Skip to main content

Azure AD Sync

The Azure AD Sync tab configures bulk user provisioning from Microsoft Entra (Azure AD) into Beak ELM. Beyond authenticating a session — that's SSO / OAuth — sync ingests department, manager, group membership, and employee type so usage and cost rollups have accurate department dimensions.

Tabs​

  • Configuration — Credentials and sync schedule
  • Sync Status & Trigger — Last sync timestamp, manual trigger, error log
  • Import Employees — Preview and selectively import users before enabling automated sync

Configuration​

FieldDescription
Client IDApplication ID of the Azure AD App Registration
Client SecretSecret credential for the App Registration
Azure Tenant IDDirectory ID of the Entra tenant
Sync Frequency (hours)How often to pull (default 24)
Default RoleRole assigned to newly-imported users (e.g. Tenant Viewer)
Auto Create UsersProvision new Entra users automatically
EnabledMaster toggle for the sync

Actions: Test Connection, Save Configuration.

Required Azure AD Permissions​

The App Registration needs Microsoft Graph permissions to read users and group memberships. At minimum: User.Read.All, Group.Read.All, and Directory.Read.All. Admin consent is required.

Best Practices​

  • Set Sync Frequency to 24 hours for stable orgs and 6 hours for high-churn orgs (frequent hires / departures) — sub-hour syncs can hit Graph rate limits.
  • Use Import Employees to do a dry-run before flipping Enabled — review the user list and verify department assignments before going live.
  • Pair Azure AD Sync with SSO / OAuth → Microsoft — sync provisions the user record, SSO authenticates the session.
  • Disable Auto Create Users if your security policy requires explicit user provisioning — the sync still updates department / manager fields for existing users.