Blazam

Blazam is a free, open-source web application for handing selected Active Directory work to non-IT staff. It is strongest for organizations that need granular permissions and automated directory tasks without a software license; it is a poor fit without a suitable domain-joined Windows host and a coherent OU structure.

Overview

Blazam handles routine administration across users, groups, organizational units, computers, and printers. That includes account unlocks, password resets, group assignments, and attribute changes. Reusable access levels can be assigned to groups or individual users, with permissions controlled by action and attribute. This lets administrators distribute specific tasks rather than grant broad directory access, which is useful when technical staff are overloaded and nontechnical colleagues can take on repeatable requests.

The deployment model is the main qualification. Blazam requires Active Directory and a domain-joined Windows host, and installing it on a Domain Controller is not recommended. Granular delegation also depends on a well-defined OU structure. Organizations that have not established one should treat directory organization as a prerequisite, not expect the app to compensate for it.

Key features

Delegation and automation

Per-action and per-attribute controls make access levels more precise than an all-or-nothing delegation model. Rule-based actions can run after events or on schedules, with filters, ordered processing, conditional stops, and expiration settings. That combination can reduce repetitive administrator work, while still requiring careful configuration of the permissions and rules.

Integration and security

A REST API and webhook notification subscriptions support integration with other systems. API tokens inherit the permissions of the associated Blazam user, and only admins can currently create tokens for existing Blazam users; that is a useful boundary, but it limits who can provision integrations. MFA is supported through Cisco DUO or Google Authenticator-compatible TOTP. Passwords are encrypted at rest and in transit, connections support TLS/SSL, and the application is designed to run under an unprivileged account.

Installation and databases

Windows installation can use IIS or a standalone service; on Linux, the installer supports Apache, nginx, or a standalone service. Documented database choices are SQLite, MSSQL Express, MariaDB, MSSQL, and MySQL, with recommended concurrent-user ceilings for each. The choice gives administrators deployment flexibility, but they need to match the database and expected concurrency to their environment.

Pricing

Free and Open Source: free. The plan is completely free of charge and MIT licensed for personal and commercial use. It includes an on-premises deployment model, delegated administration, AD auditing, lifecycle automation, reporting, and password self-service. There is no free-trial term to weigh against a paid upgrade: Blazam is offered as a free plan. Organizations should instead assess the operational cost of hosting and administering it.

Platforms

Blazam supports API, Linux, self-hosted, web, and Windows environments. Its installers accommodate common web-server setups as well as standalone services, but the required domain-joined Windows host remains a deployment constraint even with Linux installation options.

Who it's for

Blazam suits system administrators who need to delegate recurring Active Directory work to nontechnical staff, especially in organizations with limited software budgets. It is a sensible choice when tighter task-level permissions, automation, and on-premises operation matter more than a hosted service. Organizations without Active Directory, an appropriate domain-joined host, or a usable OU structure should look elsewhere.

Pros and cons

• Pros: No license cost and MIT licensing permit personal and commercial use.
• Pros: Reusable access levels with per-action and per-attribute controls support narrower delegation.
• Pros: Event- and schedule-based rules can automate repeatable directory actions.
• Pros: Multiple installer and database options provide flexibility for on-premises deployments.
• Cons: Active Directory and a domain-joined Windows host are mandatory, and Domain Controller installation is not recommended.
• Cons: Effective granular delegation depends on a well-defined OU structure.
• Cons: API tokens can only be created by admins for existing Blazam users, limiting integration setup to a narrow administrative path.

Alternatives

For a broader category comparison, see Active Directory Management Software. Choose Softerra Adaxes if you need a paid option with a 30-day full-functionality evaluation and technical support. ManageEngine ADSelfService Plus is a better fit when password self-service across mobile and desktop platforms is the priority; its free edition has no expiration and caps coverage at 50 users, unlimited domains, and 10 Endpoint MFA users. For a narrower, free self-service password tool requiring PHP and LDAP connectivity, consider LTB Self Service Password; PWM is another free, open-source password self-service application for LDAP directories. Choose ManageEngine ADAudit Plus when auditing is the central need; its free edition covers 25 workstations. Netwrix Password Secure is an alternative for self-service password management, with pricing starting at $60 a year and a one-year minimum purchase commitment. Consider Specops uReset for annual, volume-based subscriptions, or Cayosoft Administrator when you want a quote-based subscription available for 12, 36, or 72 months.

Verdict

Blazam is a strong fit for budget-conscious organizations that want to delegate and automate Active Directory tasks without purchasing a license. Its permission controls are the clearest reason to choose it; the required Windows host and need for a well-structured OU hierarchy are the reasons to look elsewhere if your environment is not ready for that model.