diff --git a/api/src/controllers/information-sharing-agreements-controller.ts b/api/src/controllers/information-sharing-agreements-controller.ts
index 6da92694..62c0d5dd 100644
--- a/api/src/controllers/information-sharing-agreements-controller.ts
+++ b/api/src/controllers/information-sharing-agreements-controller.ts
@@ -120,11 +120,7 @@ export class InformationSharingAgreementsController extends BaseController<Infor
       }
 
       const permittedAttributes = policy.permitAttributes(this.request.body)
-      await UpdateService.perform(
-        informationSharingAgreement,
-        permittedAttributes,
-        this.currentUser
-      )
+      await UpdateService.perform(informationSharingAgreement, permittedAttributes, this.currentUser)
 
       const serializedInformationSharingAgreement = ShowSerializer.perform(
         informationSharingAgreement
diff --git a/api/src/controllers/users/directory-users-controller.ts b/api/src/controllers/users/directory-users-controller.ts
new file mode 100644
index 00000000..9f815100
--- /dev/null
+++ b/api/src/controllers/users/directory-users-controller.ts
@@ -0,0 +1,39 @@
+import { isEmpty, isNil } from "lodash"
+
+import logger from "@/utils/logger"
+import { Users } from "@/services"
+import { ReferenceSerializer } from "@/serializers/users"
+import BaseController from "@/controllers/base-controller"
+
+export class DirectoryUsersController extends BaseController {
+  async create() {
+    try {
+      // Only internal (Yukon Government) staff name Manager contacts on agreements, matching
+      // who may author an ISA, so this endpoint is gated the same way. See TK-66.
+      if (this.currentUser.isExternal) {
+        return this.response.status(403).json({
+          message: "You are not authorized to resolve directory users",
+        })
+      }
+
+      const { email } = this.request.body
+      if (isNil(email) || isEmpty(email)) {
+        return this.response.status(422).json({
+          message: "email is required",
+        })
+      }
+
+      const user = await Users.EnsureFromDirectoryEmailService.perform(email, this.currentUser)
+      return this.response.status(201).json({
+        user: ReferenceSerializer.perform(user),
+      })
+    } catch (error) {
+      logger.error(`Error resolving directory user: ${error}`, { error })
+      return this.response.status(422).json({
+        message: `Error resolving directory user: ${error}`,
+      })
+    }
+  }
+}
+
+export default DirectoryUsersController
diff --git a/api/src/controllers/users/index.ts b/api/src/controllers/users/index.ts
index d5311c07..87c59ed8 100644
--- a/api/src/controllers/users/index.ts
+++ b/api/src/controllers/users/index.ts
@@ -1,2 +1,3 @@
 export { DirectorySyncController } from "./directory-sync-controller"
 export { DeactivationController } from "./deactivation-controller"
+export { DirectoryUsersController } from "./directory-users-controller"
diff --git a/api/src/router.ts b/api/src/router.ts
index e95d7839..0916d873 100644
--- a/api/src/router.ts
+++ b/api/src/router.ts
@@ -96,6 +96,9 @@ router
   .delete(Notifications.ReadController.destroy)
 
