Change Password Notifier for Active Directory FAQ

Below are common questions about setting up Change Password Notifier for Active Directory (CPN for AD) on devices in your organization.

Outbound traffic allowlist: Which URLs does CPN for AD need to call from my AD domain controllers?

• The API to get the OAuth2 token needed to authorize the request: https://oauth2.googleapis.com/token
• The device token API: https://chromedevicetoken.googleapis.com/v1/users:invalidateToken

Inbound traffic allowlist: Is there a need to allow inbound traffic to my domain controllers?

No.

Which of my domain controllers do I need to install CPN for AD on?

You must install CPN for AD on all domain controllers that might be used for password changes from your ChromeOS users.

Is there any alternative to CPN for AD to keep passwords in sync with my ChromeOS devices?

There are some integrations with major identity providers and an API for integration with custom identity solutions available. For details, see step 1 in Keep local ChromeOS and SAML SSO passwords in sync.

Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.