Skip to main content

Import Logic from Microsoft Entra ID (Azure AD)

  • Updated

User import from Microsoft Entra ID is based on a progressive identification process that uses the Object ID, email, and username to determine whether a user should be created or updated on the platform.

User Identification

Microsoft Entra ID assigns each user a unique identifier called Object ID.

This identifier allows:

  • Uniquely identifying each user
  • Maintaining consistency between Microsoft Entra ID and SMARTFENSE

Import Process

During each synchronization, the platform follows the following flow for each user received from Microsoft Entra ID:

  1. The user's Object ID is queried
  2. It is checked if a user exists in SMARTFENSE with that Object ID
    • If it exists → that user is updated
  3. If it does not exist, the email is queried
    • If it exists → that user is updated
  4. If it does not exist, the username is determined according to the user import configuration
    to check how the user's username should be set.
    • Mail Nickname
    • Mail
    • First part of the UPN (User Principal Name) up to the at symbol
    • Full UPN (User Principal Name)
  5. It is checked if a user already exists with that username
    • If it exists → that user is updated
  6. If no match is found → a new user is created

User Editing

Object ID

When a user is identified by email or username:

  • Their Object ID is assigned in SMARTFENSE
  • In future synchronizations, they will be identified by this value

This ensures a unique correspondence with Microsoft Entra ID.

Username

The username is defined according to the selected configuration:

  • Mail Nickname
  • Mail
  • First part of the UPN (User Principal Name) up to the @ symbol
  • Full UPN

In each synchronization:

  • It is validated whether the username matches the current configuration
  • If it does not match, an attempt is made to update it

Username Conflicts

Some configurations can generate duplicate names, especially:

  • Mail Nickname
  • First part of the UPN

This can cause:

  • The new username is already in use by another user
  • In that case:
    • The user's data is updated
    • But the username is not modified

First and Last Name

Name data is obtained from Microsoft Entra ID:

  • First Name: givenName
  • Last Name: surname

If these fields are empty:

  • The display_name field is used to complete the information

Considerations

  • The Object ID is the main identifier in subsequent synchronizations
  • Email and username are used as fallback mechanisms
  • Username configuration impacts data consistency
  • Some attributes in Microsoft Entra ID may not be unique

💡 Best Practices

  • Use username configurations that guarantee uniqueness (e.g., full UPN)
  • Verify that the givenName and surname fields are properly completed
  • Avoid configurations that may generate duplicates
  • Validate the structure before performing mass synchronizations

Related to

Related articles