The Gap Between Digital and Physical Offboarding
An employee hands in their notice. IT disables their email and Microsoft 365 login by lunchtime. Their access card still opens the front door, the server room and the car park barrier a fortnight later, because nobody told the access control system they had gone.
That gap between digital offboarding and physical offboarding is more common than most organisations admit. A 2025 Data Breach Investigations Report found compromised credentials were the initial way in for 22% of breaches, and stolen credentials featured in 88% of attacks on basic web applications. Access control sits in the same picture. A card that still works is a live credential, whether the person carrying it is on the payroll or not.
Active Directory access control integration closes that gap. It connects the directory your IT team already runs to the system that governs your doors, so joiners, movers and leavers show up at the reader without anyone rekeying data by hand. This guide explains how it works, how to map it to real access levels, how to secure the connection, and what changes when your identity has moved to the cloud.
What Active Directory Integration Means for Access Control
Active Directory (AD) is Microsoft's directory service. It is the central record of user accounts, groups and permissions across a Windows domain, and for most organisations it is already the single source of truth for who works there and what they can touch on the network.
Integrating it with access control links those Windows user accounts to cardholder records in your security platform. Instead of maintaining two lists of people, one held by IT and one held by security, you connect them. The directory becomes the master, and the access control system reads from it.
Under the bonnet this usually runs over LDAP (Lightweight Directory Access Protocol), the standard way applications query a directory. When an account changes in AD, the linked fields in the access control system update to match.
The two-directory problem physical security has
Most security teams live with a quiet duplication. HR and IT manage people in the directory. Security manages the same people again, by hand, in the access control database. The two drift apart the moment someone joins, moves or leaves, and the drift is where the risk sits.
Why Manual Access Management Breaks Down
Every organisation runs a version of the same lifecycle. Someone joins, someone changes role, and someone leaves. Identity teams call it joiner-mover-leaver, and each stage is a point where physical access can fall out of step with reality. Handled well; this is the heart of employee access rights management: making sure the doors someone can always open match who they are today.
Handled by hand, it tends to fail in predictable ways:
- The two-system tax: IT disables the network login, but a separate person has to remember to revoke the card. When those tasks sit with different teams, one of them slips.
- Delayed leaver revocation: The longer a departed employee's card stays live, the longer the exposure. Industry surveys suggest around half of former employees' accounts stay active for more than a day after they leave, and about the same share of organisations know ex-staff can still reach corporate systems.
- Permission creep: When someone changes departments, they usually gain new access. The old permissions rarely get stripped, so entitlements pile up.
- Orphaned credentials: Contractors, temporary staff and dormant accounts leave working cards attached to people nobody is actively managing.
None of this reflects careless teams; it reflects a manual process at scale. An offboarding checklist run by hand is only as accurate as the busiest person on it.
How the Integration Actually Works
The core mechanism is field synchronisation. You decide which cardholder fields map to which AD attributes, and the system keeps them aligned. This is what turns a directory change into automated user access management rather than another manual job.
Field synchronisation and the joiner-mover-leaver flow
Mapped to the lifecycle, it looks like this:
- Joiner: A new account is created and enabled in AD, which flows through to a cardholder record, so provisioning starts from data that already exists.
- Mover: A change of department or group in the directory updates the matching fields in the access system.
- Leaver: This is where the value is sharpest. When an account is disabled in Active Directory, access privileges in the security platform can be revoked promptly, closing the window that manual offboarding leaves open.
Group-based access mapping
Enabling and disabling accounts is only half the story. The real power comes from mapping AD security groups to access levels.
Most directories already group people in ways that mirror the building. A "Warehouse Staff" group, a "Finance" group, and a "Site B Contractors" group. When those groups drive access levels in the access control platform, a person's doors follow their group membership automatically. Move someone from Finance to Facilities in AD, and their access changes to match without a separate ticket to the security team.
This is the part most guides skip, and it is where day-to-day admin time actually disappears. Access becomes a property of who someone is in the directory, not a manual list maintained alongside it.
Windows login as application authentication
Integration also works at the point of signing in. Windows credentials can serve as the authentication for the access control application itself. Operators sign in with their existing domain accounts rather than a separate password, which keeps control over who can operate the software under the same central policy as everything else on the network.
Securing the Integration Itself
Connecting your doors to your directory is powerful, and it deserves the same caution as any other link to a critical system. Security specialists treat Active Directory as tier-zero infrastructure because it controls access to almost everything. Extend it to physical access, and you widen what depends on that directory, so the connection has to be built properly. Done right, this is what turns directory integration into real Active Directory integration security rather than just convenience.
Three things matter most:
- Least-privilege service accounts: The account the access control system uses to read the directory should have only the permissions it needs. It reads user and group data. It does not need domain admin rights.
- Encrypted directory traffic: Plain LDAP queries can travel in the clear. A secured, encrypted connection (LDAPS) keeps cardholder and account data private in transit.
- Scoped synchronisation: Sync only the organisational units and groups relevant to access. There is no reason for the door system to see the entire directory.
Handled this way, directory integration strengthens your security posture rather than adding a soft spot. This scoping is a design decision, and it is exactly the kind of thing a Sensor Access Technology certified partner works through with you before anything goes live.
On-Prem Active Directory vs Microsoft Entra ID: What Your Setup Means
Classic Active Directory runs on servers in your own domain. Many organisations have since moved identity towards the cloud with Microsoft Entra ID (formerly Azure Active Directory), which powers Microsoft 365 and cloud apps. Plenty run both at once, synchronised with Microsoft Entra Connect. Microsoft calls this a hybrid identity setup.
For access control this distinction matters. A physical access platform that integrates with classic on-premises AD reads from the on-premises directory. In a hybrid environment, that directory usually still exists, so the integration has something to read from and works as expected. For teams comparing information technology security solutions, the question to resolve early is simple: which directory is the master for your people data, and is your access control system pointed at it?
If your organisation is heading towards cloud-only identity with no on-premises AD at all, that is a different architecture, and it is worth confirming at the design stage rather than assuming. Getting this clear up front avoids surprises during commissioning.
The GuardPoint10 Active Directory Module (GP10-AD)
Sensor Access Technology handles directory integration in GuardPoint10 through its Active Directory module, GP10-AD. It links Windows user accounts to cardholder accounts and synchronises changes made in AD to designated fields in GuardPoint10 automatically. When an employee leaves, their access can be revoked quickly in line with the directory, which supports both security and regulatory compliance. Windows logins can also serve as authentication credentials within the application, adding centralised control over who operates the software.
This sits inside GuardPoint10's one-platform approach, where access control systems, alarms and video are managed together rather than bolted onto each other. Directory integration pairs naturally with the Multi-Site module, so organisations running several locations can drive access from a central directory while local branches keep the autonomy they need. That combination is what makes centralised multi-site access management possible from a single console.
Because GuardPoint10 is built on open protocols and a modern API, the directory connection is one part of a wider integration story rather than a closed feature. The same platform links to systems like visitor management, so a visitor who checked in at reception can have access credentials created without manual entry. The core GuardPoint10 software licence is a one-off rather than a recurring subscription, so the platform grows with the organisation without ongoing fees on the core software.
For installers and consultants that mix matters. The module solves a concrete client problem, and it does so within a platform that scales from a single building to a large deployment without a redesign.
Getting it Right: Edge Cases and Best Practice
Directory synchronisation is worth scoping properly rather than assuming it drops in untouched. A few decisions repay attention.
- Disabled versus deleted: Decide what should happen to a card when an account is disabled compared with when it is deleted. Disabling is usually the trigger for revoking access, while deletion may need a different rule.
- Contractors and temporary staff: These are the accounts most likely to be forgotten. Bring them into the same group-driven model so their access expires with their engagement.
- Shared and service accounts: Generic accounts do not map cleanly to a single person. Handle them deliberately rather than letting them inherit access by accident.
- Movers who should lose access: Confirm that a role change strips old permissions rather than only adding new ones.
Two habits make the whole thing dependable. Test the leaver flow specifically by disabling a test account and confirming the card stops working. And keep audit logging enabled so you hold a defensible record of every access change.
That record is central to GDPR accountability and to regulated sectors more broadly. Consistent audit logging gives you evidence of who had access, when they had it, and when it was removed.
One honest note on scope. Directory synchronisation automates the link between your user directory and your doors. It is not a full identity governance suite, and it does not replace the access reviews that mature security programmes run. It removes the manual, error-prone part of the job, which for most organisations is where the real risk lives. Because Sensor Access Technology works through accredited partners rather than delivering installations directly, the right way to scope this is a conversation with a certified partner who can match the integration to your directory and site structure.
Frequently Asked Questions
Does GuardPoint10 work with our existing Active Directory?
Yes. The GuardPoint10 Active Directory module links Windows user accounts in your existing domain to cardholder records, so you manage people in the directory you already run rather than duplicating data. A certified partner can confirm the fit against your specific environment.
Does this still work if we've moved to Microsoft Entra ID?
It depends on your setup. GP10-AD integrates with classic on-premises Active Directory. Many organisations run a hybrid model where on-premises AD still exists alongside Microsoft Entra ID, and in that case the integration has a directory to read from. If you are moving to cloud-only identity with no on-premises AD, confirm the architecture with a partner at the design stage.
Can access really be revoked instantly when someone leaves?
When an account is disabled in Active Directory, the linked access privileges in GuardPoint10 can be revoked promptly. That removes the delay manual offboarding usually creates and closes the window where a departed employee's card still works.
Is Active Directory integration GDPR compliant?
The integration supports compliance by keeping access rights synchronised with your directory and maintaining audit logs of access changes. That gives you a clear record of who had access and when it was removed, which is central to GDPR accountability. Compliance also depends on your wider policies and configuration.
Bringing It Together
The gap between IT offboarding and physical security is avoidable. Connecting Active Directory to your access control system turns a manual, easily missed task into an automatic one, using the directory your organisation already trusts. Map it to security groups, and the day-to-day admin largely looks after itself. Secure the connection and scope it to your directory setup, and it strengthens your security rather than adding risk.
At Sensor Access Technology, our team delivers GuardPoint10 through a network of accredited partners, who are NSI- or SSAIB-approved and accredited across Bronze, Silver, Gold and Platinum tiers. To see the Active Directory module in action, speak to a specialist, and we can connect you with a certified partner to scope the integration around your environment.