--- title: Microsoft Entra Integration slug: neurons-for-itsm/admin-user-help/enu/latest/microsoft-entra-integration description: Set up Microsoft Entra ID Import in Ivanti Neurons for ITSM. Configure user synchronization, filtering, field mapping, scheduling, administrative units, and Delta Sync. createdAt: 2026-07-14T19:16:26.014Z --- **Role**: Administrators. **Minimum Version**: Ivanti Neurons for ITSM 2024.3. The Microsoft Entra ID Import ou to manage your organization's workforce, including full-time employees and contractors, by maintaining user identities and access control. It also provides flexibility to customize the configuration according to your business needs. Watch this video for a visual walkthrough of configuring and using the Microsoft Entra ID Import. ::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[::embed[[Configuring Microsoft Entra ID Import (5:55)](https://www.youtube.com/watch?v=gEl_7Hsk9qU)]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"}]{url="https://www.youtube.com/watch?v=gEl_7Hsk9qU"} **Prerequisites** Before configuring Microsoft Entra ID Import, ensure that the Microsoft Entra application has the following Microsoft Graph API permissions: -  Group.Read.All - User.Read.All - AdministrativeUnit.Read.All You also need the following information: - Client ID - Tenant ID - Client secret ## Configuring Azure AD in ITSM 1. Log in to ITSM as an Administrator. 2. Open the Configuration console, scroll and select **LDAP Integration** > **Entra ID Import**. :::Paragraph{indent="1"} The **Entra ID Import Connections** page is displayed. ::: 3. Click **Setup new Entra ID connection**. 4. Enter information in the following tabs: - Configuration - Filter Management - Field Mapping - Schedule and Import ::::ExpandableHeading{indent="1"} ### Configuration tab Use the **Configuration **tab to configure the connection between ITSM and Microsoft Entra ID. The remaining tabs are disabled until complete this step. Delta Sync is enabled by default for new connections. Ivanti recommends enabling the **Delta Sync** checkbox for all existing connections on the **Entra ID Import Configuration** tab. Delta Sync improves import performance by importing only delta changes since the previous successful import. 1. Select the **Enabled** checkbox. 2. Enter the following information: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/_LoLMT2lC-xv63qFzwEGL_delta-sync-1.png" position="flex-start" size="80" width="1910" height="1035" initialPath="Delta-sync-1.png" githubPath="Admin-User/Content/Configure/Integrations/Delta-sync-1.png" darkWidth="1910" darkHeight="1035" showCaption="false"} - **Connection Name** - Enter appropriate name (minimum of 5 characters). - **Delta Sync** - Select this checkbox to enable incremental user import from Entra ID. When Delta Sync is enabled, the first import performs a full import. Subsequent imports retrieve only incremental changes. - **Client ID**, **Tenant ID**, and **Client secret** - Enter appropriate details provided by Microsoft Entra. ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/UB4jx_gAMplGnQOn8KYJt_delta-sync-2.png" position="flex-start" size="80" width="1910" height="1035" initialPath="Delta-sync-2.png" githubPath="Admin-User/Content/Configure/Integrations/Delta-sync-2.png" darkWidth="1910" darkHeight="1035" showCaption="false"} - **Graph API endpoint** - Use the default or enter custom URL to connect to import users from the Azure portal by interfacing with Azure Active Directory (Azure AD). - **Token endpoint** - Use the default or enter custom URL to request authentication tokens for secure access. 3. Use only supported URLs when configuring endpoints to match your domain requirements. :::hint{type="info" indent="1"} - If you change the Client ID, Tenant ID, Client Secret, Graph API endpoint or Token endpoint while Delta Sync is enabled, a confirmation message appears. The message indicates that the next import will perform a full synchronization instead of an incremental import. Click **Save **to continue. - Only URLs listed in the [Microsoft Graph national cloud deployments ](https://learn.microsoft.com/en-us/graph/deployments)are supported. If you enter unsupported URLs, the test connection fails and display an error. ::: 2. **Select primary key** - select one of the following options as the unique identifier: Entra ID, UPN, and Email. :::Paragraph{indent="1"} You can also apply advanced query filters using the Azure AD HTTP request string. ::: :::Paragraph{indent="1"} Example 