The Entra ID user management connector links CDESK with your Microsoft Entra ID (formerly Azure AD) and automatically creates and continuously maintains user accounts based on it. Instead of setting up and updating accounts by hand, users from the selected Entra ID groups create themselves in CDESK and are populated with data from their attributes. You make the changes in your Entra ID and CDESK picks them up during synchronisation.
Management vs. Login: This article describes the creation and maintenance of accounts (user management). Logging in via a Microsoft account is handled by a separate authentication connector — see Logging in via Entra ID and Logging in via Entra ID Multi-Tenant. Both features are usually used together, but they are configured separately and have separate connectors.
How it works
The Entra ID user management connector connects to your tenant through the Microsoft Graph API. It reads the selected groups and their users and creates or updates their accounts in CDESK. A user is uniquely identified by their GUID from Entra ID (stored in the account’s External ID field), so the account stays paired even after a name or login detail changes. Synchronisation runs automatically at the interval that has been set (every 24 hours by default), or you can start it manually at any time.
Synchronisation thereby provides:
- Automatic account creation – accounts are created according to users’ membership of the monitored groups in Entra ID.
- Pairing by GUID (optionally by e-mail as well) – existing accounts are paired, which prevents duplicates.
- Populating data from attributes – the account fields (name, e-mail and others) are filled from Entra ID attributes, and the job position and manager are assigned.
- Mapping groups to permissions – you assign CDESK user groups to the Entra ID groups, and accounts inherit permissions from them.
- Account maintenance – inactive or removed accounts are deactivated or deleted in CDESK accordingly.
Note: An account linked via Entra ID is marked with the AD label (“Account linked with an AD account”) both in the user list and in the detail. It is the same label as for accounts from AD/LDAP — Entra ID is not distinguished by a separate flag.
Prerequisites and registering an application in Entra ID
So that CDESK can read users and groups from your Entra ID, it needs an application registered in the tenant with read access to the directory. The registration is carried out by the Entra ID administrator in the Microsoft Entra portal (entra.microsoft.com), in the App registrations section. From it you obtain three values which you enter into the connector:
- Client ID (Application / client ID) – the identifier of the registered application.
- Tenant ID (Directory / tenant ID) – the identifier of your tenant.
- Certificates and secrets → Client secret (Secret value) – the secret key generated during registration. Make a note of its value straight away; it will not be shown again later.
Grant the registered application application permissions (Application permissions) in Microsoft Graph to read users and groups — typically User.Read.All, Group.Read.All and GroupMember.Read.All — and give them administrator consent (Grant admin consent). The connector accesses the Microsoft Graph API as an application (with no signed-in user), which is why application permissions are required rather than delegated ones.
The same registration as for authentication: Client ID, Client secret and Tenant ID are the same types of value that are also entered for the authentication connector. The procedure for obtaining them (registering the application in the portal, creating the secret key) is described in detail in the article Logging in via Entra ID. For synchronisation, additionally grant application permissions to read the directory (User.Read.All, Group.Read.All and GroupMember.Read.All).
Adding the connector and its basic settings
- Client ID – the application identifier from the registration in Entra ID.
- Client secret – the application’s secret key. It is entered when the connector is created; when editing it later, leave it empty if it is not changing.
- Tenant ID – the identifier of your tenant.
- Synchronisation start time – the time of day at which automatic synchronisation should start.
- Synchronisation interval – how often synchronisation repeats, in minutes (from 15 to 1440, i.e. once every 15 minutes up to once a day).
- Pairing by e-mail – when switched on, a user who already exists in CDESK with the same e-mail is paired with the account in Entra ID instead of a duplicate account being created. We recommend switching it on right at the first synchronisation.
Tip: You save the settings by clicking the Save icon. The parts that depend on data loaded from Entra ID (for example the list of groups) only become available after saving and after synchronisation has been run for the first time using the Synchronize icon.
Monitored groups and mapping to CDESK groups
CDESK creates accounts only for users who belong to the monitored groups in Entra ID listed in the connector. To each monitored group you assign one or more user groups in CDESK, from which the accounts inherit permissions. If you assign several CDESK groups to one Entra ID group, the user receives the permissions from all of them.
When adding a group, the (no group specified) option is also available — use it if you want to include users regardless of their group membership.
Condition for assignment to a group
This determines when membership of CDESK groups is updated:
- Only when the user is created – the user is assigned to the CDESK groups only once, when the account is created; later synchronisations no longer change their group membership.
- At every synchronisation – group membership is re-evaluated on every run according to the current state in Entra ID (if the user has been removed from the group, they are removed in CDESK too, and vice versa).
Pairing users' basic data
When an account is created and updated, its fields are populated from the user’s attributes in Entra ID. The basic fields have a default mapping:
- Full name – from the displayName attribute.
- Contact e-mail – from the mail attribute.
- Login name – derived from the userPrincipalName attribute (the part before the @ sign, in lower case).
- Abbreviation for listings (nickname) – if it is not mapped otherwise, it is created automatically from the initials of the first name and surname (givenName, surname).
- Account status – according to the accountEnabled attribute: an account disabled in Entra ID is set as inactive in CDESK.
In addition, you can map further attributes to system fields (for example phone, mobile) as well as to user-defined fields defined in your environment. For each rule you state the name of the attribute in Entra ID and the target field in CDESK that is to be filled from it.
Assigning a job position
Job positions can be assigned to accounts automatically according to an attribute from Entra ID. With the synchronisation by attribute method you state the name of the attribute containing the job position name (typically jobTitle). During synchronisation CDESK finds the job position with that name and assigns it to the account; if no match is found, the default job position is used (if one has been set). Job positions are managed in Global settings → Job positions.
Assigning a manager
A manager can be assigned to accounts automatically according to the attribute that references the superior account in Entra ID — manager by default. From this attribute CDESK determines which account is the superior one and creates the manager – subordinate relationship between the corresponding accounts in CDESK. The relationships are updated at every synchronisation: if the manager changes in Entra ID, the change is reflected in CDESK as well.
Note: The manager and subordinate are therefore determined from an attribute on the account in Entra ID, not from the graphical organisational structure. You will find the assigned managers in the user detail on the Managers and subordinates tab.
How synchronisation proceeds
On every run (automatic or manual) the connector performs the following, in this order:
- Removal of deleted accounts – accounts that have been deleted in Entra ID are removed in CDESK.
- Loading data – the monitored groups and their users, including attributes and group membership, are loaded from Entra ID.
- Creating or updating accounts – for every user belonging to the monitored groups the account is created (if it does not exist) or updated. The login name, nickname, External ID (GUID), status (active/inactive), job position and the mapped attributes are updated. An account that was previously deleted is restored when membership resumes.
- Removal of accounts outside the groups – if a user no longer belongs to any monitored group, their account in CDESK is removed.
- Updating groups – membership of CDESK groups is adjusted according to the condition for assignment to a group that has been set.
- Updating managers – manager – subordinate relationships are assigned and removed according to the attribute.
Warning: An account without a GUID is skipped — synchronisation processes only users with a valid unique identifier from Entra ID.