Microsoft Entra ID (Azure AD) User Sync

ServiceDesk Plus enables you to import users from Microsoft Entra ID (Azure AD) based on certain criteria. You can map Azure AD user fields with ServiceDesk Plus fields to import specific user details.

You can also automatically sync deleted users from Microsoft Entra ID to ServiceDesk Plus.

Role Required: Organization Admin for ESM Setup; SDAdmin for non-ESM setup

You can import users from multiple tenants into the application. Each tenant must have a separate app registration.

ServiceDesk Plus only reads user information from Azure via API and does not modify data in Azure.     

Prerequisites  

Configure Microsoft Entra ID

To obtain user and group information from Azure AD, create an App registration with the required permissions. Follow the steps below to register the application.

Role Required: Global Administrator

• Log into Azure.
• In the left pane, select Microsoft Entra ID.
• On the Microsoft Entra ID page, select App registrations from the left pane, and click New registration.

• Provide a name for the application.
• Select the supported account types for the application. This determines who can access the application.

• Click Register to save the application.

• In the registered application, you can find the Client ID and Token URL in ServiceDesk Plus.
  • Client ID: Application ID in the Overview section.
  • Token URL: OAuth 2.0 token endpoint (v2) under Overview > Endpoint.
  • 

• To get the Client Secret, go to Certificates & Secrets > Client Secret > New client secret.
• Provide a description of the client secret and choose its validity.
• Click Add.

• Update permissions required for user sync in the registered application:
  • Go to API permissions and click Add a permission.
  • Select Microsoft Graph > Application permissions
  • Add permissions User.Read.All and Group.Read.All
  • Grant admin consent for the added permissions.

Configure User Sync 

Set up Microsoft Entra ID integration for user synchronization under ESM Directory > User Management > Microsoft Entra ID (Azure AD) for ESM setups.

For non-ESM setups, access Microsoft Entra ID (Azure AD) under Admin > Users & Permissions.

Follow these steps to configure user import from Microsoft Entra ID:

Step 1: Add Domains

Add domains to sync users from Microsoft Entra ID. You can set up multiple domains with different field mapping and criteria for importing users.

• Go to the Microsoft Entra ID (Azure AD) page in ServiceDesk Plus.
• Under Domain Details, click Add New Domain.
• In the Add Domain pop-up, enter the following details:
  • Domain Name: Name of the domain.
  • Client ID: Azure application ID
  • Client Secret: Client secret value in Azure.
  • Token URL: Link to the Azure endpoint to obtain the access token.
• Click Save and Test Connection.

Refer here to obtain Client ID, Client Secret, and Token URL from Azure.

After the test connection is successful, the Field Mapping and User Import Settings section will appear in the Add Domain pop-up.

Step 2: Field Mapping

Map user detail fields for synchronization from Microsoft Entra ID in the Add Domain pop-up.

• In the drop-down fields displayed, select the ServiceDesk Plus fields and map them to the corresponding user fields in Microsoft Entra ID.
• On selecting field names from the ServiceDesk Plus column, the relevant Microsoft Entra ID fields will be automatically mapped. You can change the mapping of Microsoft Entra ID fields as required.
• Add or remove fields using the  and  icons.

 Name and Login Name fields are mandatory for fetching Azure users and cannot be removed .

The Reporting To field can be mapped only to the manager field in Azure AD. 

 Object ID, userPrincipalName,  onPremisesUserPrincipalName, onPremisesDomainName, and onPremisesSamAccountName are imported by default. 

Additional fields can also be used for field mapping in ServiceDesk Plus.

Step 3: User Import Settings

Schedule the user import for periodic sync or import users manually in the Add Domain pop-up.

• Scheduled Import:
  • In the Schedule Configuration tab, choose to import users with or without criteria.
  • Without Criteria: Imports all users automatically at the scheduled time.
  • Based on Criteria: Imports users based on specified criteria. Select the criteria from the available drop-downs.

• Manual Import:
  • In the Import Once tab, enter the User Principal Name of users in the text box. You can import up to five users at a time.  
  • Click Import Now. This import will be executed instantly without any scheduling, and the count of added, overwritten, and failed records will be displayed.

