Real-time
Two-way sync
Changes in Active Directory or Salesforce instantly reflect in both systems. No stale data, no manual imports.
Security and identity ⇄ CRM
Active Directory to Salesforce integration — real-time, two-way sync
Keep Active Directory and Salesforce in sync without custom scripts. Cut weeks of integration work, eliminate silent data drift, and give your team a single, reliable source of truth.
- SOC 2 and 6 other compliance frameworks
- POC with real engineers in minutes
Adopted by fast-scaling companies moving mission-critical data in real time
Case study
Migrated from MuleSoft
Case study
Migrated from Celigo
Migrated from Heroku Connect
Migrated from Matillion
Case study
Migrated from Fivetran
Case study
Migrated from Celigo
Why teams connect Active Directory and Salesforce
Keep the people Salesforce and Active Directory both track in agreement in real time: the internal users who own records in Salesforce, and the customer login accounts in Active Directory.
A CRM and an identity system usually describe different populations. Salesforce tracks customers, contacts, and the deals in motion; Active Directory governs who is allowed to sign in and what they can reach. Where the two meet is people. The reps who own records in Salesforce are the same employees Active Directory provisions and disables, and when Active Directory also runs the login accounts for your product, the customers in Salesforce are the same users Active Directory authenticates. Left unconnected, a departure in Active Directory leaves stale ownership sitting in Salesforce, and a signup in Active Directory never reaches the account it belongs to.
Stacksync syncs Tasks and Events, Products and Price Books, Custom Objects, Accounts in Salesforce with Organizational units, Organizational contacts, Users, Groups in Active Directory in real time and in both directions, matching on email or an external ID and mapping field by field. You decide which system owns which fields, and new users, role and group changes, deactivations, and account status move within seconds instead of waiting on a quarterly access review or a manual export.
Common use cases
- 01 Consolidate multiple Salesforce orgs into a single database for cross-org reporting after an acquisition.
- 02 Sync Accounts, Contacts, and Opportunities bi-directionally with Postgres so engineering teams read and write CRM data with plain SQL.
- 03 Read Users, Groups, and directoryRole assignments into a warehouse for periodic access reviews and SOC 2 audit evidence.
- 04 Keep security-group memberships aligned with application entitlement tables so access reflects the right teams as they change.
Common sync patterns
Where Active Directory runs customer login accounts: identity on the customer record
Signup, account status, multi-factor enrollment, and last-login from Active Directory land on the matching contact or account in Salesforce, so go-to-market teams see who has actually activated and who has gone dormant.
Group and entitlement membership as CRM fields
Membership of a directory group or an entitlement in Active Directory maps to fields in Salesforce, such as product tier, plan, or internal team, so segmentation reflects real access rather than a manual guess.
Where a closed deal should provision access: Salesforce drives Active Directory
A won or activated customer in Salesforce can create or update the corresponding user or account in Active Directory, so provisioning starts from the CRM record instead of a separate ticket.
What you can sync between Active Directory and Salesforce
Representative objects on each side — any object or custom field can map to any target. Schemas are auto-detected; types are converted between the two systems.
| Active Directory objects | Salesforce objects | How this pairing syncs | |
|---|---|---|---|
| Service principals & applications App registrations and enterprise apps; read-mostly for entitlement and license inventory. | Campaigns Marketing membership data; read out for attribution analysis in the warehouse. | Service principals & applications is specific to Active Directory and Campaigns to Salesforce — each maps to any object or custom field on the other side. | |
| Organizational units On-prem AD DS containers (LDAP organizationalUnit) used to scope which users and groups a sync includes. | Tasks and Events Activity records; usually read-only in syncs to feed activity reporting. | Organizational units is specific to Active Directory and Tasks and Events to Salesforce — each maps to any object or custom field on the other side. | |
| Organizational contacts Directory contact objects (orgContact); synced for shared address-book and CRM person records. | Products and Price Books Catalog and pricing data; commonly mastered in an ERP and written into Salesforce. | Organizational contacts is specific to Active Directory and Products and Price Books to Salesforce — each maps to any object or custom field on the other side. | |
| Users User accounts in Entra ID and on-prem AD DS; synced two-way to create, update attributes, and enable or disable accounts. | Custom Objects Org-specific tables with the __c suffix; discoverable via describe metadata so field mappings can be generated. | Users is specific to Active Directory and Custom Objects to Salesforce — each maps to any object or custom field on the other side. | |
| Groups Security and Microsoft 365 groups; synced two-way including name, type, and owner, with membership tracked separately. | Accounts Company records that anchor most syncs; typically mapped to customer tables in a database or ERP. | Groups is specific to Active Directory and Accounts to Salesforce — each maps to any object or custom field on the other side. | |
| Group memberships Member and owner links between users and groups; membership add/remove changes are surfaced by delta query. | Contacts People linked to Accounts; synced two-way with marketing, support, and warehouse person records. | Group memberships is specific to Active Directory and Contacts to Salesforce — each maps to any object or custom field on the other side. |
How changes propagate between Active Directory and Salesforce
Each direction of the sync is driven by what the source system can signal and what the destination accepts — detection, delivery, and expected latency below.
