Sync groups with Microsoft Entra ID

If your organization already arranges people in Microsoft Entra ID groups, Zoan Cloud can bring them in: members and owners update on their own, and tasks addressed to a group reach whoever is in it today. Someone who leaves a group in Entra stops getting its work on the next sync. If you want, Zoan Cloud also creates the accounts of the people in your groups with each group’s roles and environments and suspends access for those who leave.

The connection uses your organization’s Entra application, with its own keys. If single sign-on already uses an Entra application, you can reuse it: you just add the group read permissions.

What you need

A plan with single sign-on (SSO).
In Zoan Cloud, permission to change organization settings (Owner or Administrator) and, to choose and sync groups, Crear y editar grupos (group:manage).
In Entra, someone who can register applications and grant admin consent (for example, Application Administrator or Global Administrator).

Microsoft Graph permissions

Add these Microsoft Graph application permissions (not delegated) and grant admin consent:

Permission	What for	Also accepted
`GroupMember.Read.All`	Read groups, their members and their owners.	`Group.Read.All`
`User.Read.All`	Read each member’s email, name and status (enabled or not); with account creation, also check their groups at sign-in.	—

Directory.Read.All also covers both. They are read-only: Zoan Cloud never writes to your directory. Creating accounts, giving roles by group and suspending need no extra permission.

Step by step in Microsoft Entra

1. Register the application (or reuse the SSO one)

Go to the Microsoft Entra admin center › Identity › Applications › App registrations.
If you already have the single sign-on application, open it and go to step 2. Otherwise click New registration, name it (for example, “Zoan Cloud”) and choose Accounts in this organizational directory only. No redirect URL is needed for syncing.
In Overview, copy the Application (client) ID and the Directory (tenant) ID.

2. Add the permissions

In the application, open API permissions › Add a permission › Microsoft Graph › Application permissions.
Find and check GroupMember.Read.All and User.Read.All. Click Add permissions.

In API permissions, click Grant admin consent for and confirm. The Status column must say Granted for both permissions.

4. Create the secret

Open Certificates & secrets › Client secrets › New client secret.
Choose the lifetime (Entra allows up to 24 months) and click Add.
Copy the secret’s Value right away (Entra doesn’t show it again). Careful: the value, not the Secret ID.
Write down the expiry date: Zoan Cloud warns you 30 days before.

If you reuse the SSO application, you don’t need another secret: Zoan Cloud uses the one it already stores for sign-in.

Step by step in Zoan Cloud

Go to Administración › Organización y SSO and find Grupos de Microsoft Entra ID. Click Conectar (Connect).
If SSO is Entra, check Usar la aplicación del inicio de sesión (SSO) (use the sign-in application). Otherwise type the directory ID, the application ID and the secret value, and optionally its expiry date.
Choose how often to sync (hourly by default; or manual only).
Click Guardar y verificar (Save and verify). Zoan Cloud requests access with the application and tells you whether it has the permissions or exactly which one is missing. Repeat it whenever you want with Verificar permisos (Verify permissions).
In Grupos sincronizados (synced groups), search the group by name and click Sincronizar (Sync). The group appears in Administración › Grupos with origin Microsoft Entra ID and its members right away.

The secret is stored encrypted and never shown again. To change it, edit the connection and type the new value; empty keeps the current one.

How syncing works

Members: the group’s members in Entra, including those of nested groups. Each one is recognized by email or user principal name (UPN) against your organization’s active people.
No account: people who are in Entra but not in Zoan Cloud show in the group’s detail as Sin cuenta en Zoan Cloud (no account) with Invitar (Invite); once they accept the invitation, they join the group on the next sync. With account creation on, their account is created automatically instead.
Owner: the group’s owners in Entra who have an account. If you’d rather pick it in Zoan Cloud, add it in the group’s detail; Tomarlo de Entra (take it from Entra) goes back to the owners.
Read-only: the name and members of a synced group are changed in Entra.
When: at the interval you chose, and when you click Sincronizar ahora (Sync now). Accounts disabled in Entra don’t count.
Log: Últimas sincronizaciones (latest syncs) shows each run (manual or scheduled), how many people joined and left, new, suspended and reactivated accounts, licenses without a seat, environment access given and removed, and any error. Every sync is also in the audit log, as is every account created (user.provisioned), suspended (user.suspended) or reactivated (user.reactivated).

If a group is deleted in Entra, it keeps its current members in Zoan Cloud and is flagged; Dejar de sincronizar (stop syncing) removes it. If the application loses access (expired secret, consent removed), syncing stops without touching anyone and the connection status shows why.

Create accounts from Entra

With Crear cuentas para los miembros de los grupos sincronizados (create accounts for the members of synced groups; off by default), Zoan Cloud adds only the people in your groups: on each sync, anyone in a synced group who has no account in your organization gets one, with their email (or UPN), first and last name as they are in Entra. You onboard a whole team without inviting people one by one, and Entra remains the place where you decide who gets in.

They sign in with Microsoft: accounts created this way have no Zoan Cloud password; they sign in with the Microsoft button of single sign-on. That’s why the option requires your organization to sign in with Microsoft Entra ID, from the same directory as the connection. If it isn’t set up, the option is disabled with the reason.
Managed by Microsoft Entra: in Usuarios (Users) they show Gestionado por Microsoft Entra; their name and email come from Entra.
Welcome (optional): check Enviar un correo de bienvenida con el enlace de inicio de sesión (send a welcome email with the sign-in link) if you want them to get the link. No invitations or passwords are sent.
Roles: the ones each group gives (see below). If their groups give none, they get the single sign-on default role, just like first-sign-in provisioning.
Environments: the ones each group gives. They sign in and already see where to work, without waiting for an administrator to give them access.
Licenses: never assigned on their own. Only if the group explicitly gives a license, and always within your plan’s quota: if there’s no seat left, the person is created without the license and the sync notes it in Últimas sincronizaciones (latest syncs).
How many per run: up to 500 new accounts per sync; the rest on the next one.