 router.route("/api/users").get(UsersController.index).post(UsersController.create)
+router
+  .route("/api/users/directory-users")
+  .post(Users.DirectoryUsersController.create)
 router
   .route("/api/users/:id")
   .get(UsersController.show)
diff --git a/api/src/services/users/ensure-from-directory-email-service.ts b/api/src/services/users/ensure-from-directory-email-service.ts
new file mode 100644
index 00000000..54b7d22a
--- /dev/null
+++ b/api/src/services/users/ensure-from-directory-email-service.ts
@@ -0,0 +1,52 @@
+import { isNil } from "lodash"
+
+import { User } from "@/models"
+import { yukonGovernmentIntegration } from "@/integrations"
+import BaseService from "@/services/base-service"
+import { Users } from "@/services"
+
+/**
+ * Resolves a Yukon Government directory email to an internal User record, creating one
+ * from the directory when it does not exist yet. Used to record contract contacts (such
+ * as the ISA Manager) who are sourced from Active Directory. The returned user is not
+ * granted any group membership on its own. See TK-66.
+ */
+export class EnsureFromDirectoryEmailService extends BaseService {
+  constructor(
+    private email: string,
+    private currentUser: User
+  ) {
+    super()
+  }
+
+  async perform(): Promise<User> {
+    const existingUser = await User.findOne({
+      where: { email: this.email },
+    })
+    if (!isNil(existingUser)) {
+      return existingUser
+    }
+
+    const employee = await yukonGovernmentIntegration.fetchEmployee(this.email)
+    if (isNil(employee)) {
+      throw new Error(`No Yukon Government directory record found for email: ${this.email}`)
+    }
+
+    return Users.CreateInternalService.perform(
+      {
+        email: employee.email,
+        firstName: employee.first_name,
+        lastName: employee.last_name,
+        displayName: employee.full_name,
+        department: employee.department,
+        division: employee.division,
+        branch: employee.branch,
+        unit: employee.unit,
+        title: employee.title,
+      },
+      this.currentUser
+    )
+  }
+}
+
+export default EnsureFromDirectoryEmailService
diff --git a/api/src/services/users/index.ts b/api/src/services/users/index.ts
index 2bec3874..2c42b92f 100644
--- a/api/src/services/users/index.ts
+++ b/api/src/services/users/index.ts
@@ -9,5 +9,6 @@ export { DeactivateService } from "./deactivate-service"
 // Special Services
 export { DirectorySyncService } from "./directory-sync-service"
 export { EnsureFromAuth0TokenService } from "./ensure-from-auth0-token-service"
+export { EnsureFromDirectoryEmailService } from "./ensure-from-directory-email-service"
 export { CreateExternalService } from "./create-external-service"
 export { CreateInternalService } from "./create-internal-service"
diff --git a/api/tests/controllers/users/directory-users-controller.test.ts b/api/tests/controllers/users/directory-users-controller.test.ts
new file mode 100644
index 00000000..bf8319b7
--- /dev/null
+++ b/api/tests/controllers/users/directory-users-controller.test.ts
@@ -0,0 +1,105 @@
+import type * as Integrations from "@/integrations"
+
+import { User } from "@/models"
+import { yukonGovernmentIntegration } from "@/integrations"
+
+import { externalOrganizationFactory, userFactory } from "@/tests/factories"
+import { mockCurrentUser, request } from "@/tests/support"
+
+vi.mock("@/integrations", async (importOriginal) => {
+  const actual = await importOriginal<typeof Integrations>()
+  return {
+    ...actual,
+    yukonGovernmentIntegration: {
+      ...actual.yukonGovernmentIntegration,
+      fetchEmployee: vi.fn(),
+    },
+  }
+})
+
+const mockedFetchEmployee = vi.mocked(yukonGovernmentIntegration.fetchEmployee)
+
+describe("api/src/controllers/users/directory-users-controller.ts", () => {
+  describe("DirectoryUsersController", () => {
+    describe("#create", () => {
+      let currentUser: User
+
+      beforeEach(async () => {
+        currentUser = await userFactory.create({ isExternal: false })
+        mockCurrentUser(currentUser)
+      })
+
+      test("returns the existing internal user without creating a duplicate", async () => {
+        const manager = await userFactory.create({
+          email: "manager@example.com",
+          isExternal: false,
+        })
+        const userCountBefore = await User.count()
+
+        const response = await request()
+          .post("/api/users/directory-users")
+          .send({ email: "manager@example.com" })
+
+        expect(response.status).toBe(201)
+        expect(response.body.user.id).toBe(manager.id)
+        expect(response.body.user.email).toBe("manager@example.com")
+        expect(mockedFetchEmployee).not.toHaveBeenCalled()
+        expect(await User.count()).toBe(userCountBefore)
+      })
+
+      test("creates an internal user from the directory when the email is new", async () => {
+        mockedFetchEmployee.mockResolvedValue({
+          full_name: "Jane Manager",
+          first_name: "Jane",
+          last_name: "Manager",
+          organization: null,
+          department: "HPW",
+          division: null,
+          branch: null,
+          unit: null,
+          title: "Director",
