Microsoft Entra ID (Azure AD) User Sync

Sync users periodically from Microsoft Entra ID (Azure AD) to ServiceDesk Plus Cloud. You can import users based on criteria and custom-map Azure fields with ServiceDesk Plus fields to suit your requirements.

ServiceDesk Plus Cloud just reads user information from Azure via API and does not modify data in Azure.

Role Required: SDAdmin

While mapping fields or configuring the criteria for user import, you can sync complete user information (besides basic details) from Microsoft Entra ID (Azure AD) to ServiceDesk Plus Cloud if any of the following integrations is enabled:

• Microsoft Azure, enabled by Microsoft Azure global administrator.

• Microsoft Entra ID (Azure AD) User Sync, enabled by a Microsoft Azure user after obtaining consent from Microsoft Azure global administrator to authorize ServiceDesk Plus in Microsoft Azure. In this case, the user does not require the global administrator privileges. 

The document will help you understand the following topics:

• Authorize Workflow for Non-Admin Users

• Enable Microsoft Entra ID (Azure AD) User Sync

• Configure Microsoft Entra ID (Azure AD) User Sync

• Disable Microsoft Entra ID (Azure AD) User Sync

• Process Workflow

Authorize Workflow for Non-Admin Users

The workflow and configurations described below are required only when the authorizing user is not a Global Administrator or Privileged Administrator. In all other cases, authorization proceeds without any additional configuration.

Authorization Error for Non-Admin Users
 

If this error occurs for non-admin users, follow the steps below to complete the Microsoft Entra ID (Azure AD) authorization workflow.

 Step 1: Grant Admin Consent for ServiceDesk Plus (Cloud)  

• Sign in to the Microsoft Entra admin center as a Global Administrator.

• Go to Enterprise applications.

• From the left pane, under Manage, select All applications.

• Search for the application by name, ServiceDesk Plus (Cloud), and select it.
   

• In the left pane, under Security, click Permissions.
   

• Under the Permissions section, select Grant admin consent for ServiceDesk Plus. This will redirect you to the Microsoft authorization page, where you must complete the authorization process.
   

 Step 2: Enable the Admin Consent Workflow        

• Sign in to the Microsoft Entra admin center as a Global Administrator.

• Go to Enterprise applications > Consent and permissions > Admin consent settings.

  • Under Admin consent requests, select Yes for Users can request admin consent to apps they are unable to consent to.
     

• Configure the following settings:

  • Who can review admin consent requests - Select users, groups, or roles who can review admin consent requests. 

  • Note:

    • Global Administrators or Privileged Administrators can approve requests for apps needing application permissions. 

    • Reviewers can view, block, or deny requests and see incoming requests on the My Pending tab. 

    • New reviewers cannot act on existing or expired requests.

  • Selected users will receive email notifications for requests - Enable or disable email notifications to reviewers when a request is made.

  • Selected users will receive request expiration reminders - Enable or disable reminder emails to reviewers before a request expires.

  • Consent request expires after (days) - Specify how many days a consent request stays valid.

• Click Save.

 Authorization Page View After Configuration

Requesting User Consent on the Authorization Page   

To request consent in Microsoft Entra ID (User AD)  

• Start enabling the integration in your application or service.

• If you lack permission, Microsoft Entra ID (Azure AD) will prompt you with a message requesting admin approval.

• Click Request approval in the prompt.

Where the Authorization Consent Request Appears in Microsoft Entra ID (Azure AD)

If Admin Consent Workflow is Enabled:  

• Sign in to the Azure Portal.

• Go to Microsoft Entra ID (Azure AD).

• Under Manage, click Enterprise applications.

• In the left pane, under Activity, select Admin consent requests.

  • My Pending tab: You will see pending consent requests that users have raised.

  • Click on the request you want to review.
     

• Click Review permissions and consent.

  • To view the application details, select the App details tab.

  • To see who is requesting access and why, select the Requested by tab.

• Evaluate the request and choose Approve or Deny or Block. Learn more.

Enable Microsoft Entra ID (Azure AD) User Sync

• Go to Setup > Apps & Add-ons > Integrations > Third Party Integrations.

• On the Microsoft Entra ID (Azure AD) User Sync card, toggle the integration ON.

• Click Agree.

• You will be directed to the Microsoft authorization page to verify user identity if Microsoft Single Sign on is not configured.

• Sign in to your Microsoft account and complete the authorization process. This is a one-time process.  
   

After the integration is enabled, details of a minimum of 200 users will be updated to ServiceDesk Plus every 2 minutes.

Configure Microsoft Entra ID (Azure AD) User Sync  

Click Configure on the Microsoft Entra ID (Azure AD) User Sync card to schedule the sync or to choose how the user information must reflect in ServiceDesk Plus when deleted in Microsoft Entra ID (Azure AD). You can import users based on criteria from Microsoft Entra ID (Azure AD). You can also custom map Microsoft Entra ID (Azure AD) fields with ServiceDesk Plus fields as per requirement. 

Sync Frequency and User Profile Management  

• Set a sync frequency. You can set it between 1 to 7 days.

• When users are deleted in Microsoft Entra ID (Azure AD), you can modify user profiles in ServiceDesk Plus Cloud as follows: Revoke login, Remove user, and Do nothing.

