Skip to main content
Documentation & User Guides | FotoWare

Groups and access control for Azure AD

Choosing the groups to import from AD

Go to the Single Sign-on tab in the FotoWeb site configuration and select Import group. The dialog that appears contains a search box where you can search for groups and then select them for import.

Import groups from Active Directory or Azure AD.png

Assigning a license to group members

After choosing the groups to import, make sure you set group permissions and define a default license for members of that group.

A default license must be assigned either to the imported group or to a parent group of which the imported group is a member. That way, when users sign on to FotoWeb the first time, they will be assigned a user license based on their group membership. You can change the license assigned to a user later.

Note: AD groups will have their license level set to None by default. Make sure a license level is assigned to the group before users log in or they will receive a message that no license has been assigned to the group.

How FotoWeb queries the Active Directory

When an administrator adds groups to FotoWeb from the Active Directory, the query searches for group names that begin with what is entered in the search field. While it is possible to allow searching for group names using a contains query, this would be very inefficient in large ADs with more than 100k users.

As a consequence, an administrator that adds AD groups to the FotoWeb configuration needs to know the start of a group's name to find it when doing the lookup.

For more information about how FotoWeb works with AD, see How Directory Services relate to FotoWeb.

Which AD groups can be imported?

When FotoWeb queries the AD, Universal, Global, and Domain Local groups can be imported.


When importing groups from your AD, users are not immediately added to the FotoWeb user database. Users will be imported the first time they log in.

Importing groups from an Azure Active Directory

When importing groups from an Azure AD, a browser dialog opens requiring you to log in to Azure. You must log in with a user that has Azure AD management rights to do so. You can then choose the groups to import from the browser dialog box.

Note: If, when using Internet Explorer to import groups in the Operations Center, you receive a 404 HTTP error when the group import dialog box appears, you need to enable active scripting for the internet zone in your Internet Options.

What's next?

Next, you typically assign archive permissions to the groups you have imported. For more information, see Setting archive access and permissions.