How to Import Users and Groups from Microsoft Entra ID

This article describes the complete process for configuring the import and synchronization of users and groups from Microsoft Entra ID into SMARTFENSE, including application registration in Azure, permissions configuration, and user and group filtering options.

The configuration is available at Usuarios y grupos > Importación y sincronización > Desde Microsoft Entra ID.

Prerequisites

• An account with permissions to register applications in Microsoft Entra ID and grant admin consent.
• Administrator access to the SMARTFENSE instance.

Data required for SMARTFENSE

To configure the connection, you will need to enter the following data in SMARTFENSE:

• Dominio
• Id. de aplicación
• Clave secreta de aplicación

Step 1 — Register the application in Microsoft Entra ID

1. Sign in at https://portal.azure.com/.
2. Select Microsoft Entra ID from the left menu.
3. Go to Manage > Custom domain names.
4. Copy the domain name and paste it into SMARTFENSE in the Dominio field.

If your organization has more than one domain within the same Microsoft Entra ID tenant and all of them should belong to the platform, enter the root domain — the one ending in onmicrosoft.com. For example: mycompany.onmicrosoft.com.

5. Go to Manage > App registrations.
6. Click New registration.
7. Enter SMARTFENSE in the Name field.
8. Select Accounts in this organizational directory only (Single tenant).
9. Under Redirect URI (optional), select Web as the platform and enter https://www.smartfense.com.
10. Click Register.
11. Copy the value of the Application (client) ID field and paste it into SMARTFENSE in the Id. de aplicación field.

Step 2 — Configure the reply redirect URI

1. From the Overview menu of the newly created application, select Reply redirect URIs.
2. Add https://*.takesecurity.com/complete/azuread-oauth2/ as a new reply URL, replacing * with your instance's subdomain.

To get the exact value, go to SMARTFENSE at Usuarios y grupos > Importación y sincronización > Desde Microsoft Entra ID, click Guardar, and check the Instructivo de configuración available at the bottom of the page.

3. Click Save.

Step 3 — Grant API permissions

1. In the left menu, select API permissions.
2. Click + Add a permission.
3. Select Microsoft Graph.
4. Configure the following permissions:

Delegated permissions:

• Directory.Read.All
• User.Read
• User.Read.All
• User.Read.Basic.All

Application permissions:

• Directory.Read.All

5. Click Add permissions.
6. Click Grant admin consent and confirm by clicking Yes.

All permissions should show a green indicator confirming consent was granted. If any do not, repeat the grant consent step.

Step 4 — Generate the client secret

1. In the left menu, select Certificates & secrets.
2. Click + New client secret.
3. Enter SMARTFENSE in the Description field.
4. Under Expires, select the longest available period (for example, 730 days / 24 months).
5. Click Add.
6. Copy the generated Value and paste it into SMARTFENSE in the Clave secreta de aplicación field.

The secret value is shown only once. If you close this screen without copying it, you will need to generate a new secret.

When the expiration date is reached, the connection will stop working. You will need to create a new key and verify the connection again. For ongoing campaigns that require user authentication, users will not be able to log in until the process is complete.

Step 5 — Test the connection

1. In SMARTFENSE, click Comprobar conexión.

Ad-blocking extensions (such as Ad-Block Plus) often interfere with this test. It is recommended to disable them before testing the connection.

Periodic synchronization

Once the configuration is saved, you can enable the option Sincronizar periódicamente todos los días a la 01:00 AM (hora local). When active, SMARTFENSE will run the import automatically every day at that time, with no manual intervention required.

For status changes and deletions in the directory to be reflected daily and automatically, this option must be enabled.

User identification logic

During each synchronization, SMARTFENSE follows this order to determine whether a directory user already exists in the platform:

1. Searches by Object ID (the unique identifier assigned by Microsoft Entra ID).
2. If no match is found, searches by email.
3. If still no match, searches by username based on the configured setting.
4. If no match is found, a new user is created.

Once a user is identified by email or username, their Object ID is assigned in SMARTFENSE. In future synchronizations, they will be identified directly by that value.

It is recommended to use Full UPN as the username creation criterion, as it guarantees uniqueness and reduces the risk of conflicts between users.

User configuration

Once the connection is established, configure the import criteria.

Users to import

• Import all users from the directory: imports all users available in the tenant.
• Import only users belonging to specific groups: enter the group names exactly as they appear in Entra ID, separated by commas with no spaces and without quotes. Example: Group1,Group 2,Group_3.

This option is compatible with all Microsoft Entra ID group types: Security, Distribution, and Microsoft 365.

Loading the groups that users belong to does not create those groups in SMARTFENSE. It only determines which users are imported.

