Master Account Holders can import Microsoft Entra ID users as LogMeIn Rescue technicians into their organization. Key user data in LogMeIn Rescue will be automatically updated when those change in the Azure Active Directory.

1. Generate a service token and default password for new users in the Admin Center.
   1. Select the Global Settings tab.
   2. To generate a service token, click Generate and Copy under Active Directory Synchronization.

      Result: A service token is generated and copied to your clipboard.

   3. Define the default password you want your new technicians to use for their first login.
      Note: Users are required to change this password upon their first login.
   4. At the bottom of the page click Save.
2. Download and extract the server application.
   1. In the LogMeIn Rescue Administration Center, under Active Directory Synchronization, click Download to download the service installer.

      Result: The service installer is downloaded to your computer in a zip file.

   2. Extract the zip file to a folder.
3. Run the server application, and configure synchronization behavior.
   Important: You need privileges to run the application as a system service. The computer running the application must be connected to Active Directory with sufficient permissions to access and query all Active Directory groups and users.

   
   1. Select the Microsoft Entra ID service to be used.
   2. Submit the following credentials:
      • Master Account Holder LogMeIn Rescue credentials
        • Email
        • Password
      • The service token you previously generated on the Global Settings tab of the Admin Center.
      • Region

      Note: By checking Dry Run mode, a preview of the changes the synchronization will make to your Rescue account will be output in an Excel file.

      Important: If you select Dry Run mode, synchronization can ONLY be used as a Windows terminal application.

      
   3. Click Next.
      Note: The application runs in Admin mode.
   4. Enter your Entra App credentials, and click Next.
      Note: How to create Client ID, Tenant and Client Secret in Azure.
   5. Enter a search criteria (for example 'support').
   6. Enter a search term (for example 'aid').
      

      Result: AdSync searches for this term between the configured AD groups.

4. Select the Technician Groups you want to synchronize.
   1. Click the Technician Groups radio button under Technician Groups/Admin Groups
      • The first column contains the Microsoft Entra AD Groups, select one Active Directory group you want to synchronize with a Rescue Technician Group.
      • The second column contains the Rescue Technician Groups, select one group that will be synchronized with the AD group.
   2. Navigate to the Enable Full Group synchronization option:
      • checked (default): The synchronization process performs a one-to-one synchronization, that is groups, users, and hierarchies inside Rescue will be exactly the same as in the Entra AD hierarchy.
      • unchecked: Only user status updates are synchronized. If a user is in a different group than the configured one, they will not be moved back to the configured group.
   3. Click the arrow button pointing to the third column to finalize the selection.
      Note: If you want to select multiple groups, repeat step a. To cancel synchronization between two groups, select them in the third column, and click the arrow pointing towards the second column. The AdSync Wizard loads the previously configured groups to make the reconfiguration process smoother.
      Important: You can synchronize up to 999 groups, each consisting a maximum number of 999 members.
   4. Navigate to Group settings:
      • Mobile license: a mobile license is assigned to the members of the group, if available.
      • Mapping UPN to SSOID: When checked, the SSO IDs of the group members will directly correspond to their UPNs.
   5. Click Next.
   6. Select Yes in the confirmation pop-up window to continue with the synchronization.
      Note: If you connected at least one Active Directory Group to a Rescue Technician Group check an option under Global settings to define the behaviour of the synchronized group.
   7. Select your preferences under Global settings:
      • Use UPN instead of Email address: When checked, you can use "UserPrincipalName" instead of an email address in Rescue.
      • Use Email address as a SSO ID: When checked, the SSO ID in Rescue gets the email address.

      
5. Click Next.
6. In the resulting pop-up window click Yes to continue with the synchronization.
7. Select how AdSync will run:
   • Start Active Directory Synchronizer as a service.
   • Start Active Directory Synchronizer as a Windows terminal application.
   • Interval to send changes (minutes): You can enter your preferred frequency of the synchronization operation.

   Important: Running the synchronizer as a Windows app will also place an icon resembling to the Rescue logo in the System tray. You can hide or unhide the application by right-clicking on it. If you want to the stop the synchronization process, use the Close the program option.
8. If the installation was successful, click Finish, and close the installer.

   Result: The service application is installed as a Windows service provisioning users belonging to the selected Microsoft Entra ID group(s) to the selected Rescue Technician Group(s).

   Restriction: It is not possible to delete a technician from the LogMeIn Rescue Admin Center by using the Active Directory synchronization service. When a user is deleted or moved in Active Directory, the corresponding LogMeIn Rescue technician is disabled.
   Note: If a technician is moved to another LogMeIn Rescue Technician Group, subsequent synchronization will update the user's status and move the user back to its initial synchronization group.
   Note: If a user is disabled, deleted, or moved in Active Directory, the technician's mobile license is freed up, and becomes available for other members of the LogMeIn Rescue organization.
   Tip: If the synchronization service fails, you can get an error log by clicking Active Directory Logger at the bottom of the Active Directory Synchronization section on the Global Settings tab of the Admin Center.