+          email: "jane.manager@yukon.ca",
+          suite: "",
+          phone_office: "",
+          fax_office: "",
+          mobile: "",
+          office: "",
+          address: "",
+          po_box: "",
+          community: "",
+          postal_code: "",
+          latitude: null,
+          longitude: null,
+          mailcode: "",
+          manager: "",
+          username: "jmanager",
+        })
+
+        const response = await request()
+          .post("/api/users/directory-users")
+          .send({ email: "jane.manager@yukon.ca" })
+
+        expect(response.status).toBe(201)
+        const createdManager = await User.findOne({ where: { email: "jane.manager@yukon.ca" } })
+        expect(createdManager).not.toBeNull()
+        expect(createdManager?.isExternal).toBe(false)
+        expect(response.body.user.id).toBe(createdManager?.id)
+      })
+
+      test("returns 403 when the current user is external", async () => {
+        const externalOrganization = await externalOrganizationFactory.create()
+        const externalUser = await userFactory.create({
+          isExternal: true,
+          externalOrganizationId: externalOrganization.id,
+        })
+        mockCurrentUser(externalUser)
+
+        const response = await request()
+          .post("/api/users/directory-users")
+          .send({ email: "manager@example.com" })
+
+        expect(response.status).toBe(403)
+      })
+    })
+  })
+})
diff --git a/api/tests/services/users/ensure-from-directory-email-service.test.ts b/api/tests/services/users/ensure-from-directory-email-service.test.ts
new file mode 100644
index 00000000..7b0d19e7
--- /dev/null
+++ b/api/tests/services/users/ensure-from-directory-email-service.test.ts
@@ -0,0 +1,88 @@
+import { yukonGovernmentIntegration } from "@/integrations"
+import { User } from "@/models"
+
+import { userFactory } from "@/tests/factories"
+
+import EnsureFromDirectoryEmailService from "@/services/users/ensure-from-directory-email-service"
+
+vi.mock("@/integrations", () => ({
+  yukonGovernmentIntegration: {
+    fetchEmployee: vi.fn(),
+  },
+}))
+
+const mockedYukonGovernmentIntegration = vi.mocked(yukonGovernmentIntegration)
+
+function buildDirectoryEmployee(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    full_name: "Jane Manager",
+    first_name: "Jane",
+    last_name: "Manager",
+    organization: null,
+    department: "HPW",
+    division: "Digital Services",
+    branch: "Applications",
+    unit: "Platform",
+    title: "Director",
+    email: "jane.manager@yukon.ca",
+    suite: "",
+    phone_office: "",
+    fax_office: "",
+    mobile: "",
+    office: "",
+    address: "",
+    po_box: "",
+    community: "",
+    postal_code: "",
+    latitude: null,
+    longitude: null,
+    mailcode: "",
+    manager: "",
+    username: "jmanager",
+    ...overrides,
+  }
+}
+
+describe("api/src/services/users/ensure-from-directory-email-service.ts", () => {
+  describe("EnsureFromDirectoryEmailService", () => {
+    describe("#perform", () => {
+      test("when a user with the email already exists, returns it without touching the directory", async () => {
+        const currentUser = await userFactory.create()
+        const existingUser = await userFactory.create({ email: "manager@example.com" })
+
+        const result = await EnsureFromDirectoryEmailService.perform(
+          "manager@example.com",
+          currentUser
+        )
+
+        expect(result.id).toEqual(existingUser.id)
+        expect(mockedYukonGovernmentIntegration.fetchEmployee).not.toHaveBeenCalled()
+      })
+
+      test("when no user exists, creates an internal user from the directory record", async () => {
+        const currentUser = await userFactory.create()
+        mockedYukonGovernmentIntegration.fetchEmployee.mockResolvedValue(buildDirectoryEmployee())
+
+        const result = await EnsureFromDirectoryEmailService.perform(
+          "jane.manager@yukon.ca",
+          currentUser
+        )
+
+        expect(result).toBeInstanceOf(User)
+        expect(result.email).toEqual("jane.manager@yukon.ca")
+        expect(result.isExternal).toEqual(false)
+        expect(result.department).toEqual("HPW")
+        expect(result.title).toEqual("Director")
+      })
+
+      test("when no user exists and the directory has no matching record, throws", async () => {
+        const currentUser = await userFactory.create()
+        mockedYukonGovernmentIntegration.fetchEmployee.mockResolvedValue(null)
+
+        await expect(
+          EnsureFromDirectoryEmailService.perform("missing@yukon.ca", currentUser)
+        ).rejects.toThrow("No Yukon Government directory record found")
+      })
+    })
+  })
+})
diff --git a/web/src/api/users-api.ts b/web/src/api/users-api.ts
index a0c143d9..a1daff18 100644
--- a/web/src/api/users-api.ts
+++ b/web/src/api/users-api.ts
@@ -225,6 +225,11 @@ export const usersApi = {
     const { data } = await http.post(`/api/users/${userId}/directory-sync`)
     return data
   },
+
+  async ensureFromDirectory(email: string): Promise<{ user: UserAsReference }> {
+    const { data } = await http.post("/api/users/directory-users", { email })
+    return data
+  },
 }
 
