Azure AD syncer

The Azure AD syncer pulls users from Azure Active Directory (Microsoft Entra ID) into Casdoor using the Microsoft Graph API and keeps the directory in sync.

Pré-requisitos

Register an application in the Azure Portal and grant it the permissions below.

Step 1: Register an Application

Navigate to Azure Portal and register a new application:

1. Go to Azure Active Directory → App registrations → New registration
2. Enter a name for your application
3. Select the appropriate account type (typically "Accounts in this organizational directory only")
4. Click Register

Step 2: Create a Client Secret

After registration, create a client secret:

1. In your application, go to Certificates & secrets
2. Click New client secret
3. Add a description and select an expiration period
4. Click Add and copy the secret value immediately (it won't be shown again)

Step 3: Grant API Permissions

Configure the required Microsoft Graph API permissions:

1. Go to API permissions → Add a permission
2. Select Microsoft Graph → Application permissions
3. Add the User.Read.All permission
4. Click Grant admin consent for your organization

dica

The User.Read.All permission allows the syncer to read all user profiles in your Azure AD tenant.

Configuração

To create an Azure AD syncer in Casdoor:

1. Navigate to the Syncers tab
2. Click Add to create a new syncer
3. Fill in the following required fields:

Campo	Descrição
Organização	The Casdoor organization where users will be imported
Nome	A unique identifier for this syncer
Dica: tipo	Select "Azure AD"
ID Tenant	Your Azure AD tenant ID (found in Azure Portal → Azure Active Directory → Overview)
ID do Cliente	The Application (client) ID from your app registration
Segredo do Cliente	The client secret value you created earlier

Other database-related fields (Database type, Port, Database, Table) are not used for Azure AD syncer and can be left empty.

Field Mappings

The syncer automatically maps Azure AD user attributes to Casdoor user fields:

Azure AD Field	Casdoor Field	Descrição
id	Id	User's unique identifier
userPrincipalName	Nome	User principal name
displayName	DisplayName	User's display name
givenName	FirstName	Nome
surname	LastName	Sobrenome
mail	Email	Email address
mobilePhone	Telefone	Mobile phone number
jobTitle	Título	Job title
officeLocation	Localização	Office location
preferredLanguage	Idioma	Preferred language
accountEnabled	IsForbidden	Account status (inverted)

informação

The accountEnabled field is inverted when mapped to IsForbidden. When a user is disabled in Azure AD (accountEnabled: false), they will be marked as forbidden in Casdoor (IsForbidden: true).

Running the Syncer

After configuration:

1. Click Test Connection to verify your credentials and permissions
2. Enable the syncer by toggling Is enabled
3. Click Sync to trigger an immediate synchronization
4. The syncer will automatically fetch all users from your Azure AD tenant

The syncer handles pagination automatically, retrieving all users regardless of the total count.