---
title: Sync Microsoft Entra
description: Connect Microsoft Entra (previously Azure AD) to onyo step by step
---

[Skip to content](https://support.onyo.de/en/knowledge/sync-microsoft-entra#main-content)

- [English](https://support.onyo.de/en/knowledge/sync-microsoft-entra)
- [Deutsch](https://support.onyo.de/de/knowledge/microsoft-entra-synchronisieren)

English

Show submenu for translations

[More support](https://support.onyo.de/en/knowledge/kb-tickets/new?hsLang=en)

![logo\_green background.png\]](https://support.onyo.de/hs-fs/hubfs/logo_green%20background.png?height=40&name=logo_green%20background.png)

Open main navigation

Close main navigation

- - [English](https://support.onyo.de/en/knowledge/sync-microsoft-entra)
    - [Deutsch](https://support.onyo.de/de/knowledge/microsoft-entra-synchronisieren)

  English
  
  Show submenu for translations
- [More support](https://support.onyo.de/en/knowledge/kb-tickets/new)
- To onyo.io

 To onyo.io

 Hello. How may we assist you today?

- There are no suggestions because the search field is empty.

1. [onyo FAQ](https://support.onyo.de/en/knowledge?hsLang=en)
2. [Manager](https://support.onyo.de/en/knowledge/manager?hsLang=en)
3. [Account & Set-Up](https://support.onyo.de/en/knowledge/manager?hsLang=en#account-set-up)

July 8, 2026

# Sync Microsoft Entra

## Connect Microsoft Entra (previously Azure AD) to onyo step by step

With the [HRIS sync](https://support.onyo.de/en/knowledge/hris-sync?hsLang=en) onyo imports your employees automatically from Microsoft Entra (previously called Azure AD) – every hour, with no manual import. This guide walks you through the setup step by step.

**Prerequisite:** In Microsoft Entra you need the rights to create an app registration and to grant admin consent (e.g. as an administrator of your Microsoft 365 tenant).

### Step 1: Set the provider to Microsoft Entra in onyo

In onyo, open the [HRIS sync page](https://support-auth.onyo.de/api/hubspot/redirect?to=%2Fsettings%2Fgeneral%3Ftab%3Dhris_sync) (Settings → General → HRIS sync) and select **Microsoft Entra** under **"HRIS provider"**. Three fields appear – **"Entra directory (tenant) ID"**, **"Entra application (client) ID"** and **"Entra client secret"** – we will get their values from Microsoft Entra in steps 2–4.

![onyo HRIS sync with HRIS provider Microsoft Entra and still empty credentials](https://support.onyo.de/hs-fs/hubfs/2037-onyo-entra-01-provider-en-1.png?width=688&name=2037-onyo-entra-01-provider-en-1.png)

### Step 2: Register an application in Microsoft Entra

In the Microsoft Entra admin center, open the ["Register an application" page](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/CreateApplicationBlade/quickStartType~/null/isMSAApp~/false) (found under Entra ID → App registrations → **"New registration"**). Enter e.g. **onyo** as the **Name**, keep the "Single tenant only" option under "Supported account types" and click **"Register"**. A redirect URI is not needed for the sync.

![Microsoft Entra, Register an application with name onyo](https://support.onyo.de/hs-fs/hubfs/2037-entra-sync-01-register-en.png?width=688&name=2037-entra-sync-01-register-en.png)

### Step 3: Copy the tenant ID and client ID

After registering you land on the application's "Overview". Copy the **"Directory (tenant) ID"** there, switch back to the onyo settings page and paste it into the **"Entra directory (tenant) ID"** field. Then go back to the Entra overview and do the same with the **"Application (client) ID"** for the onyo field **"Entra application (client) ID"**.

![Microsoft Entra, application Overview with Directory (tenant) ID and Application (client) ID](https://support.onyo.de/hs-fs/hubfs/2037-entra-sync-02-overview-en.png?width=688&name=2037-entra-sync-02-overview-en.png)

### Step 4: Create a client secret

In the application's menu go to **"Certificates & secrets"** and click **"New client secret"**. Enter a description (e.g. "onyo HRIS sync"), pick an expiry and click **"Add"**. Copy the secret's **Value** into the onyo field **"Entra client secret"** right away – it is only shown once.

![Microsoft Entra, Certificates & secrets with a newly created client secret and visible value](https://support.onyo.de/hs-fs/hubfs/2037-entra-sync-03-secret-en.png?width=688&name=2037-entra-sync-03-secret-en.png)

When the secret expires the sync stops: simply create a new secret and enter it in onyo.

