Connect Microsoft Entra for participant import

Understand what the connection does

Entra imports directory members into your company's People list. It is a manual import, not administrator single sign-on, mailbox access or an email-sending connection. The initial hosted release keeps Entra disabled until the customer and operator complete a test.

The adapter reads an account identifier, name, email or user principal name, department, language, account type and enabled status. It includes enabled members whose chosen email domain exactly matches your company's approved recipient domains. Guests and disabled accounts are excluded.

Prepare an application in your directory

1. Agree a dedicated test directory with the operator first. This adapter reads the directory's user list and then filters eligible accounts; it has no group-selection filter. Confirm the company workspace and approved recipient domains before any real-directory import.
2. In the Microsoft Entra admin centre, open App registrations and create an application owned by your organisation. Select accounts in this organisational directory only. This background import does not need an interactive redirect URI.
3. Record the Directory (tenant) ID and Application (client) ID from the application overview. These must identify your own customer's directory and registration.
4. Under API permissions, add Microsoft Graph application permission User.Read.All. Have an administrator authorised to grant Microsoft Graph application consent review and approve the request. Application registration rights alone do not establish that authority.

Arrange credentials with the operator

The current adapter supports a client secret. Coordinate its creation, expiry and replacement with the operator using the agreed secure credential channel. Do not send the secret in ordinary email, support screenshots, CSV files or a public ticket. The secret value and its identifier are different fields.

Microsoft recommends certificate or federated credentials for production applications. Those authentication methods are not implemented in this adapter. Agree whether the current secret-based connection meets your organisation's requirements before enabling it.

Run an agreed import test

1. Have the operator configure this connection for your company and confirm its status in Settings. Customer connections never share credentials or silently fall back to another directory.
2. Prepare synthetic enabled and disabled members, a guest and an address outside the approved domains. Record the expected imported participants before running the manual sync.
3. Check names, departments, languages and email addresses in People. Newly imported people do not receive participation approval or training invitations automatically.
4. With the operator, verify a second successful sync and a controlled failed-sync case. A failed or incomplete read must leave the existing participant list unchanged. Review pagination and account exclusions before accepting the connection.

Understand later syncs and failures

After a complete successful sync, previously imported Entra participants absent from the eligible snapshot become inactive. This can happen when accounts are disabled, removed, excluded or no longer match approved email domains. Review domain and directory changes before syncing. Participation approval is managed separately in People.

A missing connection, expired secret, missing consent or unreadable required field needs operator review. Record the time, company name and visible error, and remove personal data from screenshots. Do not repeatedly change permissions or share access tokens. Imports are manual; this release has no scheduled directory refresh.