--- title: "Setting your Preferred Directory Source" canonical: "https://docs.certero.com/space/CUP/326336556/Setting%20your%20Preferred%20Directory%20Source" format: markdown --- --- ## Overview Where CerteroX collects user data from both Active Directory and Microsoft Entra ID, the same person may exist in both directories. **Preferred Directory Source** determines which of the two sources takes precedence for that person's details. --- ## What this setting Does and Does Not Do **It governs data.** It decides which directory supplies a user's name, email, contact details, account status and manager where both directories hold a record for them. **It does not govern sign-in.** Preferred Directory Source has no effect on how users authenticate to CerteroX. Single sign-on is configured separately under Authentication, and changing this setting will not change anyone's sign-in experience. --- ## Where to Find it **Global Settings > Other Options > Directory > Preferred Directory Source** | **Option** | **Effect** | | --- | --- | | **Active Directory** *(default)* | Active Directory supplies user details for anyone present in Active Directory. Entra ID supplies details only for users who exist in Entra alone. | | **Entra ID** | Entra ID supplies user details for anyone present in Entra. Active Directory supplies details only for users who exist in Active Directory alone. | The arrangement is symmetrical. Whichever source is not preferred still populates the users that only it knows about, no user is left without data because of this setting. --- ## Set it before your first connector run The setting is applied by each connector **as it runs**, at the point data is written. If you enable the Entra ID connector and let it run before choosing a source, the default of Active Directory will already have been applied. Changing the setting afterwards does **not** retrospectively re-arbitrate existing records, it changes which source wins on subsequent runs only. In a hybrid deployment, make this decision **before** the Entra ID connector runs for the first time. --- ## Which should I choose? There is no universally correct answer. The question to ask is: **which directory does your organisation treat as authoritative for user information?** **Choose Active Directory if:** - Active Directory remains your primary source of user administration - User attributes such as department, job title and telephone number are maintained on-premises and synchronised outward to Entra - You are adding Entra ID alongside an established Active Directory deployment and want no change to existing records **Choose Entra ID if:** - Entra ID is where your user records are actively maintained. - You are reducing your on-premises footprint and Entra has become the system of record. - Your Active Directory data is becoming stale relative to Entra. If you are unsure, Active Directory the default. is the more conservative choice for an established deployment, because it preserves existing behaviour. --- ## Exceptions worth Knowing Two behaviours sit outside this setting: - **Last logon is always the most recent.** Whichever directory reports a more recent sign-in supplies the value, regardless of which source is preferred. This is intentional, the aim is to reflect genuine last activity rather than activity in one directory only. - **Device extension attributes are not governed by this setting.** For devices, the connector that ran most recently supplies the values. If you maintain extension attributes in one directory, schedule that connector to run last. See *[Scheduling the Entra ID Connector in a Hybrid Environment](https://docs.certero.com/space/CUP/326238257/Scheduling+the+Entra+ID+Connector+in+a+Hybrid+Environment)**.* --- ## Further information To understand how a user in both directories is recognised as one person, see *[How are users matched between Active Directory and Entra ID](https://docs.certero.com/space/CUP/326336576/How+Are+Users+Matched+Between+Active+Directory+and+Entra+ID)**.* --- ## Getting Started / Support If you have questions or need help, please contact the **Certero Help Desk** or your Certero account team. --- © 2026 Certero Company Confidential. All rights reserved.