Azure AD syncer

The Azure AD syncer pulls users from Azure Active Directory (Microsoft Entra ID) into Casdoor using the Microsoft Graph API and keeps the directory in sync.

Необхідні умови

Register an application in the Azure Portal and grant it the permissions below.

Step 1: Register an Application

Navigate to Azure Portal and register a new application:

1. Go to Azure Active Directory → App registrations → New registration
2. Enter a name for your application
3. Select the appropriate account type (typically "Accounts in this organizational directory only")
4. Click Register

Step 2: Create a Client Secret

After registration, create a client secret:

1. In your application, go to Certificates & secrets
2. Click New client secret
3. Add a description and select an expiration period
4. Click Add and copy the secret value immediately (it won't be shown again)

Step 3: Grant API Permissions

Configure the required Microsoft Graph API permissions:

1. Go to API permissions → Add a permission
2. Select Microsoft Graph → Application permissions
3. Add the User.Read.All permission
4. Click Grant admin consent for your organization

порада

The User.Read.All permission allows the syncer to read all user profiles in your Azure AD tenant.

Конфігурація

To create an Azure AD syncer in Casdoor:

1. Navigate to the Syncers tab
2. Click Add to create a new syncer
3. Fill in the following required fields:

Поле	Опис
Організація	The Casdoor organization where users will be imported
Ім'я	A unique identifier for this syncer
Тип - підказка	Select "Azure AD"
ID Tenant	Your Azure AD tenant ID (found in Azure Portal → Azure Active Directory → Overview)
ID клієнта	The Application (client) ID from your app registration
Client Secret	The client secret value you created earlier

Other database-related fields (Database type, Port, Database, Table) are not used for Azure AD syncer and can be left empty.

Field Mappings

The syncer automatically maps Azure AD user attributes to Casdoor user fields:

Azure AD Field	Casdoor Field	Опис
id	Id	User's unique identifier
userPrincipalName	Ім'я	User principal name
displayName	Відображуване ім'я	User's display name
givenName	FirstName	Ім'я
surname	LastName	Прізвище
mail	Електронна пошта	Email address
mobilePhone	Телефон	Mobile phone number
jobTitle	Заголовок	Job title
officeLocation	Місцезнаходження	Office location
preferredLanguage	Мова	Preferred language
accountEnabled	IsForbidden	Account status (inverted)

інформація

The accountEnabled field is inverted when mapped to IsForbidden. When a user is disabled in Azure AD (accountEnabled: false), they will be marked as forbidden in Casdoor (IsForbidden: true).

Running the Syncer

After configuration:

1. Click Test Connection to verify your credentials and permissions
2. Enable the syncer by toggling Is enabled
3. Click Sync to trigger an immediate synchronization
4. The syncer will automatically fetch all users from your Azure AD tenant

The syncer handles pagination automatically, retrieving all users regardless of the total count.