How to import users and structure from 1C into Bitrix24?

Question

Bitrix24

Is there a way to import users along with structure from Active Directory or 1C?
Let's imagine that we need to add 3000 users to Bitrix... I really don't want to do it individually for each user, scatter each one to a certain department, etc.

Are there paid or free tools for this?

Answer 1

Yes, in Bitrix24 it is possible to import the organizational structure and users from 1C, there is even a linking of these users by login with a specific established domain, however, in practice, regular tools for a group of companies are not suitable. Such works are carried out on a turnkey basis for each company by integrator partners.
From myself I can add the following:
1. If you want there to be no problems, then the supplier of users (profiles) and organizational structures should be 1C. And it must be exactly one system, because several similar source systems cause a collapse in B24.
2. If you want to use multiple AD domains, then leave only the minimum set of fields - activity flag, login. AD should act solely as an authorization server, so no exchange with periodicity, building an organizational structure and creating users on the portal. Only activity and binding to groups.
3. To bind, create in advance at least 3 groups in each AD: "bitrix users", where include all users who should be mapped to the group of employees, "bitrix admins" these are those users from among the "bitrix users" who should become admins on the portal and "bitrix ignored" (accounts that will be ignored).
- If the user is to become an admin - to the "bitrix users" and "bitrix admins" groups.
- If the account does not need to be tightened in B24, then we write it in "bitrix ignored" and, accordingly, it is in the exceptions. Remember, if a user is both in the ignored and users groups, then he will not get to the portal.
Regarding SSO to multi-domain structures (just to open the portal and be immediately authorized), this is not easy.
Either you need to break BitrixVM by connecting Kerberos, or you need to cut your module for some KeyCloak / ADFS or other authorization provider. Regular NTLMv2 works with only one domain (the one in which the server is entered).