Syncro’s Microsoft integration helps you streamline your operations while providing better service to the organizations you support. 

The benefits include:

• Linking devices associated with Microsoft Entra accounts directly to Syncro assets, to ensure there's always an assigned End User.
• Quickly finding clients with low Microsoft Secure Scores or those who don’t have MFA turned on, to improve security.
• Lowering your client's bills by finding unused Microsoft licenses, and automating client billing based on Microsoft license types.
• A foundation for future actions initiated in Syncro to be applied to Microsoft via Microsoft Graph APIs.

This document describes how to integrate Syncro with Microsoft. In case it should be necessary, it also describes how remove the integration.

Prerequisites

• The Syncro-Microsoft integration requires you to be on Syncro's Team Plan and be an Administrator in the Syncro account.
• Syncro's integration supports all Microsoft 365 license types.
  • Depending on your Microsoft license, you may receive an error that a required service principal is missing. To resolve the issue, look up the missing application ID, then use it to add the missing service principle using PowerShell:
    >Install-Module -Name AzureAD
    >Connect-AzureAD
    >New-AzureAdServicePrincipal -AppId “Missing AppId Here”
    For example, if you discover WindowsDefenderATP is missing, use the command: 
    New-AzureAdServicePrincipal -AppId “fc780465-2017-40d4-a0c5-307022471b92”
• You can integrate with a single Microsoft Tenant or all Microsoft Tenants from your Cloud Solution Provider (CSP). 
  • IMPORTANT: If you have a CSP, please review the Important Information for CSP Microsoft Integrations before proceeding.

Enable the Integration

To integrate Syncro with Microsoft, follow these steps:

1. Navigate to Admin > RMM Settings - Microsoft Tenant Management. Syncro displays the Microsoft Tenant Management Page.
2. Click the Integrate with Microsoft button, then select either “Single Tenant” or “Cloud Solution Provider.” 
3. If you choose “Cloud Solution Provider,” be sure you've met the Prerequisites, then click Integrate Cloud Solution Provider. 
   • Log into your CSP Microsoft 365 Tenant using an appropriately privileged Global Admin account. 
     Notes: 
     • If you want a Single Tenant integration, you'll need to create Global Admin accounts on the individual Microsoft 365 Tenants you want to integrate. (These must be different from your CSP Microsoft 365 Tenant credentials.) 
     • If you use Microsoft SSO to log into Syncro, ensure your login has the appropriate privileges (see Prerequisites).
   • Click Accept for the required permissions. 
4. If you choose “Single Tenant” log into the desired Microsoft 365 account as a Global Admin, then click Accept for the required permissions. 

When the integration is complete, Syncro redisplays the Microsoft Tenant Management Page with your Microsoft Tenant(s) listed in the first column of the table, “Success” in the Sync Status column, and a Last Synced date/timestamp:

Tips: 

• Initially this process might take a little time; you can click Refresh to refresh the page and check on it.
• The only data Syncro pulls from the initial integration is the Microsoft 365 Tenant Name. All additional data requires the Microsoft 365 Tenant to be mapped. 

Next, you should Map Your Syncro Tenants.

About the Microsoft Tenant Management Page

The Tenant Management page/table displays when you navigate to Admin > RMM Settings - Microsoft Tenant Management. Initially the page is blank; the table only displays after you create an integration with a Microsoft Tenant:

The Integrate Microsoft button provides you with two ways to enable the integration: Single Tenant or Cloud Solution Provider. The Refresh button updates the table for any new Sync Statuses that might be available.

This table contains the following information about each of your existing Microsoft Tenants:

• Microsoft Tenant: The name of the Microsoft Tenant.
• CSP Auth: If you integrated with a CSP, this column shows the status the authentication process used by the Cloud Solution Provider (CSP) to access and manage Microsoft services. These may be:
  • Active (green): The CSP Admin Relationship appears to be configured correctly and isn't set to expire for at least the next 7 days. 
  • Expiring (orange/yellow): The CSP Admin Relationship appears to have at least one required role that is set to expire within the next 7 days. The GDAP relationships should be updated as soon as possible. 
  • Expired (red): The CSP Admin Relationship has at least one required role that has expired. The GDAP relationships need to be updated to resume syncing.
  • Missing Admin Relationship: No active CSP Admin Relationship exists for the Microsoft Tenant.
  • Missing Roles (red): The CSP account doesn't have all the GDAP roles we require for the Microsoft Tenant, or is not a Global Admin. Please review Important Information for CSPs. 
  • Missing Security Group: The CSP Admin Relationship does not have a valid security group assigned to it. Either the security group is missing, does not have the proper roles assigned to it, or the service account user is not in the security group.
  • Consent Failure: The CSP Admin Relationship is in an Active state and we've tried consenting but received an error from Microsoft. We will try again shortly.
  • Consent Pending (orange): Typically means Syncro is waiting for Microsoft to process the request. If the CSP Auth remains in a Consent Pending status after 10-15 minutes, there's likely a problem.
  • Unknown (orange/yellow): There is no status information available. It most likely means there's a consent failure, but can be for other unknown Microsoft errors as well.
• Syncro Tenant: The name of the Organization(s) that's mapped to the Microsoft Tenant. Click this link to navigate to the Syncro Tenant's Details Page.
• Sync Status: The status of the sync between the Microsoft Tenant and the Syncro Tenant. These may be:
  • Success (green): The sync between Microsoft and Syncro Tenants was successful.
  • Pending (orange): Syncro is waiting for Microsoft to process the request, or there's something preventing the sync from happening. The CSP Auth column can help you determine whether there's a known issue preventing syncs.
  • Auth Failed (red): May be any type of failure encountered while making requests for the tenant, including an authentication failure.
• Last Synced: The date/timestamp of the last sync attempt between Syncro and Microsoft Tenants, which happens daily.

 The options available under the vertical ellipsis ()  change based on various conditions, as follows:

Remove the Integration

If you no longer want to link your Syncro and Microsoft accounts, or if you want to reset the Syncro-Microsoft connection to start fresh, you can.

IMPORTANT: When you remove the Syncro-Microsoft integration, you'll:

• Completely disconnect your Microsoft account(s) from Syncro,
• Remove all Microsoft Tenants and the mapping between Microsoft and Syncro Tenants,
• Remove the Syncro application from Microsoft and associated Microsoft data from Syncro,
• Prevent Syncro from syncing data with Microsoft moving forward. (For example, your End Users will remain in Syncro but will no longer be updated if/when updates are made in Microsoft.) 

However, removing this integration will NOT delete any data from your Microsoft accounts.

To remove the Syncro-Microsoft integration, follow these steps:

1. Navigate to Admin > RMM Settings - Microsoft Tenant Management.
   Tip: The last line on the screen indicates how many Tenants you'll be removing from your Syncro account.
2. Click Remove Integration. The Microsoft Tenant Management page redisplays and lets you know that no Microsoft Tenants are yet integrated. 

Whenever you want, you can re-enable the integration, but you might need to wait a few minutes for Syncro to remove the prior integration.