---
title: "Configure AD account provisioning in Self-service"
slug: "self-service-how-to-configure-ad-account-provisioning"
updated: 2026-11-06T17:34:45Z
published: 2026-11-06T17:34:45Z
canonical: "docs.senhasegura.io/self-service-how-to-configure-ad-account-provisioning"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure AD account provisioning in Self-service

Set up **AD Account Provisioning** so users can create an Active Directory account from the Self-service panel. Segura™ names each account with a username mask and creates it on a target device. These requests are approved automatically.

## Requirements

- Self-service enabled. More information in [Configure Self-service](/v4-2/docs/self-service-how-to-configure).
- A domain registered in Segura.
- A target device in that domain, such as a domain controller, where Segura creates the account.
- A credential with permission to create accounts in the domain, to use as the authentication credential.
- At least one global approver, to receive the provisioning emails.

## Configure the provisioning settings

1. In Segura™, on the navigation bar, hover over the **Product Menu** and select **Settings**.
2. In the side menu, select **Access control > Access Self-service > Settings**.
3. In **Request types**, turn on **Enable AD Account Provisioning request**. The provisioning fields appear.
4. Fill in the provisioning fields. **Domain**, **Target device**, and **Authentication credential** are required:
  1. **Credential type**: the type of credential Segura creates.
  2. **Domain**: the domain of the new account.
  3. **Target device**: the device where Segura creates the account.
  4. **Change plugin**: the plugin used to change the password or credential. Required when you select a template.
  5. **Credential creation template**: the template for the new credential, if any. It must belong to the selected change plugin.
  6. **Authentication credential**: the credential Segura uses to create the account.

## Define the username mask

The username mask sets the name of each account. Combine fixed text with two markers:

- `[#VARIABLE#]`: replaced by the variable the user picks as **Identification**.
- `[#USERNAME#]`: replaced by the requester's username.

For example, the mask `[#VARIABLE#]_[#USERNAME#]` with the variable `adm` creates the account `adm_jdoe` for the user `jdoe`.

1. In **Username mask**, enter the mask. This field is required.
2. In **Variables**, click **Add** and enter a value. Repeat for each value users can pick.

Each variable appears to users as an **Identification** option. Variables cannot be empty or repeated. Segura ignores uppercase and lowercase when it compares them.

Click **Save**.

## Verify your results

1. Open **Desktop > Access Self-service > Panel** and select the **AD Account Provisioning** card.
2. Pick an **Identification**, write a justification, and submit the request.
3. On the panel, in **My requests**, check the request status. The request shows **Pending** while Segura runs the provisioning, then **Executed** or **Error**. When it shows **Executed**, the account exists in the domain.

If the request shows **Error**:

1. Open **Actions** and select **Details**. Note the execution code.
2. Find the operation with that code in the operations report to see why it failed.
3. Check the domain, target device, and authentication credential in the settings.
4. Ask the requester to restart the request. Only the requester can restart it: on the panel, in **My requests**, they open **Actions** and select **Restart execution**.

## Related topics

- [Self-service settings](/v4-2/docs/settings-self-service)
- [Self-service requests](/v4-2/docs/self-service-about)
- [About Active Directory](/v4-2/docs/about-active-directory)