Integrate with Microsoft
Table of Contents
Syncro’s Microsoft integration helps you streamline your operations while providing better service to the organizations you support. The benefits include:
- Linking devices associated with Microsoft Entra accounts directly to Syncro assets, to ensure there's always an assigned End User.
- Quickly finding clients with low Microsoft Secure Scores or those who don't have MFA turned on, to improve security.
- Lowering your client's bills by finding unused Microsoft licenses, and automating client billing based on Microsoft license types.
- Building a foundation for future actions initiated in Syncro to be applied to Microsoft via Microsoft Graph APIs.
- Identifying security gaps and receiving notifications about configuration drift.
This document describes how to integrate Syncro with Microsoft. In case it should be necessary, it also describes how remove the integration.
Prerequisites
- The Syncro-Microsoft integration requires you to be on Syncro's Team Plan and be an Administrator in the Syncro account.
- Syncro's integration supports all Microsoft 365 license types.
- You can integrate with a single Microsoft Tenant or all Microsoft Tenants from your Cloud Solution Provider (CSP).
IMPORTANT: If you have a CSP, please review the Important Information for CSP Microsoft Integrations before proceeding.
Enable the Integration
Navigate to Admin > RMM Settings - Microsoft Tenant Integrations. Syncro displays the Microsoft Tenant Integrations Page, which is initially blank:
Click the Integrate button, then select either “Single Tenant” or “Cloud Solution Provider (CSP) Tenants.”
Single Tenant Integration
- Log into the desired Microsoft 365 account as a Global Admin.
- Click Accept for the required permissions.
CSP Integration
- Be sure you've met the Prerequisites, which are shown in a pop-up window.
- Check the box, then click Continue.
- Log into your CSP Microsoft 365 Tenant using an appropriately privileged Global Admin account.
Note: If you want a Single Tenant integration, you'll need to create Global Admin accounts on the individual Microsoft 365 Tenants you want to integrate. (These must be different from your CSP Microsoft 365 Tenant credentials.) - Click Accept for the required permissions.
When the integration is complete, Syncro redisplays the Microsoft Tenant Integrations Page with your integrated Tenant and/or indicators of integration issues. What appears on the page depends on whether you integrated a Single Tenant or Cloud Solution Provider (CSP).
Note: The only data Syncro pulls from the initial integration is the Microsoft 365 Tenant Name. All additional data requires the Microsoft 365 Tenant to be mapped.
Use the Microsoft Tenant Integrations Page
The Microsoft Tenant Integrations page/table displays when you navigate to Admin > RMM Settings - Microsoft Tenant Integrations. Initially the page is blank; information only displays after you integrate with a Microsoft Tenant.
Single Tenant Integration
If you integrated with a Single Tenant, the Microsoft Tenant Integrations page displays that Tenant's name in the first column of the table. The Syncro Tenant column will initially be blank. Ideally “Success” shows in the Sync Status column to indicate a successful sync, and a Last Sync date/timestamp is available:
If the Sync Status shows something other than “Success,” here's what those statuses mean:
- Pending (orange): Syncro is waiting for Microsoft to process the request, or there's something preventing the sync from happening.
- Auth Error (red): May be any type of error encountered while making requests for the tenant, including an authentication failure.
Note: Since this is a Single Tenant integration, it is expected that the CSP Name and CSP Auth columns show a dash (-).
See also: Troubleshooting Microsoft Integrations.
CSP Integration
If you integrated with a CSP, the Microsoft Tenant Integrations page displays that Tenant in a row at the top of the page, above the table.
The row contains the name of the CSP Tenant, a label of “Cloud Solution Provider (CSP)” and if relevant, the number of tenants inside it (e.g., “with 6 tenants”); a Last Synced date/timestamp, and a Sync Status:
If the Sync Status shows something other than “Success,” here's what those statuses mean and what you can do:
- Auth Pending: Authorization may take several minutes. Once successful, the Tenants will appear in the table after a page refresh.
