Microsoft Entra ID integration (formerly Azure Active Directory)

To set up the integration, it is required to have a valid Microsoft Entra Tenant ID, Client ID and Client Secret for the application.

Required permissions

An easy automated setup is default. Manual client setup can be toggled on to set up your own client that exists in the customer’s “App registrations” in Microsoft Entra ID.

The setup inherits the application from Telia and is controlled and renewed by Telia, meaning no need to update secrets and handle timeout issues.

Enter your Tenant ID. Upon saving, you will be redirected to a Microsoft login where you need to pick an admin account for the tenant. After login, consent to the permissions requested by the “Telia Smart Connect – Entra ID User Sync” application.

Accepting the permissions will create an application in the your Entra ID “Enterprise applications“. If you are not able to consent on behalf of the organization, you might need to enter the “Permissions” for the application, and choose “Grant permission for…”

1. In Microsoft Entra ID, click on “App registrations”.

2. Click on “New registration”.

3. Enter any name for the application for example “Telia Entra ID Synchronization” and click on “Register”.

4. The application will be created and generate the Application (client) ID. The same view will display your Directory (tenant) ID. Both the Client ID and Tenant ID need to be entered into the Entra ID integration configuration page in the Telia Admin Portal.

5. Open “Certificates & secrets” in the application view in the Entra Admin portal and click on “New client secret”.

6. Give the secret a name and select an expiration time. After the secret expires, a new one needs to be generated and updated in the configuration for the Entra ID integration in the Telia Admin Portal.

7. Copy the client secret and paste it in the Entra ID integration configuration page in the Telia Admin Portal.

8. Open “API permissions” in the application view in the Entra admin portal and click on “Add a permission”.

9. Click on “Microsoft Graph”.

10. Click on “Application permissions”.

11. Select “User.Read.All” and click on “Add permissions” to add the permission.

12. Click on “Grand admin consent for <Company Name>”.

13. Confirm the permission in the popup.

Limited users are users in Microsoft Entra ID without corresponding users in the solution.

To add limited users:
Menu → Integrations → Entra ID tab → Setup → Choose Entra ID Integration → Limited Users.

When adding limited users, you can choose to add all users from Entra ID at once, or filter them according to Entra ID Sync advanced query capabilities.

When adding limited users, you can choose to add all users from Entra ID at once, or filter them according to Entra ID Sync advanced query capabilities. When you have filtered (or not) and are ready to sync limited users, click on the save button and a pop-up will show and let you confirm how many limited users that will be added.

We are not allowed to give Application permissions, can we use Delegated permissions?
No.

What if I use the same number on multiple users in Entra ID?
You will get an option in the “Users”-tab on which user you want to synchronize.

Can I change which user that is mapped with a specific number?
It depends, the users number in the solution needs to be mapped with a number in Entra ID. If multiple users have the same number in Entra ID, you will get an option to select which users you want to synchronize the data from.

Can I synchronise profile pictures?
No, not at the moment.

Can I have multiple Microsoft Tenants synchronised to the same Telia solution?
Yes.

Can I have the same Microsoft Tenant synchronised to multiple Telia solutions?
Yes.

How often is the data updated?
Once every 12 hours, the timer is based on the last sync. It’s possible to see the last synced time in the “Users”-tab in the Entra ID settings in Telia’s admin portal. It is possible to sync a single user manually in the user list.

Can I manually trigger an update of the user mapping?
Yes, do a change in the Entra ID configuration in Telia admin portal like the TenantId or ClientId, change back to a valid value and save. This will trigger an instant update of the integration. It’s also possible to manually synchronize single users from the “Users”-tab in the Entra ID settings in Telia’s admin portal.

The status icon for the integration is OK (green checkmark), but number of users is still 0?
The unique identifier is the mobilePhone or businessPhones fields from Entra ID. If you don’t have any data in those fields for any users, no user will by synchronized.

It might be due to missing permissions. Verify that the application in Entra ID got the correct permissions for User.ReadBasic.All (Application) and that you have granted admin consent.

After I save the configuration in Telia Switchboard the status is red with an error code?
The error message is returned from Entra ID, you can lookup the error code here: https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes

I created a valid synchronisation and I see users in the Entra ID users list. But no new data is displayed in the switchboard?
The user details data is cached. You need to reload the switchboard for the updated data to be visible.

All our users have two phone numbers, where when is the company number, how to map up the correct user?
You will have to manually select which user to map with which number.

Can I synchronize users that doesn’t exist in Telia’s solution (passive users)?
No, not at the moment.

Which Graph API endpoint is used by the integration?
https://graph.microsoft.com/v1.0/users
With a filter for enabled accounts and a number in the mobile phone or business phone field.

Which fields can I use to map and synchronize?
All fields described in Microsoft’s documentation here.

Is it possible to filter which users that are synchronised from Entra ID?
No, not at the moment. You are able to toggle if you want to disable the synchronization for a specific user.

The configurator complains about invalid client secret with error code 7000215?
If you just created the secret, wait a minute and try again by adding the secret again and save the settings. If that doesn’t help, verify that you did copy and paste the secret correct.

Can I disable the synchronization for a specific user?
Yes, from the “users”-tab in the integration configuration in Telias Admin portal.

I have a user that I don’t want to synchronize?
The service will fetch users and user data, and update the data right after the configuration is completed. After you created a new integration, but before you set it up, you are able to open the users-tab and disable the synchronization for single users.

Will the synchronization overwrite existing data in Entra ID?
No, the synchronization is one way only, data will be fetched from Entra ID and populate the fields in Telias Switchboard solution.

Will the synchronization overwrite existing data in Telias Switchboard solution?
As long as you mapped a value to a field in the Entra ID synchronization setup, it will overwrite existing data with data fetched from Entra ID. For example, if you have added tags to users in Telias Switchboard solution and you haven’t set up any field for mapping of tags in the Entra ID synchronization service, the tags will not be overwritten. But if you have set up for example postalCode to be mapped to the tags field, all tags will be overwritten with whatever data you have in the postalCode attribute in Entra ID. Users without any value in postalCode in Entra ID will be left without tags in Telias Switchboard solution.

Is the attribute mapping case sensitive?
Yes, so givenName will work, but not givenname, Givenname or GIVENNAME.

My custom attribute mapping isn’t working?
Each attribute needs to be unique. For example, you can’t use givenName on multiple attributes.

Some of the data from Entra ID won’t synchronize to Telias Switchboard solution?
Anything within a less than sign (<) and a greater than sign (>) will be excluded from the synchronization.

I have 100 users in the solution, but the counter states that only 70/70 is synchronized?
Only users with a valid entity in Entra ID that is mapped to a number in the switchboard solution will be counted.

Some of the users is displayed without GUID, last sync, status and sync now-buttons?
Users without a match in Entra ID but exist in the switchboard solution will be displayed like that.

I have a user in Entra ID and Telias switchboard solution, but the information isn’t updated?
Verify that the user have the correct phone number in Entra ID and try to run the synchronization again.