The Microsoft 365 sync module of Portail ZAPP creates the accounts of the members of Microsoft 365 groups (Microsoft Entra ID) and maintains the membership of these accounts in the application's groups. Synchronization goes one way: from Microsoft 365 to Portail ZAPP. It never changes Microsoft 365.
The screen is reserved for administrators. It is reached through Administration âș Connectors and automation âș M365 sync (/m365-sync).
Setting up the connection
The Microsoft Entra ID configuration block holds the identifiers of a Microsoft Entra ID app registration (the new name of Azure AD), which must be allowed to read users, groups and their members:
- Tenant ID and Client ID: identifiers of your tenant and of the application, for example
00000000-0000-0000-0000-000000000000; - Client secret: it is never shown again. Once a secret is saved, the field becomes optional: leave it empty to keep the saved secret, type a new one to replace it;
- Orphan behavior: Disable or Report (see below). The field shows the saved setting: saving the configuration again does not change it.
The tenant ID and the client ID are required. If saving fails, the message âError while saving the configuration.â is shown; since the values are saved one after the other, some of them may have been saved: check the values shown before trying again.
These settings are separate from those of user sign-in with a Microsoft 365 account, which is set up in Authentication.
Test connection tries the values typed in the form, without saving them. An empty field falls back to the saved value; the saved secret is only reused for the saved tenant and client: to test another tenant or application, type the secret as well. The result is shown in a message: connection successful, incomplete configuration, or failure (the details are then in the server logs).
Sources and mappings
User synchronization: the sources, that is, the Microsoft 365 groups whose members must have an account. Choose the type (Group, Team or Security group), search for the group by the beginning of its name, then Add source. The same group cannot be added twice.
Group membership synchronization: the mappings, which link a Microsoft 365 group to a Portail ZAPP group. At each synchronization, the members of the Microsoft 365 group who have a Microsoft 365 source account in Portail ZAPP â created by the synchronization or by a sign-in with a Microsoft 365 account â are added to the matching group; a member who has no account yet is skipped (it is not created at this step). Removals follow the same rule: only a Microsoft 365 source account is removed from a group when it is no longer in the Microsoft 365 group; a local account placed in the group by hand is never removed. A local account, or one from another source, that has the same sign-in identifier or the same address as a Microsoft 365 member is never added to the group: it would receive the group's rights without anyone deciding so. A group already synchronized by another source (for example organizations) is not changed.
All the members of a group are read, whatever its size. If Microsoft 365 throttles the calls, the read is retried a few times before giving up. A failed read never removes anyone.
What a synchronization does
For each member of the active sources:
- missing account: it is created with the first name, last name and address; the sign-in identifier is the email address (or, failing that, the user principal name). A member without an address is skipped;
- existing account: it is not changed (first name, last name and address are not updated). The Updated column of the log counts these already existing accounts. A Microsoft 365 source account is tracked by its Microsoft Entra identifier: an address change on the Microsoft 365 side does not create a second account;
- local account with the same sign-in identifier: it is counted in Updated, but does not come under the synchronization's control (not tracked, not added to mapped groups, not handled as an orphan). Since it is not tracked by its Microsoft Entra identifier, it is found again at each run by its sign-in identifier: if the person's address changes in Microsoft 365, the next synchronization creates a second account;
- reassigned address: if the address of an account already linked to a Microsoft 365 person now belongs to another person, that account is never taken over by the new holder (not linked, not reactivated, not added to groups). The new holder gets no account, and this is not counted as an error: the administrator must handle the case by hand. It is only reported in the synchronization's error details (see âFollowing synchronizationsâ), not in the Synchronize now message.
The synchronization creates accounts without a password: how these people sign in is set up in Authentication.
Line manager
The M365Sync:SyncManagers setting of the Configuration screen (M365Sync category, off by default), set to true, also fills in the line manager of the synced accounts, from the manager given in Microsoft Entra ID. The rules are those of the Google Workspace sync:
- a locked link (entered by hand, by default) is never changed;
- the manager is only looked up among the accounts followed by this sync: an unknown manager, or one whose account was created by hand or by another connector, changes nothing;
- a user with no manager in Entra ID has their link ended only if that link came from a sync;
- a new manager ends the current link and opens a new one: the history stays on the account's Managers and history page, with the origin "Microsoft 365".
If reading the managers fails, no link is changed and the error is counted in the sync history.
Orphan accounts
An orphan is an account created by the Microsoft 365 synchronization that no longer appears in any active source. Local accounts or accounts from another source are never affected.
- Disable (default): the account is disabled in Portail ZAPP. This is reversible: if the person shows up in a source again, the account is reactivated automatically. An account you disabled by hand is never reactivated.
- Report: the list of orphans is written to the synchronization log; nothing is changed.
No orphan is handled, and the reason is written to the log, if a source failed, if a source returned no member, or if a member could not be processed. Without any active source, nothing is done. Removing a source makes orphans of the accounts that only it brought in.
Running and scheduling
Synchronize now runs the synchronization immediately; a message then sums up the number of accounts created, updated and the errors.
The âM365Syncâ scheduled task of the Scheduler runs the synchronization every night at 2:30 AM. It is delivered disabled: enable it in the Scheduler once the configuration is done.
Following synchronizations
The Recent synchronizations block gives, for each run, the date, the status (Success, PartialSuccess when there were partial errors, Error), the number of accounts created and updated, the errors and the duration. When the Data grids module is installed, the grid adds the disabled accounts, the members added to and removed from groups and the error details (double-click a row to read them): they tell why orphans were not handled and list the reported orphans and the reassigned addresses. Without that module, they are not visible anywhere on the screen.