---
title: "AD | RapidIdentity Cloud Password Sync"
slug: "ad-rapididentity-cloud-password-sync"
tags: ["RapidIdentity Cloud", "Cloud password sync", "Filter", "Best Practices"]
updated: 2023-06-21T16:02:06Z
published: 2023-06-21T16:02:06Z
canonical: "help.rapididentity.com/ad-rapididentity-cloud-password-sync"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AD | RapidIdentity Cloud Password Sync

The RapidIdentity Cloud solution provides the option for a password sync. This allows for password changes made locally to be synced to the RapidIdentity Cloud Store and for changes from the RapidIdentity Cloud to be synced down to on-premises accounts, such as Active Directory.

### RapidIdentity Password Filter

By default, the password changes made in the RapidIdentity Cloud Portal will only change the password in the RapidIdentity Cloud store. To implement the AD <-> RapidIdentity Cloud password sync option, a password filter will need to be installed on all domain controllers in the Active Directory environment. The RapidIdentity Password Filter facilitates a password sync across the Identity Bridge. Once installed, the filter catches any password changes in an on-premises directory, encrypts the password, and writes the encrypted password to a special attribute on each user's account in the on-prem directory. The RapidIdentity Cloud will monitor for any changes on this attribute. When a change occurs, the updated password will sync up and be updated in Cloud and will update Target Systems.

Installation Guide: [RapidIdentity Password Filter](https://ri-doc-lts-html5.identitymgmt.net/en/install-the-active-directory-password-filter.html)

### Testing the AD <> Rapid Identity Cloud Password Sync

Confirm that the password sync is working correctly by testing both downstream and upstream changes occur.

#### Downstream

- Sign into RapidIdentity Cloud Portal and login as a user
- Change the user’s password in the Portal
- Confirm that the new password flows downstream to AD

#### Upstream

- Change password for a user on premise in either AD or RapidIdentity on-prem
- After a minute, confirm that the user can use this new password to log into the RapidIdentity Cloud Portal

### Notes

- Customers using Open-LDAP may require additional configuration for a password sync.
- The AD <> RI Cloud PW Sync option can be used in the case of AD Domain Controllers hosted by Azure.
- The password filter is not retroactive, users will still have to claim their accounts or an initial password will need to be set in the RapidIdentity Cloud.