User base management
Starting with BigFix Platform version 11.0.7, the framework includes an enhanced identity aggregation architecture that integrates traditional on-premises Active Directory (AD) environments with modern cloud-based Identity Providers (IdP), specifically Microsoft Entra ID (formerly Azure AD).
This enhancement enables BigFix operators to achieve user-centric endpoint management, advanced dynamic targeting, and global reporting within the BigFix Console, WebUI, BigFix REST APIs, and BigFix Explorer.
Architectural Overview
The identity integration relies on an automated, asynchronous dual-component flow (Server-Side and Client-Side) to map users and groups to physical machines.
Identity Aggregation Service
A scheduled task on the BigFix Server maintains an in-memory cache of directory objects from all configured Identity Providers. This ensures fast lookups and high performance without repeatedly querying external directory systems. At administrator-defined intervals, the server performs a complete data refresh. It iterates through all configured IdPs, querying cloud sources via the Microsoft Graph API and on-premises sources using standard LDAP queries. After each polling cycle, updated directory metadata is packaged into a __metadata file and delivered to the endpoint mailbox only if changes are detected (e.g., changes in group membership or office location), reducing network overhead.
Identity Discovery
The BigFix Client automatically discovers the local system's directory state during initialization. In hybrid scenarios where an endpoint is simultaneously joined to a traditional Active Directory domain and Microsoft Entra ID, the client always gives precedence to Entra ID (Azure AD) information to align with modern cloud-first standards. The discovered identity state is transmitted to the BigFix Server inside a custom HTTP header (x-bigfix-itclient-register-ad-id) during every client registration request.
Server Reserved Properties for Dynamic Targeting
To enable out-of-the-box dynamic targeting and reporting, the framework implements a set of core Server Reserved Properties. These properties automatically handle identity resolution across hybrid directories and evaluate native relevance expressions. If an endpoint cannot be correlated or if an attribute is unpopulated, the properties gracefully return "N/A".
Property Behavior Matrix
| Property Name | Source Object | Active Directory Behavior | Azure AD / Entra ID Behavior | Default Fallback |
| IDP User | Managing User | Returns samAccountName | Returns name (Display Name) | "N/A" |
| IDP Groups | Computer Object | Returns direct group samAccountName list | Returns direct group name list | "N/A" |
| IDP User Groups | Managing User | Returns user group samAccountName list | Returns user group name list | "N/A" |
| IDP Department | Managing User | Returns Department attribute | Returns department metadata | "N/A" |
| IDP Location | Managing User | Returns physicalDeliveryOfficeName | Returns officeLocation metadata | "N/A" |
| IDP Site | Managing User | Synthesizes CO and L (State, City) | Synthesizes state and city | "N/A" |