LDAP Active Directory and Microsoft Entra ID

Barracuda Networks no longer supports new insecure LDAP connections. You will need to use SSL or TLS to authenticate. Existing insecure LDAP connections will continue to be supported, but will be updated shortly.

You can configure Barracuda Cloud Control to synchronize users with LDAP Active Directory or Microsoft Entra ID (formerly Azure Active Directory) as described in the sections that follow.

To ensure uninterrupted access to LDAP from the Barracuda Cloud, you must allow incoming connections from the following IP addresses.

35.170.131.81
54.156.244.63
54.209.169.44

1 Understanding Sign-In Methods
2 Create a Barracuda Cloud Control Directory
- 2.1 Add a new LDAP Active Directory
- 2.2 Add a new Microsoft Entra ID
3 View Existing Directories and Groups
4 Change Sign-In Methods for an Existing Directory
5 Re-authorize a Microsoft Entra ID

Understanding Sign-In Methods

Each LDAP Active Directory and Microsoft Entra ID directory has two sign-in options. They control how users whose email addresses match the directory's domains log in to Barracuda Cloud Control.

Option	When turned on

Option	When turned on
Barracuda Credentials	Users matching this directory's domains can log in with their Barracuda Cloud Control credentials.
SSO Authentication	Barracuda Cloud Control uses Microsoft single sign-on (SSO) to authenticate users matching this directory's domains. Users click Sign in with Microsoft, log in with their Microsoft account, and are then returned to Barracuda Cloud Control. For LDAP directories, this applies only if you use Entra ID together with Active Directory.

You can turn on one option or both. This table shows how the two settings work together:

Barracuda Credentials	SSO Authentication	How users log in

Barracuda Credentials	SSO Authentication	How users log in
On	On	Users can log in with their Barracuda Cloud Control credentials or with Microsoft SSO.
On	Off	Users must log in with their Barracuda Cloud Control credentials. Microsoft SSO is blocked.
Off	On	Microsoft Entra ID – Users must log in with Microsoft SSO. LDAP – Users can log in with their LDAP credentials or with Microsoft SSO.
Off	Off	Microsoft Entra ID – Users cannot log in. LDAP – Users must log in with their LDAP credentials. Microsoft SSO is blocked.

Notes

For LDAP Active Directory directories, SSO Authentication controls Microsoft SSO only. If you do not use Entra ID together with your Active Directory, turning off SSO Authentication has no effect, and users log in with their LDAP credentials when Barracuda Credentials is turned off.
If you set up your directory before these options were available, SSO Authentication is turned on by default, so your current sign-in behavior does not change. Barracuda Credentials replaces the previous Authentication setting and shows the opposite value. For example, if Authentication was turned on, Barracuda Credentials now shows as turned off.

Warning: For Microsoft Entra ID directories, if you turn off both Barracuda Credentials and SSO Authentication, users matching this directory's domains cannot log in to Barracuda Cloud Control. If this happens, contact Barracuda Networks Technical Support.

Note: Barracuda Networks strongly recommends creating an additional administrator account on a separate domain that does not use directory authentication. That way, you can still access your Barracuda Networks product account if your directory server or identity provider goes down or fails.

Create a Barracuda Cloud Control Directory

In Barracuda Cloud Control, go to Settings > Admin > Directories.
Click the Add Directory button.
Select one of the following sections to add a new LDAP or Microsoft Entra ID.

