Microsoft Entra ID

🟦 Microsoft Entra ID

If your organisation runs on Microsoft 365, Entra ID already holds your people, their managers and their groups. FreeITSM can use it in four ways: for signing in, for importing people before they ever sign in, for giving Intune laptops to the right person, and for drawing the organisation chart.

This page is the front door. It says what each part does, the order to set them up in, and where each one is documented. Most of the detail lives on pages shared with LDAP and CardDAV, because all three use the same import engine.

The whole Entra integration is tracked in issue #234. Most of it was built by vsc55.

---

What you get

Part	What it does	Since	Page
🔑 Signing in	Analysts and portal users sign in with their Microsoft account	-	Single Sign-On
📥 Importing people and groups	People, managers, job titles and groups come across from Entra, so a new starter exists before their first sign-in	4.7.0	Importing people from Microsoft Entra ID
🏷️ Group names in sign-in mappings	Entra sends groups as long ids. Imported groups get their real names, so the team and role mappings read "Finance" rather than 78d21822-…	4.7.0	Single Sign-On
💻 Intune primary user	An asset nobody holds is given to its device's primary user in Intune, matched by Entra object id, never by name	4.8.0	Assets - Intune integration
🏢 Organisation chart	Who reports to whom, from the managers the import brings in	4.8.0	Organisation chart
⏱️ Importing on a schedule	The import runs once a day by itself, with LDAP and CardDAV	4.8.0	Scheduled tasks
👥 Groups in People	A Group filter on the People list, a Groups tab with a page per group, and groups on a person's and a company's page	after 4.11.0	Groups in People
🛡️ Imported people can't be deleted by hand	Deleting one lost their history and the next import created them again as somebody new. Tickets → Users now greys out Delete and says why	after 4.11.0	What happens to people
📜 Group moves in the history	The run history says who joined and left each group, not just how many	after 4.11.0	Importing people
🗓️ Each source says when it is imported	A line under Run on the Entra, LDAP and CardDAV pages reads the scheduler: how often, when next, or a warning that nothing will	after 4.11.0	Running it on a schedule

Set it up in this order

1. Sign-in first. Add a Microsoft Entra provider under System → Authentication. The issuer is https://login.microsoftonline.com/<tenant-id>/v2.0. See Single Sign-On.
2. Then the import. Make a separate app registration with User.Read.All and GroupMember.Read.All, connect it to the same provider, press Preview, then Import now. See Importing people from Microsoft Entra ID.
3. Then Intune, if you use it. Switch on Assets → Settings → Intune → Assign assets to their primary user in Intune. It only works for people the import brought in, because it matches on their Entra object id.
4. The organisation chart needs nothing. It appears under People → Organisation once managers have been imported.

The order matters less than it looks, with one catch. People the import creates can sign in straight away, to the same record. But somebody who signed in before the import already has a record, and the import only finds it by sign-in name or email. Whether it then takes that record over is up to When somebody is already here on the import's settings. Check that setting before the first import, and use Preview to see who it would match.

Not built yet

The four follow-ups to #234 (PRs #237-#240) are merged and listed above - see the review. A separate schedule per source was dropped: the import is one job in the built-in scheduler, and two overlapping schedules were not worth it.

One known limit has no pull request yet: when a leaver's email or sign-in name goes to a new starter, the import shows a conflict and leaves the new starter out. There's no screen to separate the two. See When a sign-in name or email is reused.

For developers

• Entra directory sync - developer guide: Graph calls, the identity rules, the first sign-in
• Directory sync - developer guide and Extending directory sync: the engine Entra shares with LDAP and CardDAV
• Asset reconciliation - developer guide §6b: the Intune primary-user match
• Organisation chart - developer guide

Pull request reviews, each saying what was checked and what was changed:

• Microsoft Entra ID import (#235)
• Entra follow-ups: groups in People, delete rule, schedule line, cron/ (#237-#240)
• Assets from their Intune primary user (#236)
• Organisation chart (#242)

Also from Microsoft, but not Entra

These use Microsoft services but don't depend on Entra ID being set up as above:

• Microsoft Teams channel and Microsoft Teams alerts
• Microsoft 365 mailboxes for email tickets: see Mailbox authentication
• Exchange calendar sync: see Ticket calendar sync