# directory-service

Source: https://startwithidentity.com/glossary/directory-service/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

A directory service is the system that stores an organization's identities and their attributes (users, groups, devices, service accounts) in one queryable database, and answers lookups and authentication requests from other systems. Most directory services follow the X.500 data model and are accessed with [LDAP](https://startwithidentity.com/glossary/ldap/), which [RFC 4511](https://www.rfc-editor.org/rfc/rfc4511) describes as providing "access to distributed directory services that act in accordance with X.500 data and service models."

The best-known example is [Active Directory](https://startwithidentity.com/glossary/active-directory/) Domain Services, which adds Kerberos authentication and Group Policy on top of the directory. Open-source options include OpenLDAP, 389 Directory Server and [FreeIPA](https://startwithidentity.com/vendors/open-source/freeipa/). Cloud directories, such as [Microsoft Entra ID](https://startwithidentity.com/vendors/iam/microsoft-entra/), [Okta](https://startwithidentity.com/vendors/iam/okta/) Universal Directory or [JumpCloud](https://startwithidentity.com/vendors/iam/jumpcloud/), keep the "one source of identity" role but expose it through SAML, OIDC and [SCIM](https://startwithidentity.com/glossary/scim/) instead of LDAP binds.

| A directory service | Not the same as |
|---|---|
| Stores identities and attributes, answers lookups | An [identity provider](https://startwithidentity.com/glossary/identity-provider/), which authenticates users and issues tokens (many products do both) |
| The authoritative store for accounts | An HR system, which is usually the authoritative source for who is employed |
| Often the target of provisioning | An IGA tool, which decides who should have what |

It matters because the directory is tier zero: whoever controls it controls group membership, and therefore access to everything that trusts it. Legacy directories also carry most of the attack paths, such as [Kerberoasting](https://startwithidentity.com/techniques/kerberoasting/) and delegation abuse, so moving apps from LDAP binds to federation is a security project as much as a modernization one. The terms "enterprise directory" and "master directory" usually mean the same thing: the one directory every other system synchronizes from.

See also: [LDAP](https://startwithidentity.com/glossary/ldap/), [Active Directory](https://startwithidentity.com/glossary/active-directory/), [top directory services solutions](https://startwithidentity.com/articles/top-5-directory-services-solutions/), [open-source directory services](https://startwithidentity.com/articles/top-6-open-source-directory-services/), [provisioning](https://startwithidentity.com/glossary/provisioning/)