Locking Down LDAP Access Over the Internet

enabling ldap access to azure ad ds over the internet creates a security threat the managed domain is reachable from the internet on tcp port 636 it is recommended to restrict access to the managed domain from the company environment ip addresses this can be managed by creating a group rule to create a security group rule select resource groups from the navigation pane in the azure portal choose the resource group, then select the network security group, such as aaads nsg, and the list of existing inbound and outbound security rules appears on the left hand side of the network security group window, navigate to security> inbound security rules select add , then create a rule to allow tcp port 636 for improved security, set the source as ip addresses and specify the valid ip addresses or range for your organization select add to save and apply the rule kron pam can be integrated once the necessary changes have been made to the azure ad to complete the integration, the admin should know a) domain name, b) base dn, and c) authorized user information admins can import specific user groups by defining the group search phrase with conditions