Synchronize Users from Active Directory

MyQ X synchronizes users from Active Directory (AD) using the LDAP protocol. The synchronization imports user accounts and group memberships, keeps them current as the directory changes, and maps the directory attributes that job authentication and terminal login depend on.

Guidance on when to use this source is provided in the Deployment guide. See User Synchronization.

Prerequisites

An Active Directory domain controller reachable from the MyQ server over LDAPS (port 636 recommended) or LDAP (port 389).
A service account in AD with read-only access scoped to the organizational units you intend to sync. No write access or elevated domain privileges are required.
If using LDAPS (recommended) the issuing root CA certificate must be installed in the Windows certificate store on the MyQ server so that it can verify the AD certificate. In managed environments this may already be handled by Group Policy.
DNS correctly resolves the AD domain from the MyQ server.

Key Considerations

Test job detection before configuring sync. MyQ always maps sAMAccountName to the username field for LDAP-synced users – this cannot be changed. If your job detection returns a different value, most commonly userPrincipalName in environments with Entra ID-joined or hybrid-joined devices, the match will fail unless that value is also present as an alias. Send a test job from an account that does not yet exist in MyQ and check the discard log entry (Job discarded. User "x" not found.) – the quoted value is exactly what your sync must place in the username or alias field. See Understanding Job Detection.

Multi-value fields require transformation. Some environments store multiple identifiers – an ID card number and a personal number, for example – in a single AD attribute separated by a delimiter. MyQ supports regex transformation in the sync source settings to parse these values. See Transform User Data with RegEx .

Multi-domain environments require domain appending. If users from multiple AD domains are synchronized into the same MyQ installation, the same sAMAccountName can exist in more than one domain. Enable Append the domain name to the username in each LDAP sync source to produce unique usernames in the format username@domain. For job authentication to work correctly, the domain must also be present in the print job. See Multi-domain and Multi-tenant Environments.

Schema extension is irreversible. If you plan to use custom schema extension attributes to protect sensitive values such as card numbers or PINs, test the schema change in a lab environment before applying it to production. Custom attributes added to the AD schema cannot be removed.

Configure the Authentication Server

Go to MyQ > Settings > Authentication Servers and add a new LDAP server for the AD domain. Set Security to SSL and the port to 636.

If a sub-domain service account is used, specify the sub-domain in the username field. For example, if the account Administrator resides in cz.testAD.local but connects to testAD.local, enter Administrator@cz.testAD.local.

Configure the Synchronization Source

Go to Settings > User Synchronization, click +Add, and select Add LDAP source.

For the full configuration reference, see Synchronize Users from LDAP. The following covers what is specific to Active Directory.

Default Attribute Mapping

MyQ applies these default mappings automatically for Active Directory sources. All other properties have no default and must be configured explicitly.

MyQ Property	Default AD Attribute
Username	`sAMAccountName`
Full name	`cn`
Email	`mail`

Properties commonly configured explicitly for AD:

MyQ Property	AD Attribute	Notes
Alias	`userPrincipalName`	Map here if job detection returns UPN rather than `sAMAccountName`.
Alias	`mailNickname` or `mail`	Map here if job detection returns email-format identifiers.
Personal number	`employeeId`	Useful for pairing users across sync sources, including during AD-to-Entra ID migration.
Card	Custom or `extensionAttribute`	Review confidential attribute protection before enabling – see Security Considerations.
PIN	Custom or `extensionAttribute`	Same consideration as Card.
User's storage	`HomeDrive`	Enables Easy Print from and Easy Scan to the user's home folder on embedded terminals.

Run and Schedule Synchronization

To run synchronization immediately, go to MyQ > Settings > User Synchronization, select the source, and click Synchronize now. If configured correctly, synced users and groups appear under MyQ > Users.

To synchronize automatically on a schedule, go to MyQ > Settings > Task Scheduler and configure the User Synchronization task.

Security Considerations

Use LDAPS

All LDAP communication between MyQ and AD should use LDAPS (LDAP over SSL/TLS) or StartTLS. Plain LDAP transmits credentials and directory data in cleartext. LDAPS can be enforced in the Authentication Server settings in MyQ.

Protect Sensitive Directory Attributes

Standard AD attributes are readable by any authenticated domain user by default. If ID card numbers, PINs, or other sensitive identifiers are stored in AD and will be synced to MyQ, mark those attributes as confidential before enabling the sync. Confidential attributes restrict read access to specified trustee accounts – the service account used by MyQ for synchronization would be granted trustee access.

For stronger protection, store sensitive values in custom schema extension attributes rather than standard attributes. Custom attributes are less predictable to enumerate and can also be flagged as confidential.

Apply Least Privilege to the Sync Service Account

The service account used for LDAP synchronization should have read-only access scoped to the organizational units being synced. If confidential attributes are used, the service account must be explicitly granted trustee access to those attributes only.

See also: