Azure AD syncer

The Azure AD syncer pulls users from Azure Active Directory (Microsoft Entra ID) into Casdoor using the Microsoft Graph API and keeps the directory in sync.

前提条件

Register an application in the Azure Portal and grant it the permissions below.

Step 1: Register an Application

Navigate to Azure Portal and register a new application:

1. Go to Azure Active Directory → App registrations → New registration
2. Enter a name for your application
3. Select the appropriate account type (typically "Accounts in this organizational directory only")
4. Click Register

Step 2: Create a Client Secret

After registration, create a client secret:

1. In your application, go to Certificates & secrets
2. Click New client secret
3. Add a description and select an expiration period
4. Click Add and copy the secret value immediately (it won't be shown again)

Step 3: Grant API Permissions

Configure the required Microsoft Graph API permissions:

1. Go to API permissions → Add a permission
2. Select Microsoft Graph → Application permissions
3. Add the User.Read.All permission
4. Click Grant admin consent for your organization

ヒント

The User.Read.All permission allows the syncer to read all user profiles in your Azure AD tenant.

設定

To create an Azure AD syncer in Casdoor:

1. Navigate to the Syncers tab
2. Click Add to create a new syncer
3. Fill in the following required fields:

フィールド	説明
組織	The Casdoor organization where users will be imported
名前	A unique identifier for this syncer
タイプ - ツールチップ	Select "Azure AD"
テナントID	Your Azure AD tenant ID (found in Azure Portal → Azure Active Directory → Overview)
クライアントID	The Application (client) ID from your app registration
クライアントシークレット	The client secret value you created earlier

Other database-related fields (Database type, Port, Database, Table) are not used for Azure AD syncer and can be left empty.

Field Mappings

The syncer automatically maps Azure AD user attributes to Casdoor user fields:

Azure AD Field	Casdoor Field	説明
id	Id	User's unique identifier
userPrincipalName	名前	User principal name
displayName	表示名	User's display name
givenName	FirstName	名前
surname	LastName	苗字
mail	メールアドレス	email
mobilePhone	電話	Mobile phone number
jobTitle	タイトル	Job title
officeLocation	場所	Office location
preferredLanguage	言語	Preferred language
accountEnabled	IsForbidden	Account status (inverted)

情報

The accountEnabled field is inverted when mapped to IsForbidden. When a user is disabled in Azure AD (accountEnabled: false), they will be marked as forbidden in Casdoor (IsForbidden: true).

Running the Syncer

After configuration:

1. Click Test Connection to verify your credentials and permissions
2. Enable the syncer by toggling Is enabled
3. Click Sync to trigger an immediate synchronization
4. The syncer will automatically fetch all users from your Azure AD tenant

The syncer handles pagination automatically, retrieving all users regardless of the total count.