Skip to main content

Active Directory

Authnull adds MFA, conditional access, and privileged-access controls to Active Directory without changing how your users or applications authenticate today.

Everything starts from the Identity Providers screen (Admin → Directory → Identity Providers), where you register each AD domain and EntraID source, watch their connection and sync status, and enable MFA.

How it fits together

An AD integration has two parts:

  1. A registered directory — the connection details for a Domain Controller (domain, DC host, service account, sync filters). This is what you create in the Connect Active Directory wizard.
  2. A sensor on the Domain Controller — the Authnull component that reads authentication activity and enforces policy in real time. You deploy it in the Install DC Sensor step.

Once the sensor connects, the directory shows as Running on the Identity Providers list and begins syncing users, groups, and OUs according to your sync filters. From there you define enforcement with AD Policies.

Your users & devices
│ Kerberos / NTLM / RDP / SMB / LDAP

Domain Controller ──► Authnull DC Sensor
│ │
│ ├── Policy check (AD Policies)
│ ├── MFA push to the user's phone
│ └── Allow / Deny verdict

Active Directory (completes auth only on Allow)

Choose an enforcement model

ModelWhen to useWhere it runs
Agent / DC SensorStandard deployment — install the sensor on each Domain ControllerOn the DC
Agentless ADSame sensor, deep-dive on protocol coverage and enforcement internalsOn the DC

Both models use the same Connect AD → Install DC Sensor flow. The Agentless AD section is the architecture reference for how enforcement works across Kerberos, NTLM, RDP, SMB, and LDAP.

Get started

  1. Connect Active Directory — register your domain and DC connection
  2. Install DC Sensor — deploy the sensor on the Domain Controller
  3. Identity Providers — manage and monitor your directories
  4. AD Policies — define MFA and access enforcement