> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/6/configure/auth/azure-id/synchronize-groups/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Synchronize Entra ID groups with Itential Platform

> How to configure the Azure adapter to synchronize Entra ID (Azure AD) groups to Itential Platform for role-based access control.

When Itential Platform is configured to use Microsoft Entra ID (formerly Azure Active Directory) as its AAA source, Itential Platform permissions can be assigned to users via Entra ID group membership. To do this, Entra ID groups present in the connected tenant are synchronized to Itential Platform. An Itential Platform administrator can then assign roles to these groups, and users receive the corresponding permissions when they log in with their Azure credentials.

## Select a method for group tracking

The Azure adapter's group synchronization behavior is controlled by its service configuration — specifically, by the parameters of the `groupSync` property:

| Parameter        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `interval`       | **Required.** How often, in seconds, Entra ID groups are synchronized to Itential Platform.                                                                                                                                                                                                                                                                                                                                                                                         |
| `method`         | **Required.** The method used to synchronize Entra ID groups to Itential Platform. Available methods: **all** — synchronizes all Entra ID groups in the connected tenant (can cause performance issues with large numbers of groups); **master** — designates an Entra ID group as the synchronization source and synchronizes all child groups; **account** — designates an Entra ID account as the synchronization source and synchronizes any groups the account is a member of. |
| `masterGroup`    | Only required when using the **master** method. The Object ID of the Entra ID group to be used as the synchronization source.                                                                                                                                                                                                                                                                                                                                                       |
| `serviceAccount` | Only required when using the **account** method. The Object ID of the Entra ID account to be used as the synchronization source.                                                                                                                                                                                                                                                                                                                                                    |

![](/_fern-img/2e92fa82f4f639843351aef9aca9c47ce8e3b2875efdd680cec96a693eec095c.webp)

## Configure Entra ID group synchronization

The exact steps needed to configure group synchronization depend on your environment. In general:

1. Optionally, fine-tune the synchronization interval as desired.
2. Determine which synchronization method to use based on your needs. For example, `all` may be acceptable for development environments, but is likely to cause performance issues in production environments.
3. If using the `master` or `account` synchronization method, retrieve the desired group or account Object ID from Azure.
4. Provide this Object ID to `masterGroup` or `serviceAccount` as appropriate.

Object IDs are retrieved from the Azure portal. For further information about Object IDs, refer to the [Microsoft Azure documentation](https://learn.microsoft.com/en-us/partner-center/marketplace/find-tenant-object-id).

![](/_fern-img/0a99e0ffc4bc9da66de52b94ae237b0578d3b1995f856d5bf4215374b0c0adf1.webp)

> How to configure the Azure adapter to synchronize Entra ID (Azure AD) groups to Itential Platform for role-based access control.