Active Directory Salesforce Sub-second propagation
DetectionActive Directory notifies Stacksync of record changes through webhook events. Microsoft Graph delta query (change tracking) for Users and Groups, plus change-notification subscriptions (webhooks) for near-real-time triggers.
DeliveryEach detected change is written to Salesforce through its API, with automatic retries and rate-limit backoff.
Salesforce Active Directory Sub-second propagation
DetectionChanges in Salesforce are captured at the source via change data capture — no polling loop against its API. Apex triggers are used whenever possible (Salesforce actively notifies Stacksync via an Apex trigger + callout class + remote site setting).
DeliveryEach detected change is written to Active Directory through its API, with automatic retries and rate-limit backoff.
Rate-limit considerations
- Active Directory: Graph throttles by resource-unit cost per app per tenant in 10-second windows (about 3,500–8,000 units by tenant size); directory delta tokens expire after ~7 days.
- Salesforce: Daily API request allocations vary by edition and license count.
What ships with Active Directory ⇄ Salesforce
Connect Active Directory and Salesforce for flexible, real-time data sync.
Real-time sync, workflow automation, event queues, EDI, and monitoring, for every Active Directory–Salesforce connection.
No-code + pro-code
Workflow automation
Trigger automated workflows whenever Active Directory or Salesforce data changes, update records, fire webhooks, or kick off sequences without brittle API scripts.
At scale
Event queues
Handle millions of events per minute without losing a single Active Directory or Salesforce record.
Observability
Monitoring
Track your Active Directory ⇄ Salesforce sync health, view errors, and replay failed events in one click.
Trading partners
EDI
Transform legacy EDI complexity into simple database interactions between Active Directory and Salesforce.
How the Active Directory and Salesforce connectors work
Active Directory
- Integration surface
- Microsoft Graph REST API (Entra ID / cloud) and LDAP/LDAPS (on-premises AD DS)
- Authentication
- OAuth 2.0 via the Microsoft identity platform — an app registration with application or delegated permissions (e.g. User.ReadWrite.All, Group.ReadWrite.All) and admin consent; on-prem AD DS uses a bound service account over LDAPS.
- Change detection
- Microsoft Graph delta query (change tracking) for Users and Groups, plus change-notification subscriptions (webhooks) for near-real-time triggers; on-prem AD DS uses the DirSync control and uSNChanged polling.
- Capabilities
- read · write · webhooks
- Rate limits
- Graph throttles by resource-unit cost per app per tenant in 10-second windows (about 3,500–8,000 units by tenant size); directory delta tokens expire after ~7 days.
Salesforce
- Integration surface
- REST, SOAP, and Bulk APIs
- Authentication
- OAuth login via a Salesforce user (browser-based authorization flow); requires "API Enabled" permission for polling mode, plus "Author Apex" and "Customize Application" OR "Modify All Data" for trigger mode
- Change detection
- Apex triggers are used whenever possible (Salesforce actively notifies Stacksync via an Apex trigger + callout class + remote site setting)
- Capabilities
- read · write · CDC
- Rate limits
- Daily API request allocations vary by edition and license count.
