Directory Service

What is a directory service?

A directory service is a centralized database that stores identities, groups, devices, and their attributes, and makes them available to applications for authentication and authorization. Active Directory, Microsoft Entra ID, Google Workspace Directory, Okta Universal Directory, and any LDAP server are directory services. It is the system that answers who exists in the organization.

How a directory service works

• Objects such as users, groups, and devices are stored with attributes including department, manager, and job title.
• Applications query the directory through LDAP, SCIM, or a vendor API.
• Group membership drives authorization, which is how role-based access control is usually implemented.
• Attributes are typically fed from the HR system, making HR the upstream source of truth.
• Changes propagate to connected applications through synchronization or SCIM provisioning.

Knowing who exists is not knowing what they can reach

A directory answers who works here and which groups they belong to. It does not answer which applications they actually use, which of those the company pays for, or which were never connected to it in the first place. In a mid-market estate of 100 or more SaaS tools, the distance between those two questions is exactly where license waste, orphaned accounts, and audit findings accumulate.

Examples and use cases

An IT manager exports the directory before an ISO 27001 audit and finds 214 active accounts for 198 employees. The 16 extras turn out to be service accounts, contractors, and two departures never fully closed. The directory surfaced that in minutes. What it could not show was the 40 applications those same people accessed with local logins, which only appeared through discovery against expense data and OAuth grants. Corma covers that second layer on top of the directory.

Related concepts

• Identity and access management platform
• User provisioning
• Automated onboarding and offboarding for HR teams

FAQ

What is the difference between a directory service and an identity provider?

A directory stores the identities. An identity provider authenticates them and issues tokens to applications. Modern products such as Entra ID and Okta do both at once.

Is LDAP a directory service?

LDAP is the protocol used to query a directory, not the directory itself. OpenLDAP and Active Directory are directory services that speak LDAP.

Can a company have several directories?

Yes, and most do. A common setup is Active Directory on premises, Entra ID or Google Workspace in the cloud, plus separate user stores inside individual SaaS applications.

Does a directory service manage SaaS licenses?

No. It manages identities and groups. Matching those identities to paid seats, actual usage, and renewal dates is a SaaS management function, not a directory one.

Request a demo