1 - To import active users from a specific domain. ::: :::Paragraph{indent="1"} `endsWith(userPrincipalName,'@ivanti.com') and accountEnabled eq true` ::: :::Paragraph{indent="1"} **Result: ** The import includes only active users in the **ivanti.com ** domain. Disabled accounts and users from other domains are excluded. ::: :::Paragraph{indent="1"} Example 2 - To import users by department or location. ::: :::Paragraph{indent="1"} `(accountEnabled eq true and department eq 'IT') or city eq 'London'` ::: :::Paragraph{indent="1"} **Result: ** The import includes only active users in the users in the IT department and users located in London, regardless of department. ::: 2. Select **Reset Delta **to reset the synchronization progress. :::Paragraph{indent="1"} In the confirmation message, select **Ok **to continue. The next import performs a full synchronization instead of an incremental import. ::: 2. Click **Test Connection** to validate the provided information. :::Paragraph{indent="1"} A success message confirms the connection details are correct. ::: 2. Click **Save**. :::Paragraph{indent="1"} This saves the configuration, but the connection remains inactive until further steps are completed. ::: Full synchronization continues to work as designed and supports advanced query filters, such as `endsWith`, by default. To improve full synchronization import performance, create the global constant `EntraIdGetManagerWithUser `and set to `True`. This setting imports users and their managers in a single operation. However, this setting does not support advanced query filters. Before you enable this setting, review and update any filters that rely on advanced query capabilities. For more information, refer to [Working with Global Constants.](https://help.ivanti.com/ht/help/en_US/ISM/2026/admin-user/Content/Configure/Constants/Defining_Global_Constant.htm) :::: ::::ExpandableHeading{indent="1"} ### Filter Management tab Use the **Filter Management** tab to define and apply filter conditions by using Microsoft Entra ID fields. Filters help retrieve specific users or groups based on custom criteria. You can apply `And`, `OR`, and `HttpString` predicates. You can select specific groups from which users should be imported. Only users who are members of the selected groups are included in the import process. This also imports Azure Entra ID groups to **Contact Groups** Business Object in ITSM. :::hint{type="info"} Microsoft Graph SDK is used to connect to APIs. For more information, refer to [Make API calls using the Microsoft Graph SDKs](https://learn.microsoft.com/en-us/graph/sdks/create-requests?tabs=csharp). ::: - `AND` predicate - In a filter query, `AND` predicate is used when all conditions must be true. :::Paragraph{indent="1"} For example, if you want to import only active users located in London, ::: :::Paragraph{listStyleType="disc" indent="2"} Condition 1 - `AccountEnabled Equals True` ::: :::Paragraph{listStyleType="disc" indent="2"} Condition 2 - `City Equals London` ::: :::Paragraph{indent="1"} **Result**: Only users whose accounts are enabled `and` whose city is London are included in the results. ::: - `OR` predicate - Use this predicate when users can satisfy any one of the specified conditions. :::Paragraph{indent="1"} For example, Import users who either have an active account or are located in London. ::: :::Paragraph{listStyleType="disc" indent="2"} Condition 1 - `AccountEnabled Equals True` ::: :::Paragraph{listStyleType="disc" indent="2"} Condition 2 - `City Equals London` ::: :::Paragraph{indent="1"} **Result**: Users whose active users in any location. Users located in London, even if their accounts are not enabled. ::: - `HttpString` predicate - Use the `HttpString` predicate to to create advanced filters using Microsoft Graph query syntax. :::Paragraph{indent="1"} For example, if you want to import users whose display name begins with the letter **S** and whose account is enabled. ::: :::Paragraph{indent="1"} `startsWith('S', displayName) and accountEnabled eq true`. ::: :::Paragraph{indent="1"} **Result**: The results include users name staring with S and provided their accounts are enabled. ::: **View and Manage Users** To filter and view data using the User filter type: 1. Select the **User** from the **Filter type** dropdown. 2. In the **Filter Condition** dropdown, select `And`, `OR`, or `HttpString` predicates based on your requirement. 3. Enter the appropriate details and click **Preview.