Users to exclude

• Do not exclude: imports all users matching the previous criteria.
• Exclude: select the fields to evaluate. Only users who have a value defined in all selected fields will be imported. Example: if you select Employee ID and Language, only users with both fields completed in the directory will be imported.

Users without email

• Do not import users without an email defined in Microsoft Entra ID (default behavior).
• Import users without an email defined in Microsoft Entra ID.

Create usernames from

Choose one of the following options:

• Mail nickname
• Mail
• First part of the UPN up to the @ symbol
• Full UPN

User status

• Use the status defined in SMARTFENSE: new users are imported as active. Previously imported users keep the status they have in the platform, regardless of their status in Entra ID.
• Reflect Microsoft Entra ID user status in SMARTFENSE: each user's status is determined by the accountEnabled attribute in Entra ID.

Users deleted in Entra ID

Defines what SMARTFENSE does when a previously imported user is deleted in Entra ID:

• Keep unchanged in SMARTFENSE: the user remains as-is in the platform.
• Deactivate in SMARTFENSE: the user is automatically deactivated.

Only users deleted in Microsoft Entra ID within the last 30 days will be deactivated in SMARTFENSE.

For more autonomous synchronization, it is recommended to combine Reflect Microsoft Entra ID user status in SMARTFENSE with Deactivate in SMARTFENSE. This way, status changes and deletions in the directory are automatically reflected in the platform without manual intervention.

Default language

Applies only to users who do not have a language defined in Microsoft Entra ID.

User manager

SMARTFENSE imports the immediate superior manager based on the manager property in Active Directory. For the assignment to take effect, the manager must also be an active user in SMARTFENSE.

Group configuration

In this section, specify how you want SMARTFENSE to import the groups that users belong to in Microsoft Entra ID, and which directory fields correspond to Functional Areas and Hierarchical Levels.

Groups to import

You can choose between:

• Import Microsoft Entra ID groups for each user: when this option is selected, you must choose a filtering criterion:
  • Import all groups whose names begin with the specified string: enter a text string and all groups whose names start with that value will be imported. For example, entering Management will import groups such as Management Sales, Management IT, etc.
  • Import only groups whose names exactly match the specified string: enter the group name exactly as it appears in Microsoft Entra ID.
• Do not import Microsoft Entra ID groups for each user.

The group filter allows importing only those groups relevant to the awareness program. This setting does not affect which users are imported; it only determines which directory groups will be created as groups in SMARTFENSE. To manage user import, refer to the User configuration section.

Functional Areas

Specify the Microsoft Entra ID Field where the user's Functional Areas are represented. Only one field can be selected. If that field contains more than one value for the same user (for example, Marketing|Sales), specify the Separator character used to distinguish them.

The available fields are string-type properties associated with the end user. Some examples: city, companyName, country, department, displayName, employeeType, among others.

Hierarchical Levels

Specify the Microsoft Entra ID Field where the user's Hierarchical Levels are represented. Only one field can be selected. If that field contains more than one value for the same user, specify the Separator character used to distinguish them.

As with Functional Areas, the available fields are string-type properties of the user in the directory.

Fields synchronized from Microsoft Entra ID

SMARTFENSE reads the following attributes from the directory during each synchronization:

For more information about these attributes, refer to the official Microsoft documentation: https://docs.microsoft.com/es-es/azure/active-directory-b2c/user-profile-attributes.

Fields used for Functional Areas and Hierarchical Levels must be string-type properties associated with the end user in Microsoft Entra ID. Relationship-type properties (objects) are not supported.

Language synchronization from Microsoft Entra ID

The field synchronized by default for all users is preferredLanguage.

If you need to set the same language for all users in the directory, the Entra ID administrator can run the following command from PowerShell:

Get-ADUser -Filter * -Properties mail, PreferredLanguage |
  Where-Object { ($_.mail -ne $Null) -and ($_.PreferredLanguage -ne "es-AR") } |
  ForEach-Object { Set-ADUser $_.SAMAccountName -Replace @{PreferredLanguage="es-AR"} }

This example sets the value es-AR in the PreferredLanguage field for all users with an email address defined and whose current language is not es-AR.

For more details, refer to the official Microsoft documentation: https://learn.microsoft.com/es-es/microsoft-365/troubleshoot/access-management/set-language-and-region.

💡 Best practices

• Document the client secret expiration date and set a reminder in advance to avoid service interruptions.
• If the tenant has more than one domain, always enter the root domain (onmicrosoft.com) in the Dominio field to avoid connection errors.
• Disable ad-blocking extensions before clicking Comprobar conexión.
• Use the Users to import group filter when only a subset of the directory participates in the awareness program.
• Configure the Groups to import filter if you need directory groups to also be created as groups in SMARTFENSE; groups are not created automatically just because they are associated with imported users.
• Test the import with a small subset of users before enabling full periodic synchronization.