User import from Microsoft Entra ID is based on a progressive identification process that uses the Object ID, email, and username to determine whether a user should be created or updated on the platform.
User Identification
Microsoft Entra ID assigns each user a unique identifier called Object ID.
This identifier allows:
- Uniquely identifying each user
- Maintaining consistency between Microsoft Entra ID and SMARTFENSE
Import Process
During each synchronization, the platform follows the following flow for each user received from Microsoft Entra ID:
- The user's Object ID is queried
- It is checked if a user exists in SMARTFENSE with that Object ID
- If it exists → that user is updated
- If it does not exist, the email is queried
- If it exists → that user is updated
- If it does not exist, the username is determined according to the user import configuration
to check how the user's username should be set.- Mail Nickname
- First part of the UPN (User Principal Name) up to the at symbol
- Full UPN (User Principal Name)
- It is checked if a user already exists with that username
- If it exists → that user is updated
- If no match is found → a new user is created
User Editing
Object ID
When a user is identified by email or username:
- Their Object ID is assigned in SMARTFENSE
- In future synchronizations, they will be identified by this value
This ensures a unique correspondence with Microsoft Entra ID.
Clearing the Object ID from the instance
An administrator can manually reset the Object ID assigned to a user from Users and Groups > Users > Edit User, using the Clear button located next to the Microsoft Entra ID Object ID field.
Steps:
- Go to Users and Groups > Users.
- Search for and select the user.
- On the Edit User screen, locate the Microsoft Entra ID Object ID field.
- Click Clear.
- Save the changes.
The Clear button only removes the value stored in SMARTFENSE. It does not modify or delete the user's Object ID in Microsoft Entra ID.
After clearing this value, the next synchronization will not find the user by Object ID and will re-run the import process described above: first by email, then by username. Once identified by either of these two criteria, a new Object ID will be assigned automatically.
Use this option when a user needs to be re-matched by email or username, for example if they were recreated in Microsoft Entra ID with a different Object ID from the one registered in SMARTFENSE.
Users synchronized from Google Workspace have an equivalent field, Google ID, with its own Clear button on the same Edit User screen.
Username
The username is defined according to the selected configuration:
- Mail Nickname
- First part of the UPN (User Principal Name) up to the @ symbol
- Full UPN
In each synchronization:
- It is validated whether the username matches the current configuration
- If it does not match, an attempt is made to update it
Username Conflicts
Some configurations can generate duplicate names, especially:
- Mail Nickname
- First part of the UPN
This can cause:
- The new username is already in use by another user
- In that case:
- The user's data is updated
- But the username is not modified
First and Last Name
Name data is obtained from Microsoft Entra ID:
- First Name: givenName
- Last Name: surname
If these fields are empty:
- The display_name field is used to complete the information
Considerations
- The Object ID is the main identifier in subsequent synchronizations
- Email and username are used as fallback mechanisms
- Username configuration impacts data consistency
- Some attributes in Microsoft Entra ID may not be unique
💡 Best Practices
- Use username configurations that guarantee uniqueness (e.g., full UPN)
- Verify that the givenName and surname fields are properly completed
- Avoid configurations that may generate duplicates
- Validate the structure before performing mass synchronizations
- Before clearing a user's Object ID, verify that their email and username exactly match the directory's, to avoid creating a duplicate user.