• When users are moved to trash in Microsoft Entra ID (Azure AD), you can modify the user in ServiceDesk Plus as follows: Revoke login, Remove user, and Do nothing.

• Select what happens to the manually deleted users during the next sync cycle. You can either ignore the deleted users or re-sync them using appropriate options.

• Choose whether to sync the user profile picture from Microsoft Entra ID (Azure AD) to ServiceDesk Plus.

• Set the login status for users added via Microsoft Entra ID (Azure AD): Follow login status from Azure, Enable Login, or Disable Login.

• Set the login status for users updated via Microsoft Entra ID (Azure AD): Follow login status from Azure or Do nothing.

Field Mapping 

Choose which fields from Microsoft Entra ID (Azure AD) should be mapped to the respective ServiceDesk Plus fields.

By default, i.e, without enabling Microsoft Entra ID (Azure AD) integration, Name, Email, First name, Last name, User Principal name fields can be mapped. After enabling the integration, the following fields will be available for mapping.

• By default the following fields will be available for mapping:

If Microsoft Entra ID (Azure) integration is enabled, you can map the following details from Microsoft Entra ID (Azure AD) to ServiceDesk Plus:

Additionally, AD Login Name field is available which is populated using On-premises SAM Account Name, On-premises Domain Name and On-premises User Principal Name field details.

Select and map the respective fields as shown below. An Azure field can be mapped with only one ServiceDesk Plus field.
 

Field Mapping supports both user and technician additional fields (character-based).

Criteria for User Import

You can import users based on criteria or you can import all users without any criteria.

If you want to import users based on criteria, select Based on Criteria and add conditions. For example, you can set a criterion to import users only from a particular Site by choosing the Site column, setting the operator value as is and by entering the Site name.

If you want to import users without any criteria, select Without Criteria. This option will import all users from Microsoft Entra ID (Azure AD). 

Microsoft Entra ID (Azure AD) Fields available for configuring criteria:

• Domain

• Email

• First Name

• Last Name

• Name

• Usage Location

• User Principle Name

• Users with Azure Login
   

If Microsoft Entra ID (Azure) integration is enabled, the following fields will be available for configuring criteria:

• User Type

• Department

• Office

• Job title

• Employee ID

• Mobile Phone

• Business Phone

• Reporting To

• City

• Company Name

• Street Address

• State or Province

• ZIP or Postal Code

• Country or Region

• Alternate Email

• Groups

• Cost Center

• Division

• Fax Number

• On-premises Sync Enabled

• On-premises Distinguished Name

• On-premises Domain Name

• On-premises Immutable Id

• On-premises Last Sync Date Time

• On-premises SAM Account Name

• On-premises Security Identifier

• Once you have configured everything, click Save to save the configurations or Save and Sync to initiate sync.

You can also start the sync using the Start Sync button on the Microsoft Entra ID (Azure AD) User Sync integration card.

Resync Data from Microsoft Entra ID (Azure AD) 

After the initial sync, administrators can initiate a complete resync of all data from Microsoft Entra ID (Azure AD) to ServiceDesk Plus Cloud. This option can be used especially when the integration configurations were modified after users were imported to ServiceDesk Plus Cloud.

• On the Microsoft Entra ID (Azure AD) User Sync card, click Configure.

• Select Resync to apply changes to the old data option.

• Click Save.

The option to resync data is available only for Enterprise edition of ServiceDesk Plus Cloud.

Disabling Microsoft Entra ID (Azure AD) User Sync

• Under Setup > Apps & Add-ons > Third Party Integrations, disable Microsoft Entra ID (Azure AD) User Sync by switching the toggle button.

• Click Disable on the confirmation pop-up.
   

All users imported into ServiceDesk Plus from Microsoft Entra ID (Azure AD) will be retained even after the scheduler is disabled.

Microsoft Entra ID (Azure AD) User Sync Reports

Get a report on all actions taken on each user synced from Active Directory (AD), including additions, updates, deletions, and any modifications to user data with Microsoft Entra ID (Azure AD) User Sync Reports. To get the report, select the Enable Microsoft Entra ID (Azure AD) User Sync Reports checkbox under Integrations > Microsoft Entra ID (Azure AD) User Sync > Configure > Sync Reports.

Once enabled, the reports will be available to download on the Microsoft Entra ID (Azure AD) User Sync card under Integrations.

A maximum of 10 reports, each up to 10 MB in size, will be stored. Once this limit is reached, the oldest report will be automatically deleted to accommodate storage for new reports.

Points to remember:

• If the administrator who configured Microsoft Entra ID (Azure AD) User Sync integration leaves the organization, the user who revokes the administrator/global admin privileges for the former user will added as the integration owner. The new integration owner's token will be used to validate the integration.

• Users in unverified domains will be added as non-login users in ServiceDesk Plus Cloud.

• Login users will be added only if the Account Enabled field is selected in Microsoft Entra ID (Azure AD).

  • If the Account Enabled field is enabled after adding users to ServiceDesk Plus Cloud, login permissions will be provided to users following the next scan.

  • If the Account Enabled field is disabled after adding users to ServiceDesk Plus Cloud, login permissions provided previously will not be removed for users. However, users added subsequently will not have login permissions.

Process Workflow