Sync Microsoft Entra

With the HRIS sync onyo imports your employees automatically from Microsoft Entra (previously called Azure AD) – every hour, with no manual import. This guide walks you through the setup step by step.

Prerequisite: In Microsoft Entra you need the rights to create an app registration and to grant admin consent (e.g. as an administrator of your Microsoft 365 tenant).

Step 1: Set the provider to Microsoft Entra in onyo

In onyo, open the HRIS sync page (Settings → General → HRIS sync) and select Microsoft Entra under "HRIS provider". Three fields appear – "Entra directory (tenant) ID", "Entra application (client) ID" and "Entra client secret" – we will get their values from Microsoft Entra in steps 2–4.

Step 2: Register an application in Microsoft Entra

In the Microsoft Entra admin center, open the "Register an application" page (found under Entra ID → App registrations → "New registration"). Enter e.g. onyo as the Name, keep the "Single tenant only" option under "Supported account types" and click "Register". A redirect URI is not needed for the sync.

Step 3: Copy the tenant ID and client ID

After registering you land on the application's "Overview". Copy the "Directory (tenant) ID" there, switch back to the onyo settings page and paste it into the "Entra directory (tenant) ID" field. Then go back to the Entra overview and do the same with the "Application (client) ID" for the onyo field "Entra application (client) ID".

Step 4: Create a client secret

In the application's menu go to "Certificates & secrets" and click "New client secret". Enter a description (e.g. "onyo HRIS sync"), pick an expiry and click "Add". Copy the secret's Value into the onyo field "Entra client secret" right away – it is only shown once.

When the secret expires the sync stops: simply create a new secret and enter it in onyo.

Step 5: Grant API permissions

Go to "API permissions" → "Add a permission" → Microsoft Graph → "Application permissions" and add the two permissions User.Read.All and GroupMember.Read.All. Then click "Grant admin consent for …" and confirm, so that the "Status" column shows a green "Granted for …".

onyo uses User.Read.All to import your employees and GroupMember.Read.All to read your groups and their members. (Alternatively User.ReadBasic.All suffices instead of User.Read.All – but then only names and email addresses are imported, without addresses, and accounts disabled in Entra are not deactivated in onyo.)

Step 6: Save the credentials in onyo

Switch back to onyo. The three fields from step 1 should now be filled in – click "Save changes".

Step 7: Configure the sync

After saving, the group list is loaded live from Microsoft Entra. Under "2. Sync settings", choose which employees are imported:

• Employment statuses – only import employees with these statuses.
• Employment types – only import employees with these employment types.
• HRIS groups – only import members of the selected Entra groups. Leave empty to include all current and future groups. Many companies create a dedicated group in Entra (e.g. "onyo") and select only that one.
• Budget field in tokens – irrelevant for most companies and only relevant if you use virtual tokens instead of euros in onyo. Enable it only in that case, and only if the budget in Entra is also maintained in tokens.

Important: If you set several filters, employees must match all of them to be imported. For example, if you select certain employment statuses and certain employment types, someone is only imported when both the status and the type match (and, if groups are selected, the person belongs to one of them). Within a single filter, one match is enough – e.g. one of the selected statuses.

Then click "Save changes".

Step 8: Start the first sync

Click "Synchronize now with Microsoft Entra" at the top to start the first import. After that onyo syncs automatically every hour.

Done :) From now on onyo keeps your employees in sync with Microsoft Entra automatically: new people are created in onyo, changes (e.g. name or address) are applied, and people who no longer match your criteria or were deleted in Entra are deactivated – every hour and with no manual import. If you have any questions or problems, feel free to reach out to us via the contact form at any time.

Tip: You can use the same Entra application for single sign-on as well. The application then needs both permission sets: the application permissions from this guide plus the delegated permissions "openid" and "email".