Active Directory Object
References an object in Active Directory that is not necessarily a person — a group, a computer, an organisational unit.
Where to find it
Architect Panel → Data:
- Datastores — the datastore, then Table Designer to add or edit a field
Architect Panel → Security:
- Authentication Methods — directory integration
Architect Panel → Integration & Connections:
- Azure AD Tenants — directory connections
What it is for
- Groups — recording which directory group governs something.
- Computers and devices — asset records tied to directory objects.
- Organisational units — where a record belongs in the directory structure.
Use the person search for people
This field is deliberately broader. If you are naming a member of staff, the directory person search is the better fit — narrower results, better suited display, and clearer intent to whoever reads the field definition later.
It does not join
As with the other directory field, the object lives outside the platform, so reporting through it is limited. Grouping records by directory group means working with stored values rather than joining to records.
Directory structure changes
Groups are renamed, computers are decommissioned, organisational units are restructured — and none of that reaches your stored value. A record can reference an object that no longer exists or has been renamed, and nothing will tell you.
Where the reference matters operationally, something should periodically confirm the objects still exist. That is not automatic.
Referencing a group is not using it
An important distinction. Storing a directory group in a field records which group is relevant; it does not grant access to that group's members.
Access is governed by the platform's own permissions and, where you have configured it, by directory group mapping into security groups. A field is a note, not a control — and treating it as one produces an application that appears to enforce something it does not.
Restrict what is searchable
A directory contains a great deal, much of it meaningless to your users. Scope the search to the object types and the parts of the tree that are relevant, or the picker becomes unusable.
Consider a local record instead
If you are building an asset register, the directory object is one attribute of an asset rather than the asset itself. Model the asset locally, with its own fields, history and permissions, and reference the directory object from it.
Trying to use the directory as your asset datastore leads to a system that cannot record anything the directory does not already hold.
Worked example
An IT asset datastore holds each machine as a local record with its own purchase date, location and owner, and references the directory computer object as one field. Reporting works from the local records; the directory reference is there for administrators who need it, and a quarterly check flags references to objects that have been removed.
Recommendations
- Use the person search for people.
- Model your own records and reference the object from them.
- Never treat a stored group as a permission.
- Check periodically that referenced objects still exist.