Permissions for managing mobile device objects in Active Directory

If you want to manage your mobile device objects in Active Directory, you need to delegate the necessary permissions to the Centrify Connector:

At least read permission to the container that has the Privileged Access Service user accounts.

A broader set of permissions on the container that has the registered device objects.

When you designate the registered device object container or organizational unit in the Device Registration Settings, you need to set the read permission and the permissions for the Active Directory user account for the container or organizations unit that stores the registered device objects. Repeat the second procedure for every container or organizational unit you use to store the registered device objects.

  1. Open Active Directory Users and Computers, select the user account container, and open the Properties.
  2. Select the Security tab and then click Add to add the user account you are using to run the connector service. Click OK after you add the user account.
  3. Click the user account in Group or User Names and click the Allow box for the Read permission.
  4. Click OK.
  1. Open Active Directory Users and Computers, select the registered device object container, and open Properties.
  2. Select the Security tab then the Advanced button to view the Advanced Security Settings.
  3. Click Add to add a new permission entry.
  4. Click Object Types and confirm that the object type for your connector is selected.
  5. Click OK.
  6. Navigate to Select User, Computer, Service Account, or Group window.
  7. Enter the first few characters of the object name into the object name text box then click Check Names.
  8. Select the object name for your connector and click OK.
  9. Select Allow for the Create Computer objects permission.
  10. Click OK.
  11. Click Add to add another permission entry.
  12. Click Object Types and confirm that the object type for your connector is selected.
  13. Select the object name for your connector and click OK.

    The Permission Entry for MobileDevices window opens.

  14. Click the Allow box for the following permissions on the Object tab:
    • Write all properties
    • Delete
    • Read permissions
    • All validated writers
  15. Click OK on the succeeding windows to exit the Properties configuration windows.