Outbound HTTPS Only
The tool calls the AutoPhish API from inside your network. You open no inbound port and expose no domain controller.
All integrations
Active Directory integrationBeta
On-Premises Active Directory Sync for Phishing Simulations
Keep phishing simulation target lists in step with your on-premises AD groups. A signed PowerShell tool runs on your own Windows Server and uploads group membership once a day, so AutoPhish never needs a connection into your network.
This integration is in beta. It is included in every AutoPhish plan at no extra cost.
On-Premises Does Not Have to Mean Manual
Many organizations keep Active Directory on-premises for good reasons, and most cloud security tools respond by asking for an inbound connection, a broad service account or a weekly CSV export. None of that belongs in a security awareness program. AutoPhish turns the direction around: a small, signed tool inside your network reads the groups you choose and pushes a snapshot out over HTTPS.
Connected in Three Steps
Map Your AD Groups
Create the connection in AutoPhish and map each AD group to a target list. Groups are identified by their objectGUID, so renaming a group breaks nothing.
Install the Signed Tool
Download the configured package and install it on a domain-joined Windows Server 2019 or newer, running under a read-only group managed service account.
Let the Daily Sync Run
A scheduled task uploads a complete snapshot of each mapped group every night. AutoPhish adds new members and removes people who left.
Designed for Cautious Windows Administrators
Recursive Group Membership
Members of nested groups are resolved for you, so one mapping covers a whole department with all its sub-teams.
Fails Safe, Never Empty
If a group cannot be read completely, nothing is uploaded. A snapshot in which every account was filtered out is rejected instead of emptying your list.
Signed and Verified Scripts
Every script is Authenticode-signed. The installer checks each file hash and signature before it enables the scheduled task.
Nothing Reaches Into Your Network
The tool is built for environments where every service account and every script is reviewed.
- The API key can only read your group mappings and submit directory snapshots for your company. It cannot access campaigns or reports.
- The key is stored with Windows DPAPI and is readable only by the service account, SYSTEM and local administrators.
- The download package contains no credentials and no customer data.
- Local logs contain IDs, counts and status only, never member names or email addresses.
- Disabled accounts and addresses outside your verified domains are not imported.
Active Directory Integration FAQ
Does AutoPhish need access to my domain controller?
No. AutoPhish never connects to your network. A PowerShell tool on one of your own servers reads group membership and sends it to AutoPhish over outbound HTTPS.
What do I need to run the sync tool?
A domain-joined Windows Server 2019 or newer with Windows PowerShell 5.1, the RSAT Active Directory module and a group managed service account with read access to the directory.
How often is Active Directory synced?
Once a day. The scheduled task runs at night with a random delay, and an administrator can start a sync manually on the server at any time.
Which data leaves my network?
Only what a simulation needs for the groups you mapped: names, email addresses and account status of their members. Passwords and password hashes are never read.
We use Microsoft Entra ID as well. Which integration should I choose?
If your users and groups are available in Entra ID, the Microsoft 365 integration is the simpler choice because it needs no software in your network. Use the Active Directory tool when the groups exist only on-premises.
Is Active Directory sync included in my plan?
Yes. The integration is in beta and included in every AutoPhish plan at no extra cost.
More AutoPhish Integrations
Google Workspace
Record reports made with Gmail's built-in "Report phishing" option on your simulations. No add-on to roll out.
Learn moreMicrosoft 365
Sync Microsoft Entra ID groups into target lists every night, with nested groups and disabled accounts handled for you.
Learn moreNextcloud
Install the official app from the Nextcloud App Store and map Nextcloud groups to AutoPhish target lists.
Learn moreRun your first phishing test in 10 minutes.
Sign up free — no credit card. Try Pro free for 7 days when you're ready.