Add a new LDAP Active Directory Select LDAP Active Directory. On the INFO tab, specify a new Directory Name. Configure the sign-in options. For details, see Understanding Sign-In Methods above. Barracuda Credentials – Turn on to let users matching this directory's domains log in with their Barracuda Cloud Control credentials. SSO Authentication – Turn on to let users matching this directory's domains log in with Microsoft SSO (Sign in with Microsoft). Turn off to block Microsoft SSO for these users. Note: If you do not use Entra ID with Active Directory, turning off SSO Authentication has no effect. Click SAVE AND CONTINUE. On the HOST tab, specify the following for the LDAP host: LDAP Host IP address Base Domain Name (DN) – Any user or group that exists within the search base that will sync to Barracuda Networks. For example, DC=domain,DC=com. Bind DN – The bind domain name for a service account with read permissions to the active directory. Password – The password for the service account. Connection Security – Select SSL or TLS. For more information, see New Requirements for LDAP Authentication. (Optional) To add more servers, click Add LDAP Host. If your LDAP server uses a self-signed certificate, toggle on the Allow Self-Signed Certificate setting. Click TEST CONNECTION to check connectivity to the host. If the connection fails, verify your settings are correct and that you have allowed the Barracuda Networks IP in your firewall. Contact Barracuda Networks Technical Support for additional troubleshooting. If the connection succeeds, it displays as Connected. Click SAVE AND CONTINUE. On the DOMAINS tab, add the domains associated with your users. For each domain that you add, click Verify and follow the instructions to verify the domain. After each domain is verified, you can sync your users and groups to Barracuda Cloud Control.

Add a new Microsoft Entra ID Select Microsoft Entra ID. On the INFO tab, enter a new Directory Name. For example, "Office 365". Click CONNECT TO MICROSOFT to log in to Microsoft and authorize Barracuda Cloud Control to connect to your Microsoft Entra ID. Log in with your Microsoft 365 administrator credentials. Accept the permissions requested by the application. Configure the sign-in options. For details, see Understanding Sign-In Methods above. Barracuda Credentials – Turn on to let users matching this directory's domains log in with their Barracuda Cloud Control credentials. SSO Authentication – Turn on to use Microsoft SSO to authenticate users matching this directory's domains. Users are sent to Microsoft to log in. For more information, see . Warning: If you turn off both options, users matching this directory's domains cannot log in. If this happens, contact Barracuda Networks Technical Support. After you are redirected back to the Barracuda Cloud Control, click Save.

View Existing Directories and Groups

Complete the following steps to view existing directories and groups in Barracuda Cloud Control:

From the Settings > Admin tab in Barracuda Cloud Control, click Directories. The Directories table shows the sign-in methods turned on for each directory.
Click View groups to display the groups associated with a configured directory.
To make sure user information is up to date, click Sync groups to synchronize the listed groups.
Click Edit for a directory to change its settings, including its sign-in methods. When you're done making changes, click SAVE.

Change Sign-In Methods for an Existing Directory

In Barracuda Cloud Control, go to Settings > Admin > Directories.
Click Edit for the directory you want to change.
On the INFO tab, turn Barracuda Credentials and SSO Authentication on or off as needed.
Click SAVE.

Tip: Before you change these settings, make sure at least one administrator can still log in. Use an administrator account on a separate domain, or test the new settings first with a non-administrator account in a private browser window.

Microsoft Entra ID – Before you turn off SSO Authentication, make sure Barracuda Credentials is turned on and users have Barracuda Cloud Control passwords set. Before you turn off Barracuda Credentials, make sure Microsoft SSO works for your users.
LDAP – Before you turn off Barracuda Credentials, make sure your LDAP connection is working and users can log in with their LDAP credentials.

Re-authorize a Microsoft Entra ID

Complete the following steps to reauthorize an existing Microsoft Entra ID:

On the Settings > Admin > Directories page, click Edit for the Microsoft Entra ID directory you need to reauthorize.
Click RE-AUTHORIZE.
- If Barracuda Networks' permissions were revoked in Microsoft Entra ID, re-authorizing lets you log in to the linked Microsoft Entra ID account and grant the permissions again.
- If the list of domains in Microsoft Entra ID has changed, re-authorizing updates the matching list of domains in Barracuda Cloud Control.

The original administrator who initially authorized the Barracuda Networks permissions to the account does not have to be the one who re-authorizes the account. Another administrator on the same Microsoft Entra ID account can complete this task. A non-administrator user on the same Microsoft Entra ID account or any user on a different Microsoft Entra ID account may not be used. The user who performed the most recent authorization is displayed above the RE-AUTHORIZE button.