### Step 5: Grant API permissions

Go to **"API permissions"** → **"Add a permission"** → **Microsoft Graph** → **"Application permissions"** and add the two permissions **User.Read.All** and **GroupMember.Read.All**. Then click **"Grant admin consent for …"** and confirm, so that the "Status" column shows a green **"Granted for …"**.

![Microsoft Entra, API permissions with User.Read.All and GroupMember.Read.All, admin consent granted](https://support.onyo.de/hs-fs/hubfs/2037-entra-sync-04-permissions-en.png?width=688&name=2037-entra-sync-04-permissions-en.png)

onyo uses **User.Read.All** to import your employees and **GroupMember.Read.All** to read your groups and their members. (Alternatively **User.ReadBasic.All** suffices instead of User.Read.All – but then only names and email addresses are imported, without addresses, and accounts disabled in Entra are not deactivated in onyo.)

### Step 6: Save the credentials in onyo

Switch back to onyo. The three fields from step 1 should now be filled in – click **"Save changes"**.

![onyo connection with filled in Entra directory (tenant) ID, application (client) ID and client secret](https://support.onyo.de/hs-fs/hubfs/2037-onyo-entra-02-connection-en-1.png?width=688&name=2037-onyo-entra-02-connection-en-1.png)

### Step 7: Configure the sync

After saving, the group list is loaded live from Microsoft Entra. Under **"2. Sync settings"**, choose which employees are imported:

- **Employment statuses** – only import employees with these statuses.
- **Employment types** – only import employees with these employment types.
- **HRIS groups** – only import members of the selected Entra groups. Leave empty to include all current and future groups. Many companies create a dedicated group in Entra (e.g. "onyo") and select only that one.
- **Budget field in tokens** – irrelevant for most companies and only relevant if you use virtual tokens instead of euros in onyo. Enable it only in that case, and only if the budget in Entra is also maintained in tokens.

**Important:** If you set several filters, employees must match **all** of them to be imported. For example, if you select certain employment statuses **and** certain employment types, someone is only imported when both the status and the type match (and, if groups are selected, the person belongs to one of them). Within a single filter, one match is enough – e.g. one of the selected statuses.

Then click **"Save changes"**.

![onyo sync settings with employment statuses, employment types and budget field](https://support.onyo.de/hs-fs/hubfs/2037-onyo-entra-03-sync-en-1.png?width=688&name=2037-onyo-entra-03-sync-en-1.png)

### Step 8: Start the first sync

Click **"Synchronize now with Microsoft Entra"** at the top to start the first import. After that onyo syncs automatically every hour.

Done :) From now on onyo keeps your employees in sync with Microsoft Entra automatically: new people are created in onyo, changes (e.g. name or address) are applied, and people who no longer match your criteria or were deleted in Entra are deactivated – every hour and with no manual import. If you have any questions or problems, feel free to reach out to us via the contact form at any time.

---

**Tip:** You can use the same Entra application for [single sign-on](https://support.onyo.de/en/knowledge/sso-via-entra?hsLang=en) as well. The application then needs both permission sets: the application permissions from this guide plus the delegated permissions "openid" and "email".

- [Manager](https://support.onyo.de/en/knowledge/manager?hsLang=en#main-content)

    - [Account & Set-Up](https://support.onyo.de/en/knowledge/manager?hsLang=en#account-set-up)
    - [Order and Shipping Process](https://support.onyo.de/en/knowledge/manager?hsLang=en#order-and-shipping-process)
    - [Return Process](https://support.onyo.de/en/knowledge/manager?hsLang=en#return-process)
    - [Contract Management](https://support.onyo.de/en/knowledge/manager?hsLang=en#contract-management)
- [Employee](https://support.onyo.de/en/knowledge/employee?hsLang=en#main-content)

    - [Delivery and Assembly](https://support.onyo.de/en/knowledge/employee?hsLang=en#delivery-and-assembly)
    - [Order](https://support.onyo.de/en/knowledge/employee?hsLang=en#order)
    - [Product Information](https://support.onyo.de/en/knowledge/employee?hsLang=en#product-information)
    - [Return Request and Insurance Case](https://support.onyo.de/en/knowledge/employee?hsLang=en#return-request-and-insurance-case)
    - [Other](https://support.onyo.de/en/knowledge/employee?hsLang=en#other)
    - [Return](https://support.onyo.de/en/knowledge/employee?hsLang=en#return)
- [Miscellaneous](https://support.onyo.de/en/knowledge/miscellaneous?hsLang=en)

[![Chill listening crop-3](https://support.onyo.de/hs-fs/hubfs/onyo_Logo_png.png?width=24&height=24&name=onyo_Logo_png.png "Chill listening crop-3")](https://www.onyo.io)

onyo FAQ

Copyright © 2026, onyo GmbH