Skip to main content
Documentation & User Guides | FotoWare

Importing groups from Active Directory

Choosing the groups to import from AD

Go to the Single Sign-on tab in the FotoWeb site configuration and click in the Import group button.The dialog that appears contains a search box where you can search for groups and then select them for import.

Assigning a license to group members

After choosing the groups to import, make sure you set group permissions and define a default license for members of that group.

A default license must be assigned either to the imported group, or to a parent group of which the imported group is a member. That way, when users sign on to FotoWeb the first time, they will be assigned a user license based on their group membership. You can change the license assigned to a user later.

Note: AD groups will have their license level set to "None" by default. Make sure a license level is assigned to the group before users log in, or they will receive a message that no license has been assigned to the group.

How FotoWeb queries the Active Directory

When an administrator adds groups to FotoWeb from the Active directory, the query searches for group names that begin with what is entered in the search field. While it would be possible to allow searching for group names using a "contains" query, this would be very inefficient in large ADs with more that 100k users.

As a consequence an admin that adds AD groups to the FotoWeb configuration needs to know the start of a group's name to find it when doing the lookup.

Additional details on how FotoWeb works with AD is available in a reference topic.

Which AD groups can be imported?

When FotoWeb queries the AD, Universal, Global and Domain Local groups can be imported.


When importing groups from your AD, users are not immediately added to the FotoWeb user database. Users will be imported the first time they log in.

Importing groups from an Azure Active Directory

When importing groups from an Azure AD, a special browser dialog will open and require you to log in to Azure. You will need to log in with a user that has Azure AD management rights to do so. It will then allow you to choose the groups to import from the browser dialog box.

Note: If, when using Internet Explorer to import groups in the Operations Center, you receive a 404 http error when the group import dialog box appears, you need to enable active scripting for the internet zone in your Internet Options.

What's next?

Next, you typically assign archive permissions to the groups you have imported.