Everything touches Active Directory. Too little of it is controlled.

HR onboarding, service desk workflows, security tools and now AI agents all change Active Directory. SYNERGY Management Gateway for Active Directory gives them one controlled way in — every change checked, approved where it matters, and recorded.

Console, REST API, AI agents and n8n workflows passing one governed checkpoint before they reach Active Directory

Too many hands on Domain Admin

Scripts, service accounts and third-party tools each keep their own privileged credentials — often shared, rarely rotated.

Automation lives in fragile scripts

PowerShell scattered across servers, with no approval step and no record of what ran. When the person who wrote it leaves, the knowledge leaves too.

AI agents have no safe way in

Teams want assistants to unlock accounts and answer directory questions. Today, giving an agent access means giving it the keys.

What changes with the gateway

Applications, workflows and AI agents work with users, groups, OUs, computers and service accounts through one REST API and MCP server — and every request passes the same permission, approval and audit checks.

Control every change

Keys and roles reach only the directories they need, and sensitive changes wait for approval. Fewer admin rights to justify — and no more being the last safeguard.

Automate safely

Connect HR, ITSM and your own scripts through the REST API, and let AI agents work over MCP — each with only the access its key allows.

Prove what happened

Every change is recorded with who asked, from where and what changed, and can stream to your SIEM. Audit evidence becomes a report, not a project.

Key features

Six capabilities IT teams ask about first.

SYNERGY Management Gateway for Active Directory node in the n8n editor

Dedicated n8n nodes

A ready-made n8n node for Active Directory lets you create users, reset passwords and change group membership in a workflow, without writing scripts. It works through the same gateway as every other channel, so each workflow can do only what its API key allows, approval rules still apply, and every change is audited. Your team builds onboarding and service desk automation visually, and none of it gets around your rules.

MORE
Active Directory Connections screen with several connected directories

Multiple directories

Connect several Active Directory domains or forests to one gateway: test and production, or a domain that came with an acquisition. Each role and API key is bound to the directories it may touch, so a key made for test cannot change production. You work from one console with one set of rules, instead of a separate tool and set of accounts for each domain.

MORE
Directory Policies screen with operations grouped by risk

Permissions and approvals

Fine-grained permissions decide who can do what, and approval rules can hold sensitive changes, such as group membership, until a second person approves them. The same checks run in the web console, the REST API, MCP and n8n, so no channel skips them, and a rule set for one directory can only make the global rules stricter. You get segregation of duties you can show an auditor, without taking the work away from the people who do it.

MORE
Operations log listing requests with requester, channel and result

Audit trail and change history

Every change is recorded with who made it, through which channel, the object it touched, the values before and after, and whether it succeeded. Changes to the gateway itself, such as roles, API keys and policies, are recorded too and cannot be switched off, and events can stream to your SIEM. When someone asks what happened to an account, you answer from one place instead of piecing together domain controller logs.

MORE
Consent screen for connecting an AI agent with a chosen role

Flexible sign-in and API access

People sign in with Windows Integrated Authentication, SAML, OpenID Connect or a local account, and AI agents connecting over MCP can use OAuth. Each script or integration gets its own API key with its own role, directory scope and expiry, and any key can be revoked on its own. It fits the identity setup you already have, and switching off one integration never affects the others.

MORE
Setup wizard checking Windows Server prerequisites

Runs on your own servers

It installs on your own Windows Server with an installer and setup wizard, and keeps its data in SQL Server, PostgreSQL or SQLite. Updates are signature-checked and installed in a maintenance window you choose. Your directory data stays inside your network, and the gateway keeps working if your internet connection drops.

MORE

Screenshots show demo data.
Book a demo

Pricing

How many users will you manage?

Up to 1,000 users

Prices exclude VAT and any other taxes or duties, which depend on your country and how you buy. Prices from SYNERGY partners may differ. EUR prices apply to organisations in the EU and EEA; USD prices apply elsewhere.

Request a free trial

A 14-day trial for up to 100 users, with every feature included. No card needed. Tell us who you are and we'll email your trial licence code and installation instructions.

Thank you. We've received your trial request and will email your trial licence code and installation instructions shortly. Questions in the meantime: hello@synergy.eu.
Sorry, the request couldn't be sent. Please try again, or email us at hello@synergy.eu.

Common questions

How is it licensed?

By the number of users you manage through the gateway, in tiers from 250 to 10,000 users, paid monthly or yearly. There is one edition, and every feature is included, AI agents too. Only the users you activate count, so old and unused accounts can stay out. Above 10,000 users, ask us for a quote.

What happens when we need more users?

Move up a tier at any time and pay only the difference for the rest of your billing period. When your tier is full, no more users can be added until you upgrade.

Does it replace Active Directory or our current tools?

No. It sits in front of your existing Active Directory and controls how people, workflows and AI agents reach it. Your domain controllers and schema stay as they are.

Where does it run, and what do we need?

On your own Windows Server with IIS, next to your directory, with SQL Server, PostgreSQL or SQLite for its own data. It needs outbound HTTPS to SYNERGY for licensing and updates, and works through your proxy.

Can we install it ourselves?

Yes. An installer and setup wizard do the configuration, and a typical installation takes an hour or two. If you prefer, we can install it for you remotely.

Does our directory data leave our network?

No. The gateway contacts SYNERGY only for licensing and updates. Optional usage statistics count which modules are used and contain no directory content or identities.

Can an AI agent change the directory on its own?

Only within the role and directories allowed for its key. Any type of change you hold for approval waits for a person to approve it.

Does it help with NIS2?

It supports that work. Every change is recorded and can be streamed to your SIEM, which helps with traceability, incident investigation and audit evidence. No product makes an organisation compliant on its own.

What support is included?

Standard Support, Monday to Friday, 08:00 to 17:00 CET. You raise tickets from inside the product.

Can we try it before we buy?

Yes. Request a 14-day free trial for up to 100 users, with every feature included; no card is needed. You choose which users from your Active Directory to try it with. We email you a trial licence and installation instructions. If your evaluation needs more time, talk to us before the trial ends. We can also show it to you in a meeting.

Microsoft and Active Directory are trademarks of the Microsoft group of companies. SYNERGY Management Gateway for Active Directory is not affiliated with, sponsored or endorsed by Microsoft. Other product and company names are trademarks of their respective owners.

Discuss your ITSM needs

Clients benefit from a no-commitment call to discuss their specific requirements.

Book a meeting