thank you thank you. I've no idea what I've stumbled across here on this site but you guys have been awesome and the only real help I could find. Much appreciated!

@dustinb3403 I'm able to get a single group to import via LDAP but I can't restrict login to ONLY that group.

We have several thousand users, badly organized, so disabling them after a full import would be a pain.

Ideally I'm looking to import a specific group via LDAP, which works at the moment, and then ONLY allow that group to login, which doesn't work. Anyone from the base DN can also login. I could turn off LDAP integration after doing the initial sync I guess but that means the passwords won't match after they change their AD ones.

I feel like this SHOULD be possible but I'm not sure if I'm missing something obvious again in the settings.

Is it possible to restrict sign-in to only a specific group in AD? The ldap filter only seems to apply for ldap import. No matter what base DN I pick, every user is able to login and account gets created. Eg, only allow login for staff group and not students.