Microsoft Entra ID — LiveSync™

LiveSync™ connects Swopi to your Microsoft Entra ID, and from that point on your members and their digital business cards manage themselves: a new employee in a group means a ready-to-go account in Swopi complete with a business card; a change of position in the directory means up-to-date details on the card. Set it up once and it runs without manual data entry.

This is a pull sync — at a scheduled interval (daily / weekly / …) Swopi reads data from Microsoft Graph, one-way and read-only. The exact list of permissions can be found on the Permissions (least privilege) page. For a real-time (push) option, see SCIM 2.0.

#Overview

#Prerequisites

• permission to edit the App Registration in your Entra ID and to grant admin consent,
• security groups whose members are to be synchronized into Swopi,
• the Swopi Teams plan.

#Step 1 — App Registration and permissions (provided by the customer)

In the Azure Portal → Microsoft Entra ID → App registrations:

1. Use the same app registration as for SSO, or create a new one.

2. API permissions → Add a permission → Microsoft Graph → Application permissions → add these two permissions (read-only):

   CopyCopied ✓

   User.Read.All
   

   CopyCopied ✓

   GroupMember.Read.All
   

3. Click Grant admin consent for {tenant} — without this step the Graph requests will fail.

   📸 Screenshot: admin consent granted for the Graph permissions. images/entra-graph-consent.png

4. Certificates & secrets → New client secret → create a client secret (if you don't already have one) and copy the value.

#Step 2 — Configuration in Swopi (customer administrator)

Dashboard → Integrations → Microsoft Entra ID:

1. Connection — fill in the Directory (tenant) ID, Application (client) ID, and client secret. Searching for groups also verifies that the connection works.

   📸 Screenshot: connecting Entra ID and searching for groups. images/swopi-entra-connect.png

2. Groups — select the groups whose members should be synchronized, and for each one set a role (Admin / Manager / Member). See Role mapping.

3. Frequency — we recommend Daily.

4. Fields to synchronize — for each field you choose:

   • Synchronize — the field is populated for new members,
   • Overwrite — changes in Entra overwrite the value in Swopi on the next sync. With overwrite disabled, manual edits in Swopi are preserved.

#Field mapping

#How synchronization works

• New member in a group → an account assigned to your organization is created in Swopi, along with a digital business card (pre-filled with the name and a QR code). The account has no password — the user signs in via SSO.
• Existing member → details are updated according to the Overwrite toggles; the role is reconciled with current group membership.
• Role based on groups → the group → role mapping is applied (priority Admin > Manager > Member). The Owner role is never overwritten.
• Security — accounts belonging to another organization are never taken over; the sync skips them and lists them in the results summary. The client secret never leaves the server.
• Removal from a group — the pull sync does not remove the member in Swopi (v1 does not delete). Automatic account deprovisioning is handled by SCIM 2.0; until then, an admin removes members manually in the Users section.

After each run, the configuration shows a summary: the number of new members, the number of updated members, and any skipped records with the reason.

This integration covers automated creation and updating of members by reading from Microsoft Graph (pull). SCIM 2.0 provisioning is a push standard by which Entra ID itself writes changes, including deactivations — see SCIM 2.0 provisioning. Both approaches share the group-to-role mapping.

#Troubleshooting

Integration contact: support@swopi.co