Microsoft Entra ID (Azure Active Directory)
Note: To configure sync with Microsoft Entra ID (AAD) you need to be an admin or application owner within Zilla AND have admin access to your organization's Microsoft Entra ID application, specifically Global administrator
role.
Login to Microsoft Azure with your admin credentials.
Click
Microsoft Entra ID
to be redirected to your tenant’s overview page.Copy and save the Primary domain for the tenant you want to sync for use in a later step.
Login to Zilla with your admin credentials. Click
Add Application
in the top right corner.
You will see Add Application screen with Search Library tab. Type
entra
as search text, and clickAdd to Applications
button on the right side of the Microsoft Entra ID (Azure Active Directory) entry.
Fill in the form with appropriate details and click
Add to Applications
button.
The Entra ID instance will be added to your Applications, and you will be brought to a detailed application instance page. Click
Sync now
in the top right corner.
A dialogue appears, enable API Integration.
Upon enabling the API Integration more customization options appear
AAD tenant's domain name
- Fill in the domain name saved above.Sync All Groups? ( Yes/No )
-Yes
will sync all groups from Entra ID,No
will only sync security-enabled groups. Default value:No
.Comma-separated attributes that identify a user
- Provide an Entra ID specific attribute (e.g.,employeeId
,jobTitle
,department
, etc) for which you want to sync Entra ID users. For example, if you specify department, only accounts that have a defined department will be imported. If multiple attributes are specified, all accounts having at least one of the attributes defined will be imported. Be sure to refer to this document before entering the attribute, otherwise all the accounts will be marked asService
if the attribute does not match with what is specified in the document.Auto Discover Azure Cloud subscriptions? (Yes/No)
-Yes
will auto-discover all the Azure Cloud subscriptions and create application instances for them in Zilla. Default value:No
.Auto Sync discovered subscriptions? (Yes/No )
-Yes
will automatically sync the auto-discovered subscriptions when the parent is synced. This value should be set toNo
ifAuto Discover Azure Cloud subscriptions? (Yes/No)
is set toNo
. Default value:No
.Enable account modifications? (Yes/No)
-Yes
will automatically revoke group memberships, group ownerships and permissions that have been flagged for revocation after an access review during a sync. Note: This setting is only available if Account Modifications are enabled in the tenant Settings.Sync last login? (Yes/No)
-Yes
will bringlastLogin
for a user. DefaultNo
.
Note:
To complete configuration of this setting you must reauthenticate after setting
Yes
, check “Reauthenticate API integration” box if this is not the first sync.Also, user who is authorizing the sync should have one of the following roles:
Global Administrator
Global Reader
Security Administrator
Security Reader
Conditional Access Administrator
The last login data that is synced matches what is displayed on the User’s Overview page.
Comma separated custom select fields (e.g., country, id)
- This configuration allows you to retrieve additional fields from Microsoft Entra ID by specifying a comma-separated list of field names. For example, you can input "city, officeLocation" to retrieve the city and office location field. For more info refer this https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#select-parameter.
Click
Sync Now/Next
.In the next pop-up, click
Next
.
You will be taken to the
Microsoft
site where you need to log in with a user with the Admin (Global administrator
) role for Azure portal and grant consent on behalf of the organization.The consent screen will look like the image below when
Auto Discover Azure Cloud subscriptions? (Yes/No)
is set toYes
.The consent screen will look like the image below when
Auto Discover Azure Cloud subscriptions? (Yes/No)
is set toNo
.The consent screen will look like the image below when
Enable account modifications? (Yes/No)(Yes/No)
is set toYes
. Highlighted permissions are the new ones for consent if you have previously synced Entra ID withEnable account modifications? (Yes/No)
set asNo
.Click
Accept
. On successful OAuth, you will be redirected to Zilla withSync in progress...
message for newly added Entra ID application instance. ClickDone
on the below pop-up screen
On successful sync, you will see the following notification:
Review the sync summary, click
Close
Note: In some cases, the process of configuring and using Entra ID API through Zilla to sync permissions and users with your organization's Entra ID may be done by an Azure user with Global Reader permissions. When an Azure Global Reader makes the initial sync request the request will need to be approved within the Azure portal by a Global Administrator as shown in the steps below:
Step 1. Global Reader initiates Entra ID sync with Zilla. A consent request will be created in the Azure portal.
Step 2. In Entra ID go to Enterprise applications, then Admin consent requests. The pending request appears waiting for approval.
Step 3. The Global Administrator approves the permissions request by clicking Accept
.
Note: If you try to sync in a tenant other than for which you have entered the domain, Microsoft will return an error message.
Note:
If user has already consented the sync with Enable account modifications? (Yes/No)
and Auto Discover Azure Cloud subscriptions? (Yes/No)
set to No
, then when re-authenticating the consent screen will not be shown for the same Azure user performing the sync. If the above values are set to Yes
then the same user will now see the consent screen even without re-authentication until that user gives consent for these permissions.