Importing Employees using the Azure AD Connector
In this feature, Azure AD currently operates using web scripts, which are deprecated starting with release 2026.1. Extended support will remain available until release 2026.2. To continue using the Azure AD Import feature, refer to Azure AD Import.
Role: Administrator
Minimum Version: 2022.4.
Package Installation: Existing customers - import the latest package from the Ivanti Marketplace - Azure AD Employee Import for Service Manager.
Configuring and setting up the required permissions from the Azure Portal
To create the application:
- From the Azure portal, navigate to the Azure Active Directory > App Registrations.
- Click New registration and enter the name for the application.
- Click the Register button.
- Once the application is created, the following details are displayed:
- Client ID - Remember to note down the client ID somewhere safe.
- Tenant ID - Remember to note down the Tenant ID somewhere safe.
- Client Secret ID: Unique client secret ID. Refer to the next procedure for how to create one.
To create a Client Secret ID:
- Click Add a certificate or secret.
- Under Client Secrets, click on new client secret and enter a description.
- Select the Add button to add this Client Secret ID, but before that, remember to check when it expires, as once it exceeds the expiry date, you will need to create a new Client Secret.
Ensure you make a note of the Client Secret value and save it somewhere safe, as it is not accessible later.
To add the necessary permissions:
Once the application is created and the information in the previous section is noted, the next step is to add the necessary permissions required in the Permission tab.
- Under App Registrations in Owner Applications, open the application which you just created in the previous section.
- In the left panel under Manage, open API permissions.
- Select Add permissions > Microsoft Graph > Application Permissions > Directory > Directory.Read.All > Add Permissions.
- Navigate to the Azure Active Directory > App Registrations > Owner Applications.
- Under Owner Applications, click the present application, and you will be able to see the Client ID, Tenant ID and the Client Secret ID.
In case you forgot or lost the Client Secret ID, you must create a new one.
Once the Azure configuration is completed, the next step is to configure the ITSM platform.
- Login to ITSM as an Administrator.
- Open the Configuration Console.
- Generate an API Key:
a. Navigate to Security Controls > API Keys.
b. Click Add Key Group and enter a contextual name.
c. Click Add API Key under the group you just created and enter the description.
When creating a key, ensure you create it with a user who has an Administrator role and ensure the In Role field is set to an Admin role.
- Click Save.
To get a comprehensive understanding of importing employees using the Azure AD connector, it is important that you understand what each field in the Azure AD employee connector does.
Field | Description |
|---|---|
Enabled | This enables the connector to import employees. |
Test Mode | This is only used if you want to test the connector and sync 10 employees. Only the first 10 employees will be synced everytime you run the test. |
Client ID | As mentioned in Configurations/Permissions Required from Azure Portal section. |
Tenant ID | As mentioned in Configurations/Permissions Required from Azure Portal section. |
Client Secret | As mentioned in Configurations/Permissions Required from Azure Portal section. |
API Key | This is the API key generated from Ivanti ITSM and used to authenticate communications between ITSM and Azure AD. |
Primary Key | This key is used as a unique identifier to sync data from Azure to ITSM. |
AD filter | This is used to filter the results fetched from Azure AD. Example: If you want to add a filter to not import inactive users, then the filter value would be: {Azure AD Field} accountEnabled eq true For more information on using filters, refer to the Microsoft document Use the filter query parameter. In the examples shown here, the ones marked * are not supported; they are part of the advanced query capabilities. |
ISM Employee Field | This drop down shows the list of fields in the employee business object. |
Azure AD fields | This drop down shows the list of fields which can currently sync from Azure AD. |
Fixed Value | Once checked, you can set a fixed value to sync employees. Example: Team is a mandatory field in ITSM, but there is no real value from Azure to sync to team, hence you can add a fixed value for syncing to work. |
Do not update field | Once Do not update is enabled for an added mapping, the Employee field selected in the mapping will not be updated after the first insert of the employees. |
- Open the Azure AD Employee Connector workspace.
- Select the Enabled check box.
- Create an API Key on the tenant with admin access.
- Enter values in the Client ID, Client Tenant ID, and Client Secret fields.
You can get these values from your Azure Client account.
- Enter the API key.
- Under the Please select only one option below section, select any one of the listed options as the Primary Key.
Ensure you select only one option.
- AD Filter - use this field to enter the filter details to filter results fetched from Azure AD.
For example, to filter out inactive users from getting imported, enter the following query:
{Azure AD Field}
accountEnabled eq true
For more information on using filters, refer to the Microsoft document Use the filter query parameter.
Currently, advanced query capabilities on Azure AD directory objects is not supported. Refer to the Microsoft document Advanced query capabilities on Azure AD directory objects. Documentation will be updated when it is made available.
- A list of pre-mapped fields are displayed. You can add custom fields using:
- ISM Employee Field - field in ITSM that should be mapped.
- Azure AD Fields - field in Azure AD that should be mapped.
- Select the Fixed Value field and enter a value if there is no value for the Azure AD Field with respect to the Neurons for ITSM field.
- Click Add Mapping. The mapped fields are displayed in the Field Mappings tab.
For the import to work, add mappings to mandatory fields of the employees.
Example:
- In the ISM Employee Field select Team
- In the Is Fixed - True
- Fixed Value - QA
If QA is not a team in your organization, enter an existing team as the default value instead.
Do not update Field - when this check box is selected, the fields are updated only the first time upon inserting the fields. The next time onwards, it is ignored.
- Save and exit by clicking List View.
- From the Action Menu drop-down, select Execute Employee Import.
- Open the record to check the import status.
After importing, the records are fetched in the Queue tab of the record. After which, they go into the Employee workspace.
- Click the Queue tab. If the RunOutPut field displays Completed without errors, the import was successful.
The employee records will be fetched in the Employee workspace.
The Ivanti Azure AD Daily Schedule is scheduled to run every day; therefore, the records are updated daily.
If you get the Invalid Input error message while trying to import the Azure AD employees, it means the import failed. This happens if the Server URL field (not visible in the UI, present in the backend) in the Azure AD Employee Connector workspace is not populated with an appropriate value.
To fix the issue:
- From the Azure AD Employee Connector workspace list view, run the SET SERVER URL Quick Action.
This sets the appropriate value in the Server URL field, which resolves the issue.