Domains and Organizational Units

Domains and organizational units are included in the internal database to mirror the hierarchical organization of your company.

Organizational units are designed to hold user accounts and authenticator records. They allow to group users according to department, job function, or other criteria. They also allow authenticators to be allocated for auto-assignment to single or multiple groups of users. Both, domains and organizational units can be used to limit administrators to a group of users and/or authenticators.

Figure: Domains and organizational units

There are two differences between domains and organizational units:

1. All user accounts and authenticator records must belong to a domain. User accounts and records do not have to belong to an organizational unit.
2. The domain is used to identify user accounts, whereas organizational units are not. This means that two user accounts with the same name can only exist if they are in different domains.