Microsoft Entra Integration

4 min

Role: Administrators.

Minimum Version: Ivanti Neurons for ITSM 2024.3.

The Microsoft Entra ID Import ou to manage your organization's workforce, including full-time employees and contractors, by maintaining user identities and access control. It also provides flexibility to customize the configuration according to your business needs.

Watch this video for a visual walkthrough of configuring and using the Microsoft Entra ID Import.

https://www.youtube.com/embed/gEl_7Hsk9qU

Configuring Microsoft Entra ID Import (5:55)

Prerequisites

Before configuring Microsoft Entra ID Import, ensure that the Microsoft Entra application has the following Microsoft Graph API permissions:

 Group.Read.All

User.Read.All

AdministrativeUnit.Read.All

You also need the following information:

Client ID

Tenant ID

Client secret

Configuring Azure AD in ITSM

Open the Configuration console, scroll and select LDAP Integration > Entra ID Import.

The Entra ID Import Connections page is displayed.

Click Setup new Entra ID connection.

Enter information in the following tabs:

Configuration

Filter Management

Field Mapping

Schedule and Import

Use the Configuration tab to configure the connection between ITSM and Microsoft Entra ID. The remaining tabs are disabled until complete this step.

Delta Sync is enabled by default for new connections.

Ivanti recommends enabling the Delta Sync checkbox for all existing connections on the Entra ID Import Configuration tab. Delta Sync improves import performance by importing only delta changes since the previous successful import.

Select the Enabled checkbox.

Enter the following information:

Connection Name - Enter appropriate name (minimum of 5 characters).

Delta Sync - Select this checkbox to enable incremental user import from Entra ID. When Delta Sync is enabled, the first import performs a full import. Subsequent imports retrieve only incremental changes.

Client ID, Tenant ID, and Client secret - Enter appropriate details provided by Microsoft Entra.

Graph API endpoint - Use the default or enter custom URL to connect to import users from the Azure portal by interfacing with Azure Active Directory (Azure AD).

Token endpoint - Use the default or enter custom URL to request authentication tokens for secure access.

Use only supported URLs when configuring endpoints to match your domain requirements.

If you change the Client ID, Tenant ID, Client Secret, Graph API endpoint or Token endpoint while Delta Sync is enabled, a confirmation message appears. The message indicates that the next import will perform a full synchronization instead of an incremental import. Click Save to continue.

Only URLs listed in the Microsoft Graph national cloud deployments are supported. If you enter unsupported URLs, the test connection fails and display an error.

Select primary key - select one of the following options as the unique identifier: Entra ID, UPN, and Email.

You can also apply advanced query filters using the Azure AD HTTP request string.

Example 1 - To import active users from a specific domain.

endsWith(userPrincipalName,'@ivanti.com') and accountEnabled eq true

Result: The import includes only active users in the ivanti.com domain. Disabled accounts and users from other domains are excluded.

Example 2 - To import users by department or location.

(accountEnabled eq true and department eq 'IT') or city eq 'London'

Result: The import includes only active users in the users in the IT department and users located in London, regardless of department.

Select Reset Delta to reset the synchronization progress.

In the confirmation message, select Ok to continue. The next import performs a full synchronization instead of an incremental import.

Click Test Connection to validate the provided information.

A success message confirms the connection details are correct.

Click Save.

This saves the configuration, but the connection remains inactive until further steps are completed.

Full synchronization continues to work as designed and supports advanced query filters, such as endsWith, by default.

To improve full synchronization import performance, create the global constant EntraIdGetManagerWithUser and set to True. This setting imports users and their managers in a single operation.

However, this setting does not support advanced query filters. Before you enable this setting, review and update any filters that rely on advanced query capabilities. For more information, refer to Working with Global Constants.

Use the Filter Management tab to define and apply filter conditions by using Microsoft Entra ID fields. Filters help retrieve specific users or groups based on custom criteria. You can apply And, OR, and HttpString predicates.

You can select specific groups from which users should be imported. Only users who are members of the selected groups are included in the import process. This also imports Azure Entra ID groups to Contact Groups Business Object in ITSM.

Microsoft Graph SDK is used to connect to APIs. For more information, refer to Make API calls using the Microsoft Graph SDKs.

AND predicate - In a filter query, AND predicate is used when all conditions must be true.

For example, if you want to import only active users located in London,

Condition 1 - AccountEnabled Equals True

Condition 2 - City Equals London

Result: Only users whose accounts are enabled and whose city is London are included in the results.

OR predicate - Use this predicate when users can satisfy any one of the specified conditions.

For example, Import users who either have an active account or are located in London.

Condition 1 - AccountEnabled Equals True

Condition 2 - City Equals London

Result: Users whose active users in any location. Users located in London, even if their accounts are not enabled.

HttpString predicate - Use the HttpString predicate to to create advanced filters using Microsoft Graph query syntax.

For example, if you want to import users whose display name begins with the letter S and whose account is enabled.

startsWith('S', displayName) and accountEnabled eq true.

Result: The results include users name staring with S and provided their accounts are enabled.

View and Manage Users

To filter and view data using the User filter type:

Select the User from the Filter type dropdown.

In the Filter Condition dropdown, select And, OR, or HttpString predicates based on your requirement.

Enter the appropriate details and click Preview.

The Preview Entra ID import window appears, displays all users that match the selected filter criteria.

User filter considerations

When Delta sync is enabled, User filter type is supported only during preview. User filters are not applied during the actual import.

When manager information is imported with user data, advanced query filters such as endsWith are not supported by the current version of Microsoft Graph APIs. For more information, refer to Microsoft Graph- Advanced query capabilities on Microsoft Entra ID objects.

View and Manage Groups

To filter and view users by groups:

Select the Group from the Filter type dropdown.

In the Filter Condition dropdown, enter or select the desired one or more groups then click Ok.

A link appears showing the number of selected groups.

Click this link to view the selected group names.

To remove a group, click Close icon next to it.

To add more filters, use the And, or OR, or HttpString predicate, define your filter query and then click Preview.

Group filter considerations

If you select User as the filter type, the queue displays progress messages immediately.

If you select Group as the filter type, the system adds messages to the queue only after it finishes retrieving all users from Azure portal.

The system updates user information and relationships only when the user belongs to of the selected group.

You can select up to 50 groups for group-based filtering.

For more information on filter queries and predicates, refer to Microsoft Graph - Use the $filter query parameter and Microsoft Graph - Advanced query capabilities on Microsoft Entra ID objects.

Microsoft Entra Integration

Configuring Azure AD in ITSM

Configuration tab

Filter Management tab

Field Mapping tab

Schedule and Import tab