Microsoft Entra Integration

role administrators minimum version 2024 3 the microsoft entra id import ou to manage your organization's workforce, including full time employees and contractors, by maintaining user identities and access control it also provides flexibility to customize the configuration according to your business needs watch this video for a visual walkthrough of configuring and using the microsoft entra id import configuring microsoft entra id import (5 55) https //www youtube com/watch?v=gel 7hsk9qu prerequisites before configuring microsoft entra id import, ensure that the microsoft entra application has the following microsoft graph api permissions group read all user read all administrativeunit read all you also need the following information client id tenant id client secret configuring azure ad in itsm log in to as an open the configuration console, scroll and select ldap integration > entra id import the entra id import connections page is displayed click setup new entra id connection enter information in the following tabs configuration filter management field mapping schedule and import configuration tab use the configuration tab to configure the connection between itsm and microsoft entra id the remaining tabs are disabled until complete this step delta sync is enabled by default for new connections ivanti recommends enabling the delta sync checkbox for all existing connections on the entra id import configuration tab delta sync improves import performance by importing only delta changes since the previous successful import select the enabled checkbox enter the following information connection name enter appropriate name (minimum of 5 characters) delta sync select this checkbox to enable incremental user import from entra id when delta sync is enabled, the first import performs a full import subsequent imports retrieve only incremental changes client id , tenant id , and client secret enter appropriate details provided by microsoft entra graph api endpoint use the default or enter custom url to connect to import users from the azure portal by interfacing with azure active directory (azure ad) token endpoint use the default or enter custom url to request authentication tokens for secure access use only supported urls when configuring endpoints to match your domain requirements if you change the client id, tenant id, client secret, graph api endpoint or token endpoint while delta sync is enabled, a confirmation message appears the message indicates that the next import will perform a full synchronization instead of an incremental import click save to continue only urls listed in the microsoft graph national cloud deployments https //learn microsoft com/en us/graph/deployments are supported if you enter unsupported urls, the test connection fails and display an error select primary key select one of the following options as the unique identifier entra id, upn, and email you can also apply advanced query filters using the azure ad http request string example 1 to import active users from a specific domain endswith(userprincipalname,'@ivanti com') and accountenabled eq true result the import includes only active users in the ivanti com domain disabled accounts and users from other domains are excluded example 2 to import users by department or location (accountenabled eq true and department eq 'it') or city eq 'london' result the import includes only active users in the users in the it department and users located in london, regardless of department select reset delta to reset the synchronization progress in the confirmation message, select ok to continue the next import performs a full synchronization instead of an incremental import click test connection to validate the provided information a success message confirms the connection details are correct click save this saves the configuration, but the connection remains inactive until further steps are completed full synchronization continues to work as designed and supports advanced query filters, such as endswith , by default to improve full synchronization import performance, create the global constant entraidgetmanagerwithuser and set to true this setting imports users and their managers in a single operation however, this setting does not support advanced query filters before you enable this setting, review and update any filters that rely on advanced query capabilities for more information, refer to working with global constants https //help ivanti com/ht/help/en us/ism/2026/admin user/content/configure/constants/defining global constant htm filter management tab use the filter management tab to define and apply filter conditions by using microsoft entra id fields filters help retrieve specific users or groups based on custom criteria you can apply and , or , and httpstring predicates you can select specific groups from which users should be imported only users who are members of the selected groups are included in the import process this also imports azure entra id groups to contact groups business object in itsm microsoft graph sdk is used to connect to apis for more information, refer to make api calls using the microsoft graph sdks https //learn microsoft com/en us/graph/sdks/create requests?tabs=csharp and predicate in a filter query, and predicate is used when all conditions must be true for example, if you want to import only active users located in london, condition 1 accountenabled equals true condition 2 city equals london result only users whose accounts are enabled and whose city is london are included in the results or predicate use this predicate when users can satisfy any one of the specified conditions for example, import users who either have an active account or are located in london condition 1 accountenabled equals true condition 2 city equals london result users whose active users in any location users located in london, even if their accounts are not enabled httpstring predicate use the httpstring predicate to to create advanced filters using microsoft graph query syntax for example, if you want to import users whose display name begins with the letter s and whose account is enabled startswith('s', displayname) and accountenabled eq true result the results include users name staring with s and provided their accounts are enabled view and manage users to filter and view data using the user filter type select the user from the filter type dropdown in the filter condition dropdown, select and , or , or httpstring predicates based on your requirement enter the appropriate details and click preview the preview entra id import window appears, displays all users that match the selected filter criteria user filter considerations when delta sync is enabled, user filter type is supported only during preview user filters are not applied during the actual import when manager information is imported with user data, advanced query filters such as endswith are not supported by the current version of microsoft graph apis for more information, refer to microsoft graph advanced query capabilities on microsoft entra id objects https //learn microsoft com/en us/graph/aad advanced queries?tabs=http view and manage groups to filter and view users by groups select the group from the filter type dropdown in the filter condition dropdown, enter or select the desired one or more groups then click ok a link appears showing the number of selected groups click this link to view the selected group names to remove a group, click close icon next to it to add more filters, use the and , or or , or httpstring predicate, define your filter query and then click preview group filter considerations if you select user as the filter type, the queue displays progress messages immediately if you select group as the filter type, the system adds messages to the queue only after it finishes retrieving all users from azure portal the system updates user information and relationships only when the user belongs to of the selected group you can select up to 50 groups for group based filtering for more information on filter queries and predicates, refer to microsoft graph use the $filter query parameter https //learn microsoft com/en us/graph/filter query parameter?tabs=http and microsoft graph advanced query capabilities on microsoft entra id objects https //learn microsoft com/en us/graph/aad advanced queries?tabs=http field mapping tab this tab is used to set the field mappings from to entra id it consists of both existing and new field mappings for a connection click add mapping select appropriate mappings from ism employee field and map it to entra id fields choose the mapping type map choose from available options fixed value enter a static value to prevent a field from being updated during import, select the do not update checkbox next to the mapping delta sync and field mapping when delta sync is enabled, entra id import detects changes only for fields mapped using the map type in the field mapping tab entra id imports and tracks only these selected fields during the next incremental import add the isentraiddeleted field in the field mapping tab to track deleted users from entra id this works only when delta sync is enabled if you add, delete, or modify any field of map type in the field mapping values of existing connection, the next import will perform a full synchronization instead of an incremental import schedule and import tab this tab allows you to set a schedule or initiate an immediate import you can also enable the import of administrative units schedule an import choose a schedule from the schedule list to run the import as per the time in the selected schedule run an immediate import select save and import to run the import immediately import administrative units select the import administrative units checkbox to import administrative units into the database limitations administrative unit and group imports are not available when delta sync is enabled if an incremental update is not scheduled within 7 days after the initial full synchronization, the next import performs a full synchronization when delta sync is enabled for more information, refer to microsoft user delta https //learn microsoft com/en us/graph/api/user delta?view=graph rest 1 0\&tabs=http