> For the complete documentation index, see [llms.txt](https://docs.lithnet.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lithnet.io/ams/v2.1/configuration/deploying-features/setting-up-lithnet-laps/setting-up-the-ams-directory.md). # Preparing the AMS directory ![](https://1174763835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYKUIJoHjACu79Ekwwf7i%2Fuploads%2Fgit-blob-777b39409f48f271de2f52ccc6f33e3248829f95%2Fbadge-enterprise-edition-rocket.svg?alt=media) Managing more than 100 devices in the Access Manager directory is an [Enterprise edition feature](/ams/v2.1/access-manager-editions.md) When using the Lithnet Access Manager Agent (AMA) on devices that are not joined to an Active Directory (non-windows devices, Azure AD devices, and standalone Windows devices), the AMA stores passwords in the Access Manager Directory. The agent will contact the AMS server at regular intervals, and ask if its password needs to be changed, if it does, it rotates its local password, encrypts it, and submits it to the AMS server, which then stores the password in its internal database. The following guide outlines the steps required to enable the AMS directory service. ## Step 1: Enable API support From the `Host configuration` page, tick `Enable the Access manager API`, and specify the host name clients will use to connect to the server. This must match the DNS name in the active TLS/SSL certificate, or clients will be unable to connect. ![](https://1174763835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYKUIJoHjACu79Ekwwf7i%2Fuploads%2Fgit-blob-438368d8aec5ee8d5f074baf98672ba92ce1c0e4%2Fui-page-host-configuration.png?alt=media) ## Step 2: Enable device registration modes From the `Directory configuration/Access Manager Directory` page, select mechanisms by which devices will register with the AMS server. You can use registration keys deployed at installation time to the devices, and Windows 10 and higher devices joined or registered with Azure AD, can use Azure AD authentication to register. ![](https://1174763835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYKUIJoHjACu79Ekwwf7i%2Fuploads%2Fgit-blob-3ed4783591809738b9e1ac634bbd0c9cdf44c498%2Fui-page-directory-configuration-access-manager-directory.png?alt=media) If you do not plan on using AAD device registration, then the setup process is complete. ## Step 3: Configure Azure Active Directory tenant details If you enable Azure Active Directory device registration, you must register your Azure Active Directory tenant details, and grant permission for the service to read information from your AAD. If you are using Azure AD authentication for AMS, you can reuse the app registration created for authentication. Skip to the `Granting directory permissions` section below. If you are not using Azure AD for authentication, or you'd like to create a separate application for the directory access, then follow these steps to create a new application in Azure AD. ### Configure a new application in Azure AD 1. Log into portal.azure.com with administrative credentials, select `All services` and select `Azure Active Directory` 2. Select `App registrations` and click `New application registration` 3. Enter `Lithnet Access Manager` or another suitable application name, and select `Accounts in this organizational directory only (Lithnet only - Single tenant)` as the supported account type 4. Leave the `redirect URI` field blank 5. Click `Register` 6. Take note of the `Application ID` value, this is our client ID 7. Save the settings 8. Take note of the Directory/Tenant ID from the main application page 9. From the `Certificates and secrets` page, click `new client secret`, give your secret a name, and then take note of the value provided. ### Granting directory permissions 1. Log into portal.azure.com with administrative credentials, select `All services` and select `Azure Active Directory` 2. Select `App registrations` and select your Application registration for Lithnet Access Manager. 3. From the `API permissions` page, click `Add permission` and grant the following API permissions * Device.Read.All * Group.Read.All * Organization.Read.All * User.Read 4. Ensure that you have selected `Grant admin consent` for each item. ### Configure the service account details in Access Manager 1. Open the Lithnet Access Manager Service Configuration Tool 2. Select the `Directory configuration/Azure Active Directory` page 3. Press the `Add...` button to add a new tenant configuration 4. Add the client ID, secret, and directory/tenant ID in the fields provided 5. Save the tenant configuration {% hint style="info" %} You may need to wait a minute or two for the secret and delegation to become active {% endhint %} Access Manager is now configured to support Azure AD joined and registered devices. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.lithnet.io/ams/v2.1/configuration/deploying-features/setting-up-lithnet-laps/setting-up-the-ams-directory.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.