 export default usersApi
diff --git a/web/src/components/information-sharing-agreements/InformationSharingAgreementBasicInformationEditCard.vue b/web/src/components/information-sharing-agreements/InformationSharingAgreementBasicInformationEditCard.vue
index a1a01d09..f219bfe4 100644
--- a/web/src/components/information-sharing-agreements/InformationSharingAgreementBasicInformationEditCard.vue
+++ b/web/src/components/information-sharing-agreements/InformationSharingAgreementBasicInformationEditCard.vue
@@ -115,14 +115,13 @@
           cols="12"
           md="6"
         >
-          <UserSearchableAutocomplete
-            :model-value="internalGroupSecondaryContactId"
+          <YukonGovernmentEmployeeSearchableAutocomplete
+            :model-value="internalGroupSecondaryContactEmail"
             label="Yukon Government (YG) Manager Contact Name *"
-            :where="internalGroupSecondaryContactWhere"
-            hint="Typically the manager of the primary YG contact, but can be any appropriate internal contact."
+            hint="Typically the manager of the primary YG contact, but can be any appropriate internal contact. Search the Active Directory."
             :rules="[required]"
             required
-            @update:model-value="emit('update:internalGroupSecondaryContactId', $event)"
+            @update:model-value="emit('update:internalGroupSecondaryContactEmail', $event)"
           />
         </v-col>
       </v-row>
@@ -140,6 +139,7 @@ import useUser from "@/use/use-user"
 import UserSearchableAutocomplete, {
   type UserAsIndex,
 } from "@/components/users/UserSearchableAutocomplete.vue"
+import YukonGovernmentEmployeeSearchableAutocomplete from "@/components/yukon-government-directory/YukonGovernmentEmployeeSearchableAutocomplete.vue"
 
