change, group-membership change, and removal from the synchronization scope.

11. Expand the synchronization scope only after the results are correct.

Schedule Synchronization

Directory synchronization is periodic rather than continuous. It can be run manually or scheduled using the MyQ task scheduler.

A daily synchronization is typical for most organizations. If user provisioning or deactivation must follow directory changes more quickly, choose a frequency that meets the organization’s operational and security requirements.

The Delta synchronization option enables you to run a lightweight Microsoft Entra ID (Graph API) synchronization periodically, to keep the user data up to date (default: every 10 minutes).

Before enabling a schedule:

• Complete the initial synchronization validation.

• Confirm which source controls user deactivation.

• Verify that the directory or application account will remain valid.

• Establish monitoring for failed or unexpected synchronization results.

• Consider the effect of directory maintenance or temporary connectivity failures.