This FAQ attempts to answer some of the most common questions around the subject of Active Directory.

When configuring GAL Sync using Microsoft’s Identity Integration Feature Pack (IIFP) you are asked to provide a domain account for use by each Management Agent. Most organisations would not want to provide an account with elevated privileges (e.g. Enterprise Admins or Domains Admins). The IIFP help documentation provides some information on what level of permissions are required for these accounts, but does not provide a good level of detail. In an effort to provide some clarity, this article describes a simple GAL Sync scenario and provides specific guidance on what permissions are required.