 const props = defineProps<{
   title: string | null | undefined
@@ -148,7 +148,7 @@ const props = defineProps<{
   externalGroupContactTitle: string | null | undefined
   internalGroupContactId: number | null | undefined
   internalGroupContactTitle: string | null | undefined
-  internalGroupSecondaryContactId: number | null | undefined
+  internalGroupSecondaryContactEmail: string | null | undefined
 }>()
 
 const emit = defineEmits<{
@@ -158,7 +158,7 @@ const emit = defineEmits<{
   "update:externalGroupContactTitle": [value: string | null | undefined]
   "update:internalGroupContactId": [value: number | null | undefined]
   "update:internalGroupContactTitle": [value: string | null | undefined]
-  "update:internalGroupSecondaryContactId": [value: number | null | undefined]
+  "update:internalGroupSecondaryContactEmail": [value: string | null | undefined]
 }>()
 
 const { externalGroupContactId } = toRefs(props)
@@ -183,9 +183,6 @@ const externalGroupContactWhere = computed(() => ({
 const internalGroupContactWhere = computed(() => ({
   isExternal: false,
 }))
-const internalGroupSecondaryContactWhere = computed(() => ({
-  isExternal: false,
-}))
 
 function updateExternalGroupContactTitle(user: UserAsIndex | null) {
   if (isNil(user)) {
diff --git a/web/src/components/yukon-government-directory/YukonGovernmentEmployeeSearchableAutocomplete.vue b/web/src/components/yukon-government-directory/YukonGovernmentEmployeeSearchableAutocomplete.vue
index a14dfe5c..b59dad34 100644
--- a/web/src/components/yukon-government-directory/YukonGovernmentEmployeeSearchableAutocomplete.vue
+++ b/web/src/components/yukon-government-directory/YukonGovernmentEmployeeSearchableAutocomplete.vue
@@ -3,9 +3,9 @@
     :model-value="modelValue"
     :loading="isLoading"
     :items="allItems"
-    label="Search Active Directory"
+    :label="label"
     placeholder="Start typing name or email..."
-    hint="Pre-populates user information directly from the directory."
+    :hint="hint"
     item-value="email"
     item-title="email"
     prepend-inner-icon="mdi-magnify"
@@ -55,9 +55,17 @@ import useYukonGovernmentEmployees, {
   type YukonGovernmentEmployeeQueryOptions,
 } from "@/use/yukon-government-directory/use-yukon-government-employees"
 
-const props = defineProps<{
-  modelValue: string | null | undefined
-}>()
+const props = withDefaults(
+  defineProps<{
+    modelValue: string | null | undefined
+    label?: string
+    hint?: string
+  }>(),
+  {
+    label: "Search Active Directory",
+    hint: "Pre-populates user information directly from the directory.",
+  }
+)
 
 const emit = defineEmits<{
   "update:modelValue": [email: string | null | undefined]
diff --git a/web/src/pages/information-sharing-agreements/InformationSharingAgreementEditBasicInformationPage.vue b/web/src/pages/information-sharing-agreements/InformationSharingAgreementEditBasicInformationPage.vue
index aa54e362..fa4b8857 100644
--- a/web/src/pages/information-sharing-agreements/InformationSharingAgreementEditBasicInformationPage.vue
+++ b/web/src/pages/information-sharing-agreements/InformationSharingAgreementEditBasicInformationPage.vue
@@ -90,11 +90,10 @@
         cols="12"
         md="6"
       >
-        <UserSearchableAutocomplete
-          v-model="informationSharingAgreement.internalGroupSecondaryContactId"
+        <YukonGovernmentEmployeeSearchableAutocomplete
+          v-model="managerEmail"
           label="Yukon Government (YG) Manager Contact Name *"
-          :where="internalGroupSecondaryContactWhere"
-          hint="Typically the manager of the primary YG contact, but can be any appropriate internal contact."
+          hint="Typically the manager of the primary YG contact, but can be any appropriate internal contact. Search the Active Directory."
           :rules="[required]"
           required
         />
@@ -131,19 +130,21 @@
 </template>
 
 <script setup lang="ts">
-import { computed, useTemplateRef } from "vue"
+import { computed, ref, useTemplateRef, watch } from "vue"
 import { useRouter } from "vue-router"
 import { useDisplay } from "vuetify"
-import { isNil } from "lodash"
+import { isEmpty, isNil } from "lodash"
 
 import { required } from "@/utils/validators"
 
 import useInformationSharingAgreement from "@/use/use-information-sharing-agreement"
 import useSnack from "@/use/use-snack"
+import usersApi from "@/api/users-api"
 
 import UserSearchableAutocomplete, {
   type UserAsIndex,
 } from "@/components/users/UserSearchableAutocomplete.vue"
+import YukonGovernmentEmployeeSearchableAutocomplete from "@/components/yukon-government-directory/YukonGovernmentEmployeeSearchableAutocomplete.vue"
 
 const props = defineProps<{
   informationSharingAgreementId: string
@@ -156,15 +157,28 @@ const { informationSharingAgreement, isLoading, save } = useInformationSharingAg
   informationSharingAgreementIdAsNumber
 )
 