** :::Paragraph{indent="1"} The **Preview Entra ID import** window appears, displays all users that match the selected filter criteria. ::: :::Paragraph{indent="1"} **User filter considerations** ::: - When **Delta sync** is enabled, User filter type is supported only during preview. User filters are not applied during the actual import. - When manager information is imported with user data, advanced query filters such as `endsWith` are not supported by the current version of Microsoft Graph APIs. For more information, refer to [Microsoft Graph- Advanced query capabilities on Microsoft Entra ID objects](https://learn.microsoft.com/en-us/graph/aad-advanced-queries?tabs=http). **View and Manage Groups** ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/svCussP7g5gxMdcFbDkAx_entra-id-group-filter.png" position="flex-start" size="80" width="1910" height="988" initialPath="images/entra-id-group-filter.png" githubPath="Admin-User/Content/Configure/Integrations/images/entra-id-group-filter.png" darkWidth="1910" darkHeight="988" showCaption="false"} To filter and view users by groups: 1. Select the **Group** from the **Filter type** dropdown. 2. In the **Filter Condition** dropdown, enter or select the desired one or more groups then click **Ok**. :::Paragraph{indent="1"} A link appears showing the number of selected groups. ::: 3. Click this link to view the selected group names. 4. To remove a group, click **Close** icon next to it. 5. To add more filters, use the `And`, or `OR`, or `HttpString` predicate, define your filter query and then click **Preview**. :::Paragraph{indent="1"} **Group filter considerations** ::: - If you select **User** as the filter type, the queue displays progress messages immediately. - If you select **Group **as the filter type, the system adds messages to the queue only after it finishes retrieving all users from Azure portal. - The system updates user information and relationships only when the user belongs to of the selected group. - You can select up to 50 groups for group-based filtering. For more information on filter queries and predicates, refer to [Microsoft Graph - Use the $filter query parameter](https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http) and [Microsoft Graph - Advanced query capabilities on Microsoft Entra ID objects](https://learn.microsoft.com/en-us/graph/aad-advanced-queries?tabs=http). :::: :::ExpandableHeading{indent="1"} ### Field Mapping tab This tab is used to set the field mappings from ITSM to Entra ID. It consists of both existing and new field mappings for a connection. 1. Click **Add Mapping**. 2. Select appropriate mappings from **ISM Employee Field** and map it to **Entra ID Fields**. 3. Choose the **Mapping Type**: - **Map** - Choose from available options. - **Fixed Value** - Enter a static value. 4. To prevent a field from being updated during import, select the **Do not update** checkbox next to the mapping. **Delta Sync and Field Mapping** - When Delta Sync is enabled, Entra ID import detects changes only for fields mapped using the **Map **type in the **Field Mapping** tab. Entra ID imports and tracks only these selected fields during the next incremental import. - Add the **IsEntraIdDeleted **field in the** Field Mapping** tab to track deleted users from Entra ID. This works only when Delta Sync is enabled. - If you add, delete, or modify any field of **Map **type in the** Field Mapping** values of existing connection, the next import will perform a full synchronization instead of an incremental import. ::: :::ExpandableHeading{indent="1"} ### Schedule and Import tab This tab allows you to set a schedule or initiate an immediate import. You can also enable the import of administrative units. - **Schedule an import **- Choose a schedule from the **Schedule list** to run the import as per the time in the selected schedule. - **Run an immediate import **- Select **Save and Import** to run the import immediately. - **Import administrative units** - Select the **Import Administrative Units** checkbox to import administrative units into the database. **Limitations** - Administrative unit and group imports are not available when Delta Sync is enabled. - If an incremental update is not scheduled within 7 days after the initial full synchronization, the next import performs a full synchronization when Delta Sync is enabled. For more information, refer to [Microsoft user: Delta](https://learn.microsoft.com/en-us/graph/api/user-delta?view=graph-rest-1.0\&tabs=http). :::