> For the complete documentation index, see [llms.txt](https://incident-tracker.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://incident-tracker.gitbook.io/docs/admin-guide/application-information/authentication-settings/account-provisioning/microsoft-graph.md).

# Microsoft Graph

### Configuring Microsoft Graph for Account Sync

{% hint style="warning" %}
SSO with SAML must be configured before setting up Microsoft Graph for Account Sync.
{% endhint %}

{% hint style="info" %}
When you configured SSO, Azure/Entra ID automatically created an **App Registration** for your Enterprise Application. You do not need to create a new App Registration — you'll use that existing one for Microsoft Graph steps below.
{% endhint %}

**Step-by-Step Setup**

1. In the Authentication Settings, check **Microsoft Graph for Account/Sync** and click **Save Settings**.
2. Log in to the Azure Portal and go to **App Registrations**.
3. Find the App Registration that was automatically created when you set up your SSO Enterprise Application. If it doesn't appear in the list, check the **All applications** tab rather than **Owned applications**.
4. Copy the **Application (client) ID** and **Directory (tenant) ID**, and paste them into the respective fields in Incident Tracker.
5. Navigate to **Certificates & Secrets** and create a new **Client Secret**.
6. Copy the Secret Value and paste it into the **Incident Tracker app secret** field.
7. Configure API Permissions:
   * Go to **API Permissions > Add a Permission > Microsoft Graph**.
   * Select **Application Permissions** and add:
     * `Group.Read.All`
     * `User.Read.All`
   * Click **Grant Admin Consent** if prompted.
8. Click **Test** in Incident Tracker to confirm the connection.

### ▶️ Interactive Tutorial – Configuring Microsoft Graph

{% @arcade/embed flowId="iHvgVYvs2owC3UZMxnsM" url="<https://app.arcade.software/share/iHvgVYvs2owC3UZMxnsM>" %}

***

## Managing Users by Group with Graph Sync

#### Step-by-Step Group Sync

1. Navigate to **Manage User Groups** under **User Information**.
2. In the text field, type the group name (e.g., "All Users").
3. Click **Add** to create the group.
4. Click **click to configure sync settings** next to the new group.
5. In the sync settings, search for the remote group (e.g., "All Users") and link it.
6. Click **View Members** to preview the users in the remote group.
7. To finalize, click **Link to this Group**.
8. Use **Manual Sync** if needed to pull in users immediately.

### ▶️ Interactive Tutorial – Most Common Graph Sync Setup

{% @arcade/embed flowId="SrM25YHt2fO5i8OLuaao" url="<https://app.arcade.software/share/SrM25YHt2fO5i8OLuaao>" %}

<details>

<summary>Graph Sync Rules Explained</summary>

## Microsoft Graph Sync Settings

Incident Tracker supports automated and manual user synchronization from Microsoft Graph (Azure Active Directory). Sync behavior is controlled through a combination of **Global Settings** and **User Group-specific Settings**.

***

### 🔄 Global Sync Settings

These apply to all users unless overridden by a specific user group.

#### 🔁 Sync Frequency

* Options: `Daily`, `Weekly`, `Monthly`, `No automatic sync`
* If no group-level sync frequency is defined, the global frequency is used.

#### 🧾 User Updates

* ☑ **Update all accounts linked to Microsoft Graph**\
  If enabled, the following fields are always updated (even if not in a group):
  * Login
  * Email
  * First Name
  * Last Name
  * Enabled
  * Manager

#### 👤 Account Creation

* ☑ **Only create new accounts if they are enabled in Microsoft**

#### ✉️ New Account Notification

* ☑ **Send email to new users with login instructions**
  * Send options: `Only if enabled` | `Always`

#### 🔥 Global Orphan Handling

These options apply if a user:

1. Exists in Incident Tracker but **not in Microsoft**
2. Exists in Microsoft but **is not in any linked security group**

For both cases, select one:

* `Do nothing`
* `Remove from group`
* `Remove and disable`
* `Remove, disable, and delete`

#### 🚨 Global Override Settings

* ☑ **Disable/Delete all linked users who are disabled in Microsoft**
* ☑ **Disable/Delete all linked users who no longer exist in Microsoft**
  * Each setting allows choice between `Disable` or `Delete`

***

### 🧩 User Group Sync Settings

Each user group can be configured with its own sync rules. These **override** global settings when present.

#### 🔗 Linked Microsoft Groups

* One or more Microsoft security groups can be mapped to a single Incident Tracker user group.
* If a user belongs to multiple linked MS groups, **only the highest priority IT group** is used.

#### 📅 Group-Level Sync Frequency

* Overrides the global frequency
* Options: `Daily`, `Weekly`, `Monthly`, `No automatic sync`

#### ➕ New-Only Sync Mode

* ☑ **Only sync new accounts**
  * Skips updates for existing users (name, email, etc.)

#### 🧹 Group-Level Orphan Handling

For users in the group who no longer qualify:

**A. No longer exists in Microsoft**

* `Do nothing`
* `Remove from group`
* `Remove and disable`
* `Remove, disable, and delete`

**B. Still exists in Microsoft, but not in a linked security group**

* `Do nothing`
* `Remove from group`
* `Remove and disable`
* `Remove, disable, and delete`

***

### 🧠 Priority-Based Group Assignment

Incident Tracker groups are processed **bottom to top** in the group list (lowest to highest priority). A user can only be assigned to **one group**.

| Priority | Microsoft Group    | Incident Tracker Group |
| -------- | ------------------ | ---------------------- |
| High     | `Security_Admins`  | Admins                 |
| Medium   | `Security_Leads`   | Supervisors            |
| Low      | `Security_General` | Staff                  |

* A user in multiple groups will be promoted to the **highest linked group**.
* If a user is removed from a high-priority group, the system will evaluate if they still qualify for a lower-priority group.

***

</details>