How it works
How to connect Active Directory to Salesforce — three steps, no code
Configure and sync within minutes, no code. Whether you sync 50k or 100M+ records, Stacksync handles the queues, infra, and plumbing. Integrations are non-invasive and need zero setup on your systems.
- 01
Connect your apps
Authenticate Active Directory and Salesforce with each platform's native method — OAuth, API keys, or service accounts — plus secure options like SSH tunneling, IP whitelisting, and VPC peering.
Active Directory
connected
Salesforce
connected
OAuth 2.0SSH tunnelSSL certificateVPC peering - 02
Choose tables
Pick the Active Directory and Salesforce objects to sync — Stacksync auto-detects both schemas, including custom fields where the platform exposes them. Sync to existing tables, or let Stacksync create new ones with ideal data types.
objects · Active Directory ⇄ SalesforceCustomers 12,480Sales Orders 8,213Invoices 5,902Items 1,344 - 03
Map fields
Fields map automatically even when names and types differ. Stacksync handles transformation and type casting for you, zero configuration required.
Active Directory SalesforceCompany company_name textEmail email textAmount amount numericCreated created_at timestamp
FAQ
Active Directory and Salesforce integration FAQ
-
Yes. Stacksync provides a managed, real-time two-way integration between Active Directory and Salesforce: authenticate both systems, choose the objects to sync (such as Active Directory's Service principals & applications and Organizational units), map fields visually, and changes propagate both ways in milliseconds — no code required.
-
Yes — Stacksync ships production-grade connectors for both Active Directory and Salesforce. The connectors handle authentication, schema detection, rate limits, and retries; you configure the sync, and Stacksync operates it.
-
Change detection on Active Directory: Microsoft Graph delta query (change tracking) for Users and Groups, plus change-notification subscriptions (webhooks) for near-real-time triggers; on-prem AD DS uses the DirSync control and uSNChanged polling. On Salesforce: Apex triggers are used whenever possible (Salesforce actively notifies Stacksync via an Apex trigger + callout class + remote site setting). Each detected change propagates to the other side in milliseconds, with field-level conflict resolution and an inspectable event log.
-
On the Salesforce side: Tasks and Events, Products and Price Books, Custom Objects, Accounts, plus custom fields where Salesforce exposes them. On the Active Directory side: Organizational units, Organizational contacts, Users, Groups. Stacksync auto-detects both schemas and converts types between the two systems.
-
Yes. Each object mapping can be bidirectional or restricted to a single direction (both systems accept writes). Read-only mirrors, one-way pushes, and full two-way sync can be mixed in the same integration.
-
Common patterns for Active Directory and Salesforce: Where Active Directory runs customer login accounts: identity on the customer record; Group and entitlement membership as CRM fields; Where a closed deal should provision access: Salesforce drives Active Directory. Signup, account status, multi-factor enrollment, and last-login from Active Directory land on the matching contact or account in Salesforce, so go-to-market teams see who has actually activated and who has gone dormant.
SECURITY
Security teams trust Stacksync
As a data company, we understand the importance of keeping your data secure. Stacksync is built with security best practices to keep your data safe at every layer, and is DPF-certified for US, EU, UK and CH data transfers.
SOC 2 Type II
ISO 27001
HIPAA BAA
GDPR
CCPA
DPF US-EU-UK-CH
→ SECURITY WITH BENEFITS
SSO & SCIM
Let your users access Stacksync from your centralized user management systems. Works with Okta, Azure, Google SSO and more.
Alerts
Immediately get alerted about record syncing issues over email, Slack, PagerDuty and WhatsApp. Resolve issues from a centralized dashboard with retry and revert options.
Secure connection options
Securely connects to your systems with:
Related integrations
Every pair below is a real-time, two-way sync. Search all 535 integrations available for Active Directory and Salesforce.
Popular · 7 of 535
-
Active Directory ⇄ Seismic -
Active Directory ⇄ Xactly -
Active Directory ⇄ Gong -
Salesforce ⇄ Jumpcloud - Salesforce ⇄ Azure Active Directory
-
Salesforce ⇄ Okta -
Salesforce ⇄ Onelogin
No integrations match .
