Microsoft Entra ID (Azure Active Directory)

Prerequisites

Note: To configure sync with Microsoft Entra ID (AAD) you need to be an admin or application owner within Zilla AND have admin access to your organization's Microsoft Entra ID application, specifically Global administrator role.

Login to Microsoft Azure with your admin credentials.
Click Microsoft Entra ID to be redirected to your tenant’s overview page.
Copy and save the Primary domain for the tenant you want to sync for use in a later step in Zilla while configuring Microsoft Entra ID.

Setup Microsoft Entra ID instance in Zilla

Login to Zilla with your admin credentials. Click Add Application in the top right corner.

2. You will see Add Application screen with Search Library tab. Type entra as search text, and click Add to Applications button on the right side of the Microsoft Entra ID (Azure Active Directory) entry.

Fill in the form with appropriate details and click Add to Applications button.

The Entra ID instance will be added to your Applications, and you will be brought to a detailed application instance page. Click Sync now in the top right corner.

A dialogue appears, enable API Integration.

Upon enabling the API Integration more customization options appear. Information is given for each configuration field below the screenshot.

AAD tenant's domain name* - This is a required field. Fill in the domain name saved above under Prerequisites section.
Sync Groups data? (Yes/No)*- This is a required field. This controls the overall behavior as to whether or not sync any groups data. The default value is Yes. When set to No, Zilla will not sync any group details from Graph.
Sync Security Enabled Groups Only? (Yes/No)*- This is a required field. The default value is Yes and Zilla will sync only Security Enabled Groups. When set to No, Zilla will sync all the groups provided the above field Sync Groups data is set to Yes.
Comma-separated attributes that identify a user - Provide an Entra ID specific attribute (e.g., employeeId, jobTitle, department, etc) for which you want to sync Entra ID users. For example, if you specify department, only accounts that have a defined department will be imported. If multiple attributes are specified, all accounts having at least one of the attributes defined will be imported. Be sure to refer to this document before entering the attribute, otherwise all the accounts will be marked as Service if the attribute does not match with what is specified in the document.
Auto Discover Azure Cloud subscriptions? (Yes/No)* - This is a required field. Yes will auto-discover all the Azure Cloud subscriptions and create application instances for them in Zilla. Default value: No.
Auto Sync discovered subscriptions? (Yes/No)* - This is a required field. Yes will automatically sync the auto-discovered subscriptions when the parent is synced. This value should be set to No if Auto Discover Azure Cloud subscriptions? (Yes/No) is set to No. Default value: No.
Sync last login? (Yes/No) - Yes will bring lastLogin activity of users. Default No.

Note for syncing Last login:

To complete configuration of last login setting you must re-authenticate after setting Yes, check “Re-authenticate API integration” box if this is not the first sync.
Also, user who is authorizing the sync should have Global Administrator role.
The last login data that is synced in Zilla matches what is displayed on the User’s Overview page.

Comma separated custom select fields (e.g., country, id) - This configuration allows you to retrieve additional fields from Microsoft Entra ID by specifying a comma-separated list of field names. For example, you can input "city, officeLocation" to retrieve the city and office location field. For more info refer this https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#select-parameter.
Enable account modifications? (Yes/No)* - This is a required field. Yes will automatically revoke group memberships, group ownerships and permissions that have been flagged for revocation after an access review during a sync. Note: This setting is only available if Account Modifications are enabled in the tenant Settings.

Click Sync Now/Next.
In the next pop-up, click Next.

You will be taken to the Microsoft site where you need to log in with a user with the Admin (