+const managerEmail = ref<string | null | undefined>(undefined)
+
+watch(
+  () => informationSharingAgreement.value?.internalGroupSecondaryContactId,
+  async (secondaryContactId) => {
+    if (isNil(secondaryContactId)) {
+      managerEmail.value = undefined
+      return
+    }
+
+    const { user } = await usersApi.get(secondaryContactId)
+    managerEmail.value = user.email
+  },
+  { immediate: true }
+)
+
 const externalGroupContactWhere = computed(() => ({
   isExternal: true,
 }))
 const internalGroupContactWhere = computed(() => ({
   isExternal: false,
 }))
-const internalGroupSecondaryContactWhere = computed(() => ({
-  isExternal: false,
-}))
 
 function updateExternalGroupContactTitle(user: UserAsIndex | null) {
   if (isNil(informationSharingAgreement.value)) return
@@ -200,6 +214,15 @@ async function saveWrapper() {
   }
 
   try {
+    if (isNil(informationSharingAgreement.value)) return
+
+    if (!isNil(managerEmail.value) && !isEmpty(managerEmail.value)) {
+      const { user } = await usersApi.ensureFromDirectory(managerEmail.value)
+      informationSharingAgreement.value.internalGroupSecondaryContactId = user.id
+    } else {
+      informationSharingAgreement.value.internalGroupSecondaryContactId = null
+    }
+
     await save()
     snack.success("Basic Information updated.")
 
diff --git a/web/src/pages/information-sharing-agreements/InformationSharingAgreementNewPage.vue b/web/src/pages/information-sharing-agreements/InformationSharingAgreementNewPage.vue
index 88c08231..37fd8701 100644
--- a/web/src/pages/information-sharing-agreements/InformationSharingAgreementNewPage.vue
+++ b/web/src/pages/information-sharing-agreements/InformationSharingAgreementNewPage.vue
@@ -20,9 +20,7 @@
           v-model:internal-group-contact-title="
             informationSharingAgreementAttributes.internalGroupContactTitle
           "
-          v-model:internal-group-secondary-contact-id="
-            informationSharingAgreementAttributes.internalGroupSecondaryContactId
-          "
+          v-model:internal-group-secondary-contact-email="managerEmail"
           class="border"
         />
       </v-col>
@@ -63,6 +61,7 @@ import { VForm } from "vuetify/components"
 import informationSharingAgreementsApi, {
   type InformationSharingAgreement,
 } from "@/api/information-sharing-agreements-api"
+import usersApi from "@/api/users-api"
 
 import useBreadcrumbs, { BASE_CRUMB } from "@/use/use-breadcrumbs"
 import useSnack from "@/use/use-snack"
@@ -76,9 +75,10 @@ const informationSharingAgreementAttributes = ref<Partial<InformationSharingAgre
   externalGroupContactTitle: undefined,
   internalGroupContactId: undefined,
   internalGroupContactTitle: undefined,
-  internalGroupSecondaryContactId: undefined,
 })
 
+const managerEmail = ref<string | null | undefined>(undefined)
+
 const form = useTemplateRef("form")
 const isLoading = ref(false)
 const snack = useSnack()
@@ -105,9 +105,15 @@ async function saveAndGoToEditPage() {
 
   isLoading.value = true
   try {
-    const { informationSharingAgreement } = await informationSharingAgreementsApi.create(
-      informationSharingAgreementAttributes.value
-    )
+    const attributes: Partial<InformationSharingAgreement> = {
+      ...informationSharingAgreementAttributes.value,
+    }
+    if (!isNil(managerEmail.value) && !isEmpty(managerEmail.value)) {
+      const { user } = await usersApi.ensureFromDirectory(managerEmail.value)
+      attributes.internalGroupSecondaryContactId = user.id
+    }
+    const { informationSharingAgreement } =
+      await informationSharingAgreementsApi.create(attributes)
     snack.success("Information Sharing Agreement created.")
     await router.push({
       name: "information-sharing-agreements/InformationSharingAgreementEditDurationPage",