Microsoft Entra ID group sync

Keep EmbayLMS group membership in step with your Microsoft Entra ID groups (formerly Azure AD groups) — the Microsoft counterpart of the Google Workspace group sync. An app registration you control reads your Entra groups through Microsoft Graph (read-only), on a schedule and on demand, and EmbayLMS reconciles the members into the LMS groups you map.

Why a scheduled sync and not sync-at-login? Tenant sign-ins carry no Entra group claim EmbayLMS can rely on, and SCIM provisioning can create groups but not maintain their members. A tenant-granted app registration with application permissions is the workable mechanism: EmbayLMS syncs every mapped group every 6 hours, and admins can trigger an immediate Sync now.

How the sync behaves

• Each mapping links one Entra group (by its object ID) to one EmbayLMS group. Several Entra groups may feed the same EmbayLMS group — the membership is the union.
• Entra members are matched to EmbayLMS users by email address (mail, falling back to the user principal name). Emails without a matching active account are counted and reported, never created — user provisioning stays with SCIM, CSV import, or SSO just-in-time provisioning.
• Members added by the sync are tagged internally (source: entra). When they leave the Entra group, the next sync removes them. Members added manually in EmbayLMS — or by the Google sync — are never removed by this sync.
• Nested Entra groups are flattened (transitive membership): members of a group inside a mapped group are included.
• Every membership change is written to the tenant audit log — actor system for scheduled runs, the requesting administrator for Sync now.
• The client secret is encrypted at rest (AES-256-GCM) and is never displayed again after you save it; only the directory and application IDs and sync status are shown.
• In the Groups admin, memberships managed by an IdP sync are marked Synced from Microsoft Entra ID and cannot be removed manually — remove the user from the Entra group instead, so the LMS never silently diverges from the IdP.

Prerequisites

• An EmbayLMS plan that includes SCIM provisioning (the same entitlement gates both provisioning mechanisms).
• Owner access in EmbayLMS (the SCIM settings surface).
• Rights to create an app registration and grant admin consent in your Microsoft Entra tenant (Global Administrator or Privileged Role Administrator).

Step 1 — Register an application (Microsoft Entra admin center)

1. In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration.
2. Name it e.g. EmbayLMS group sync. Leave Supported account types on Accounts in this organizational directory only. No redirect URI is needed — this is a daemon (client-credentials) app.
3. On the app’s Overview page, copy the Application (client) ID and the Directory (tenant) ID — you enter both in EmbayLMS in Step 3.

Step 2 — Grant application permissions and admin consent

1. On the app registration, open API permissions → Add a permission → Microsoft Graph → Application permissions.

2. Add exactly these two permissions — both read-only:

   Group.Read.All
   GroupMember.Read.All

3. Click Grant admin consent for your tenant. Without admin consent the connection test in Step 3 fails.

4. Open Certificates & secrets → New client secret, choose an expiry, and copy the secret Value immediately (it is only shown once).

Step 3 — Connect EmbayLMS

1. In EmbayLMS, go to Settings → User Management → SCIM Provisioning and find the Microsoft Entra ID group sync section.
2. Enter the Directory (tenant) ID, Application (client) ID, and the client secret from Steps 1–2.
3. Click Connect. EmbayLMS validates the credentials live with one Graph call before saving; if the call fails, nothing is stored.

Step 4 — Map Entra groups to EmbayLMS groups

1. In the Group mappings section, start typing the Entra group’s name in the Entra group field (at least two characters). EmbayLMS searches your directory as you type and lists the matching groups with their mail address. Pick the one you mean — its object ID and display name are taken from the directory, so there is nothing to copy out of the Entra admin center and nothing to mistype. The search matches the start of the display name (that is what Microsoft Graph offers), so type the first word of the group’s name rather than a word from the middle.
2. Pick the EmbayLMS group it should feed. Only static groups can be mapped — dynamic groups are rule-managed.
3. Click Add mapping. Repeat per group.
4. Click Sync now to run immediately, or wait for the next scheduled pass (every 6 hours). Each mapping row shows its last sync time, member count, and how many emails had no matching account.

Unverified mappings

A mapping carries an Unverified badge until the directory has confirmed its group exists. Mappings created before 2026-09-10 were typed by hand and all start out unverified; every sync checks each mapping against the directory, stamps it verified when the group is found, and refreshes its display name from the directory at the same time. If the group has since been deleted in Entra, the badge comes back and the sync’s error list names the mapping — remove it, or map the group’s replacement. An unverified mapping never moves members, so the badge is worth acting on rather than ignoring.

If the field shows “The directory could not be searched”, the connection is missing, paused, or its client secret has expired — the message links back to the connection settings above. The mapping form does not accept a typed object ID as a fallback: fixing the connection is the fix.

Configuration reference

Troubleshooting

Limitations (v1)

• No user provisioning — unmatched emails are reported, not created.
• Sync direction is one-way: Entra ID → EmbayLMS. Membership changes made in EmbayLMS are not written back to Entra.
• Removing a mapping or disconnecting keeps the members the sync already added; clean up membership in the Groups admin if needed.