When adding new users, the user's manager will be automatically included as a user. To prevent this, remove the manager field in the Field Mapping section.

When field mapping or user import criteria are changed, full import will be initiated for the next delta sync.

Step 4: Set a local authentication password for imported users   

Set a default local authentication password for users imported from Microsoft Entra ID. Users can change this password after their first login.

• In the Microsoft Entra ID (Azure AD) page in ServiceDesk Plus, hover over the Local Authentication Password section, and click Edit.
• Generate a random password for each user or set a predefined password.
• Click Save.

Step 5: Schedule Microsoft Entra ID import  

Schedule user import to synchronize user details periodically. Users and their details are synchronized with ServiceDesk Plus in two ways:

• Full Import: Syncs all user data.
• Delta Import: Syncs updated user details and newly added user accounts every hour.

When the schedule is enabled, both Full import and Delta import are automatically enabled. To enable the import schedule,

• On the Microsoft Entra ID (Azure AD) page in ServiceDesk Plus, hover over the Import Schedule field, and click Edit.
• Enable the schedule using the check box and specify the import frequency.
• Set the start date and time for the schedule.
• Click Save.

The users will be imported per the schedule, and the user information will be updated every hour. You can view the last import time and the next scheduled time in the Import Schedule section. 

The import summary will be notified to the Organization Admin (for ESM setup) and SDAdmins (for non-ESM setup) through bell notifications. It can be viewed under , and will display the count of users added, updated, and failed. Additionally, a CSV file containing the User Principal Name of the failed users will be included.

Step 6: Sync deleted users from Active Directory  

Configure what happens to the user data in ServiceDesk Plus when they are deleted in Microsoft Entra ID.

You can either delete the users automatically or manually. Deleted users will be synced with ServiceDesk Plus during the configured full import schedule.

To configure the syncing of deleted users,

• On the Microsoft Entra ID (Azure AD) page in ServiceDesk Plus, hover over the Sync Deleted Users section, and click Edit.
• Choose your deletion method: Automatic or manual. Note that automatic deletion is  applicable only to non-technician users.
• Click Save.

If manual deletion is chosen, the SDAdmin/Organization Admin will receive a bell notification and a list of deleted users will be displayed upon clicking the notification.

If automatic deletion is chosen,

• Non-technicians will be automatically removed, and a bell notification indicating the number of deleted users will be sent to the SDAdmin/Organization Admin. Clicking the notification will open the system log with the deleted user information in a CSV file.
• Technicians will not be deleted automatically. Instead, the SDAdmin/Organization Admin will receive a bell notification and a list of deleted users will be displayed upon clicking the notification.

Additionally, the link to the deleted users list will be displayed on the Microsoft Entra ID page in ServiceDesk Plus and also under Admin > Users & Permission > Users/Technician tab. The SDAdmin/Organization Admin can review the list before removing the users from ServiceDesk Plus.

Authentication

Authenticate imported Entra ID users using SAML SSO - https://pitstop.manageengine.com/portal/en/kb/articles/configuring-saml-with-azure-ad-9-8-2020

 Criteria to Overwrite  User

The user will be overwritten if:

• ObjectID of an Azure user matches an existing user.
• onPremisesUserPrincipalName or onPremisesImmutableId of the Azure user matches the existing user's userPrincipalName or lookup_guid, respectively.
• OnPremiseDomainName and OnPremiseSamAccountName of the Azure user matches the domain name and login name of the existing user.
• Login name and the domain name of the Azure user match the existing user's login and domain name.
• Login name of the Azure user matches the login name of the existing user, but the domain is not associated with that user.
• Override user information based on email ID is enabled, and the email ID of the Azure user matches the email ID of the existing user.

If none of the above criteria are met, a new account will be created for the Azure user.

Refer to the following Microsoft documentation to learn more about synching users from OnPremises Active Directory: 

 Adding an attribute mapping from AD to Microsoft Entra ID   

 Integrating a single forest with a single Microsoft Entra tenant