# Controlling user access via Azure AD groups **URL:** \ **Category:** Pritunl VPN\ **Created:** [July 20, 2022, 12:45am UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255 "2022-07-20T00:45:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![wallet](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/w/e99b99/32.png) [@wallet](https://forum.pritunl.com/u/wallet)\ **Post date:** [July 20, 2022, 12:45am UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255/1 "2022-07-20T00:45:26Z")
Okay, so I am trying to get authentication via Azure AD working. Am I right in saying that AD group membership is only checked on the first login attempt for a user and never checked again? I have tested this by removing the user from the AD group, and I have even removed the group from the Pritunl settings - it still allowed the user to login. Is it also true that AD support does not include actual Pritunl client connections? There is no way to link a group to a server and then only allow users that are members of that AD group to connect? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [July 20, 2022, 6:31pm UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255/2 "2022-07-20T18:31:20Z")
Organizations represent certificate authorities, changing a users organization requires issuing a new certificate and private key. This can’t be done during connection. If a user logs into the web console with single sign-on and the group has changed the user will be moved to a new organization. If the [**groups mode**](https://forum.pritunl.com/t/cannot-find-how-to-set-up-user-groups/231/2) is configured the Azure API would be used to update the users groups on connection. You also need to configure groups on the server. If a server has no groups configure the user groups will never be checked. ---
**Author:** ![wallet](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/w/e99b99/32.png) [@wallet](https://forum.pritunl.com/u/wallet)\ **Post date:** [July 25, 2022, 12:13am UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255/3 "2022-07-25T00:13:41Z")
So essentially, SSO is only for the web interface and not for the VPN client? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [July 25, 2022, 1:57am UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255/4 "2022-07-25T01:57:56Z")
The Azure API is used for every VPN connection, disabled or deleted users in Azure cannot connect. The groups mode can be used to also validate the user groups on each connection. The certificate is sufficient for authenticating the user to the VPN server. This design is required to maintain compatibility with all OpenVPN clients. There’s several multi-factor authentication options that will provide additional authentication for connections. ---
**Author:** ![meerkataries](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/9e8a1a/32.png) [@meerkataries](https://forum.pritunl.com/u/meerkataries)\ **Post date:** [July 27, 2022, 10:46pm UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255/5 "2022-07-27T22:46:39Z")
Oh, that’s nice information. Thanks Zach, I need to test this now 🙂 ---
**Author:** ![Fane](https://forum.pritunl.com/user_avatar/forum.pritunl.com/fane/32/296_2.png) [@Fane](https://forum.pritunl.com/u/Fane)\ **Post date:** [February 3, 2023, 9:09pm UTC](https://forum.pritunl.com/t/controlling-user-access-via-azure-ad-groups/255/6 "2023-02-03T21:09:08Z")
Did it work? If you disable a user in Azure AD I’d expect the VPN connection would fail on authentication. Is this correct?