Vendor Domain Join Agreement

VENDOR DOMAIN JOIN AGREEMENT

This Vendor Domain Join Agreement (the Agreement) is entered into by and between Client Name: (Client) and Vendor Name: (Vendor), effective as of the day of , (Effective Date).

RECITALS

WHEREAS, Client maintains an enterprise domain and centralized identity environment (the Domain) and requires that any third-party devices or services joining the Domain comply with Client's security, configuration, and access control requirements; and

WHEREAS, Vendor provides services and/or devices that require domain integration in order to perform contracted work and agrees to comply with the Domain join process, security controls, and oversight defined in this Agreement; and

WHEREAS, the parties desire to set forth the responsibilities, limitations, security obligations, payment, and termination terms applicable to Vendor's joining of the Domain.

SCOPE OF WORK

Vendor shall perform the Domain join activities described below in compliance with Client policies and technical requirements. Vendor must not alter Domain configuration, deploy persistent privileged accounts, or enable lateral access beyond the approved scope without prior written approval from Client.

VENDOR RESPONSIBILITIES

Vendor shall: (a) provide qualified personnel to perform Domain join tasks; (b) follow Client's change control and maintenance windows; (c) ensure all devices meet Client's minimum configuration and patching standards prior to joining; (d) promptly remediate any security issues introduced by Vendor activity; and (e) maintain records of accounts, credentials, and device identifiers used in the Domain join activity for audit by Client on request.

CLIENT RESPONSIBILITIES

Client shall: (a) provide necessary Domain accounts and scoped privileges required to accomplish the approved join activities; (b) supply configuration guidance and acceptance criteria; and (c) perform verification testing and acceptance within a reasonable timeframe following Vendor completion of tasks.

SECURITY AND ACCESS CONTROLS

Vendor shall implement least-privilege access, use unique per-person credentials, and avoid shared or hard-coded credentials. Any elevated privileges granted for Domain join activities must be time-limited and revoked immediately upon completion. Vendor shall encrypt credentials in transit and at rest, and shall not store Domain admin credentials on non-approved devices. Vendor will notify Client within twenty-four (24) hours of any suspected compromise related to Domain activities.

PAYMENT TERMS

TERM AND TERMINATION

This Agreement shall commence on Start Date: and shall continue until End Date: unless earlier terminated as set forth below.

Either party may terminate this Agreement for convenience upon giving written notice to the other party at least days prior to the intended termination date.

Either party may immediately terminate this Agreement for material breach by the other party if such breach is not cured within thirty (30) days after written notice of the breach. Termination for cause does not limit any other remedies available by law or equity.

CONFIDENTIALITY

Each party shall maintain in confidence all Confidential Information disclosed by the other party in connection with this Agreement and shall not use or disclose such information except as necessary to perform its obligations under this Agreement or as required by law. Confidential Information includes, but is not limited to, Domain credentials, network architecture, security controls, and audit records. The confidentiality obligations shall survive termination for a period of years, except that trade secrets shall remain protected for so long as they qualify as trade secrets under applicable law.

INDEMNIFICATION

Vendor shall indemnify, defend, and hold Client harmless from and against any claims, losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees) arising out of Vendor's negligent, willful, or unlawful acts or omissions in performing Domain join activities, including unauthorized access or propagation of malware attributable to Vendor's actions.

LIMITATION OF LIABILITY

EXCEPT FOR LIABILITY ARISING FROM A PARTY'S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR INDEMNIFICATION OBLIGATIONS, NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING UNDER THIS AGREEMENT.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of without regard to conflict of laws principles.

ENTIRE AGREEMENT

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations, and understandings, whether written or oral. Any amendment or modification of this Agreement must be in writing and signed by authorized representatives of both parties.

ADDITIONAL TERMS

Vendor agrees that any accounts, service principals, or machine objects created in the Domain for the purpose of performing this Agreement remain the property of Client and shall be documented and handed back to Client on completion or termination. Vendor will not export schema changes, delegate domain-wide privileges, or create permanent privileged groups without express written consent.

Sign Now