Skip to main content

Microsoft Entra ID (Azure AD)

Manage1to1 can roster students and staff directly from Microsoft Entra ID (Azure AD) instead of a traditional SIS feed. This is the path for districts whose on-premises Active Directory is synchronized to Entra with Azure AD Connect — your directory is already the source of truth, and Manage1to1 reads it through Microsoft Graph with no software to install on-site.

Permission Required

To configure rostering you need the Manage Settings permission on your role.

How roles are decided

Entra has no concept of "student" vs "staff," so Manage1to1 uses group membership: you point it at one Entra group for students and one for staff. Members of the students group are rostered as students, members of the staff group as staff. Nested groups are included.

What you'll need​

  • Access to the Microsoft Entra admin center as a Global Administrator or Cloud Application Administrator (to grant admin consent).
  • Two Entra groups: one whose members are your students, one whose members are your staff.
  • A few minutes to register an application and create a client secret.

Step 1: Register an Application in Microsoft Entra​

  1. In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration.
  2. Name it (for example, Manage1to1 Rostering), keep the default single-tenant option, and register it.
  3. On the app's Overview page, copy the Directory (tenant) ID and the Application (client) ID.

Step 2: Grant the Directory Permissions​

  1. On your app, open API permissions → Add a permission → Microsoft Graph → Application permissions.
  2. Add both:
    • User.Read.All — read your directory's users
    • GroupMember.Read.All — read the members of your student and staff groups
  3. Choose Grant admin consent for your organization — each permission's status must show a green check.
Application permissions, not delegated

Manage1to1 reads your directory on a schedule with no signed-in user, so both permissions must be added under Application permissions (not Delegated) and must have admin consent. Without consent, the connection test fails even with a correct tenant, client ID, and secret.

Step 3: Create a Client Secret​

  1. Open Certificates & secrets → New client secret, set an expiry, and add it.
  2. Copy the secret Value immediately — Entra shows it only once. Copy the Value, not the Secret ID.
Set a reminder for the expiry

Client secrets expire on the date you choose. When one lapses, rostering stops until you create a new one and paste it into Manage1to1. Note the date and rotate the secret before it expires.

Step 4: Identify Your Student and Staff Groups​

In Entra, open Groups and note the Object ID of the group whose members are your students, and the group whose members are your staff. These are the two group IDs Manage1to1 will read.

Keep the groups current in your directory

Manage1to1 rosters exactly who is in these groups. If your Azure AD Connect / directory automation already maintains student and staff groups, point Manage1to1 at those and membership stays current automatically.

Step 5: Align Your Buildings​

Manage1to1 assigns each person to a building using the value of a directory attribute (for example, department, officeLocation, or an extensionAttribute). That value must match a building's SIS ID in Manage1to1.

Before your first sync, make sure the buildings exist in Manage1to1 with a SIS ID matching whatever your directory stores (e.g. if a user's department is HS, a building must have the SIS ID HS). See Building Alignment on the rostering overview.

Step 6: Configure the Integration in Manage1to1​

  1. Navigate to Settings → Integrations → User Rostering.
  2. Choose Microsoft Entra ID as the rostering provider.
  3. Fill in the Connection settings:
SettingWhat to enter
Directory (Tenant) IDThe Directory (tenant) ID from Step 1.
Application (Client) IDThe Application (client) ID from Step 1.
Client SecretThe secret Value from Step 3.
  1. Fill in the Mapping settings:
SettingWhat to enter
Students Group IDThe Object ID of your students group (Step 4).
Staff Group IDThe Object ID of your staff group.
Identifier AttributeThe directory attribute used as each person's local ID (the match key). Defaults to the on-prem AD username (onPremisesSamAccountName); employeeId is also common.
Building AttributeThe attribute whose value is the building code (must match a building's SIS ID). Common choices: department, officeLocation, companyName, or an extensionAttribute.
Grade Attribute(Optional) The attribute holding a student's grade level. Leave blank if you don't track grade in Entra.
  1. Click Test Connection — Manage1to1 authenticates with Microsoft Graph and confirms the credentials and permissions.
  2. Save, then run a sync (or wait for the daily automated sync).

What Gets Synced​

  • Students — members of the students group, with name, email, local ID, building, and (if configured) grade.
  • Staff — members of the staff group, with name, email, local ID, and building.
  • Disabled accounts in a group are skipped, so a departed student or staff member left in the group isn't re-created.

Manage1to1 matches people to existing records by the Identifier Attribute you chose, so make sure it holds the same value your Manage1to1 records use as their local ID.

Troubleshooting​

Test Connection fails​

  • Admin consent isn't granted. On the app's API permissions page, confirm User.Read.All and GroupMember.Read.All are Application permissions with a green Granted check. This is the most common cause.
  • The secret value is wrong or expired. Confirm you copied the secret Value (not the Secret ID) and that it hasn't passed its expiry.
  • The tenant or client ID is off. Re-copy both from the app's Overview page.

Sync runs but people are missing​

  • Confirm the person is actually a member of the correct group (directly or through a nested group).
  • Confirm their account is enabled in Entra — disabled accounts are skipped.
  • Confirm the Identifier Attribute has a value for them.

People sync but aren't placed in a building​

  • The Building Attribute value must exactly match a building's SIS ID in Manage1to1. Check the attribute's value in Entra against your building SIS IDs, and pre-create any missing buildings.

Rotating the Client Secret​

  1. In Entra, create a New client secret on your app and copy its Value.
  2. Paste it into Settings → Integrations → User Rostering → Microsoft Entra ID → Client Secret.
  3. Click Test Connection to confirm, then Save.
  4. Delete the old secret in Entra once the new one is saved and working.
Last updated on