Keep Bitwarden Directory Connector’s desktop and scheduled CLI runs from competing

The desktop app and CLI share local configuration, so treat them as one synchronization workflow.

Source facts

Bitwarden Directory Connector pulls users, groups, and associations from a supported source directory. It can run on demand or at a configured interval and can be configured to remove disabled users from the organization without deleting their accounts. The desktop app and CLI share their database and configuration, and Bitwarden does not recommend using them simultaneously on one machine. Its documented approach is to configure and test with the desktop app, then use the CLI to schedule production synchronization.

Source: Bitwarden — Directory Connector.

Applicability

This applies to Bitwarden Directory Connector, not SCIM or SSO authentication. A scheduled process still needs access to the chosen directory and the organization’s provisioning credentials.

DSE recommendation

DSE recommends naming one synchronization host and one operational owner. Complete a reviewed configuration in the desktop app, record the intended source and scope, then document how the scheduled CLI obtains that same configuration. Pause the scheduled task while making controlled desktop changes rather than running competing sessions. Review removal behavior before enabling automatic production runs, and maintain a protected change record for configuration and credential updates. Monitor completion and failures so a silent stalled task does not leave identity changes unapplied.

Verification

Use test users and groups to compare a desktop run with the intended scheduled CLI run, one at a time. Confirm the configured source scope and handling of a disabled test user. Verify that the schedule reports success or failure and that an administrator knows how to pause it during maintenance.

Official reference

Bitwarden — Directory Connector. Reviewed October 15, 2026.