See what would change

Before turning the option on, or at any time, click Ver qué cambiaría (see what would change): Zoan Cloud queries Entra and shows what the next sync would do, without applying anything: new accounts (with their roles and environments), who joins and leaves each group, role, license and environment access changes, suspensions, reactivations and the suspensions that would wait for your confirmation.

Roles and environments per group

In a synced group’s detail (Administración › Grupos), Lo que reciben sus miembros (what its members get) › Cambiar lets you choose one or more roles, optionally a license, and the Ambientes (environments) they get into. Everyone in the group with an account gets them, including people you invited by hand.

Roles and environments given by a group are marked De Microsoft Entra in the person’s access. They can’t be removed by hand: remove the person from the group in Entra or remove them from the group.
What an administrator assigned by hand is never removed by the sync. If someone already had an environment assigned by hand, it stays manual.
If someone leaves the group, they lose the roles and environments that group gave them, unless another of their groups gives the same.
In the environments a group gives, each person works with their own roles. Todas las carpetas (all folders) can be checked by hand in their access; if the group stops giving that environment, it goes with it.
Only active environments can be chosen. If you archive an environment, the sync neither gives nor removes access to it while it stays archived; once reactivated, it syncs again.
Owners and Administrators get into every environment: no need to give it to them by group.
The Owner role is not given by group: it is assigned by hand to each person, so a change in Entra never leaves your organization without an Owner.
To change what a group gives you need Crear y editar grupos and the ability to assign roles, and you can only give roles, licenses and environments you could assign yourself: if you’re not an Owner or Administrator, only environments you work in, and only if the group’s members couldn’t do more there with their roles than you can. Changes apply on the next sync.
A role that administers the organization (for example, Administrator) can’t be given by a public Microsoft 365 group, which anyone in the directory can join: use a security group.
If a single sync would remove Entra roles, licenses or environments from many people at once (for example, because a group was emptied by mistake), it doesn’t remove them: Ver qué cambiaría shows it and someone who can change roles and remove people confirms it with Sincronizar y quitarlos (sync and remove them).
With account creation on, or if the group gives roles, licenses or environments, stopping its sync or deleting it also requires permission to change roles and remove people.

When someone leaves

With account creation on, if a person managed by Microsoft Entra leaves every synced group, or their account is disabled in Entra, their access is suspended on the next sync:

They can’t sign in and their open sessions are closed. They don’t get new work from their groups.
Nothing is deleted: their history, tasks and data stay. Their open tasks remain visible to whoever manages tasks, who can reassign them; Owners and Administrators get a notice (in the bell and by email) with how many tasks each person had.
If they come back to a synced group with an enabled account, they are reactivated automatically on the next sync (or when they sign in).
People you invited by hand are not suspended for this: they only lose the roles and environments their groups gave them.

So that a mistake in Entra can’t leave your organization without anyone to run it, some suspensions wait for your confirmation instead of applying on their own:

an Owner’s;
the person who set up the connection or turned the option on;
all of them, when a single sync would suspend many people at once (more than 3, or more than a quarter of the accounts managed by Entra).

While they wait, those people keep their roles and environments. They show in the connection with Suspender (suspend); confirming requires permission to remove people from the organization. Nobody can suspend themselves, and there is always at least one active Owner. If a group can’t be read from Entra in that run, nobody is suspended.

In Usuarios, a suspended person shows as Suspendido and has Reactivar (reactivate). If Entra manages them and they’re still out of the groups, the next sync suspends them again.

With the option on, someone signing in for the first time with the Microsoft button doesn’t need to wait for the sync: Zoan Cloud queries Entra at that moment and, if they’re in a synced group, creates their account with their groups’ roles and environments and signs them in.

If they’re in no synced group, it depends on Al entrar con Microsoft, solo los miembros de un grupo sincronizado tienen cuenta nueva (when signing in with Microsoft, only members of a synced group get a new account; checked by default):

Checked: they can’t get in, with a clear message asking them to get added to the group.
Unchecked: the single sign-on rule applies: if you have Crear usuarios automáticamente al primer acceso, they’re created with the default role (not managed by Entra); otherwise they need an invitation.

Which option should I use?

I want…	Set up
Only people in certain Entra groups to get in, with roles by group, losing access when they leave	Crear cuentas para los miembros de los grupos sincronizados, with roles per group.
Anyone in my domain to get in with the same role	In single sign-on, Crear usuarios automáticamente al primer acceso.
To decide person by person	Neither: invite from Usuarios (they can still sign in with Microsoft).

Common problems

Message	What to do
Missing application permission User.Read.All…	Add the permission it names and grant admin consent (steps 2 and 3).
The application secret is not valid	You copied the Secret ID instead of the value, or it was mistyped. Create a new one and paste its Value.
The application secret expired	Create a new secret in Entra and load it by editing the connection.
No application with that id in this directory	Check the application ID and the directory ID.
Admin consent is missing	Click Grant admin consent in API permissions.
To create accounts from Microsoft Entra ID, the organization must sign in with Microsoft Entra ID…	Set up and enable single sign-on with Entra.
Single sign-on uses another directory…	The connection and SSO must be in the same Entra directory. Simplest: Usar la aplicación del inicio de sesión (SSO).
Your Microsoft account doesn’t belong to any group enabled… (at sign-in)	Add the person to a synced group in Entra, or invite them from Usuarios.