-
Auth Failed: This is an authorization failure message related to an issue with the CSP:
- Unknown: An unknown authentication occurred. You should select “Reauthorize CSP” from the ellipsis menu to try again.
- No MFA Prompt: The authenticating account was not prompted for Entra ID MFA. You should update the account to prompt for MFA on every sign in. Then select “Reauthorize CSP” from the ellipsis menu to try again.
- Not in the AdminAgents Group: The authenticating account is not a member of the AdminAgents group. Add the account to the AdminAgents group, then select “Reauthorize CSP” from the ellipsis menu to try again.
- No Child Tenants: The CSP Tenant has no customer relationships. Add customer relationships, then select “Reauthorize CSP” from the ellipsis menu to try again.
- (Auth) Error: This is an error message related to an issue with the CSP.
The table beneath this section displays like it does for a Single Tenant integration, but the CSP Name and CSP Auth columns are filled in. The CSP Auth column may also help you identify and resolve common errors with any individual tenants:
- CSP Name: Displays the name of the CSP this Microsoft Tenant belongs to.
-
CSP Auth: Shows the status of the authentication process used by the CSP to access and manage Microsoft services. These may be:
- Active (green): The CSP Admin Relationship appears to be configured correctly and isn't set to expire for at least the next 7 days.
- Consent Failure: The CSP Admin Relationship is in an Active state and we've tried consenting but received an error from Microsoft. We will try again shortly.
- Consent Pending (orange): Typically means Syncro is waiting for Microsoft to process the request. If the CSP Auth remains in a Consent Pending status after 10-15 minutes, there's likely a problem.
- Expired (red): The CSP Admin Relationship has at least one required role that has expired. The GDAP relationships need to be updated to resume syncing.
- Expiring (orange/yellow): The CSP Admin Relationship appears to have at least one required role that is set to expire within the next 7 days. The GDAP relationships should be updated as soon as possible.
- Granting Application Roles (orange/yellow): This status is part of the consent process, and the CSP Auth may be in this status for about 30 minutes.
- Missing Admin Relationship: No active CSP Admin Relationship exists for the Microsoft Tenant.
- Missing Roles (red): The CSP account doesn't have all the GDAP roles we require for the Microsoft Tenant, or does not have the Global Administrator role. Please review Important Information for CSP Microsoft Integrations.
- Missing Security Group: The CSP Admin Relationship does not have a valid security group assigned to it. Either the security group is missing, does not have the proper roles assigned to it, or the service account user is not in the security group.
- Unknown (orange/yellow): There is no status information available. It most likely means there's a consent failure, but can be for other unknown Microsoft errors as well.
See also: Troubleshooting Microsoft Integrations.
After any integration issues are resolved, you should Map Your Syncro Tenants. Once this is done, the Syncro Tenant column populates with a link to that Syncro Tenant's Details Page, and Microsoft Tenant sync attempts occur approximately every 30 minutes (unless there is an Auth Error).
Actions for Existing Integrations
Once your Tenants are integrated and mapped, you'll have access to a number of actions under the vertical ellipsis (
) menu. The actions change based on the integration type and whether or not a Syncro Tenant is already mapped. This works as follows:
| Condition | Syncro Tenant(s) Mapped | Available Option(s) |
|---|---|---|
|
Single Tenant integration
|
No |
Map Syncro Tenant: Creates an association between the Microsoft Tenant and an Organization, so you can then set up Entra ID User Sync or Baselines. Reauthorize: Allows you to provide different credentials to reauthorize the originally configured Microsoft tenant. Remove Integration: Disconnects your Microsoft account from Syncro, including all mappings and syncing between Microsoft and Syncro Tenants. No data is deleted from your Microsoft accounts. |
| Individual Tenants for a CSP integration | No | Map Syncro Tenant: Creates an association between the Microsoft Tenant and an Organization, so you can then set up Entra ID User Sync. |
| Single Tenant integration | Yes |
Unmap Syncro Tenant: Removes the association between the Microsoft and Syncro Tenants. For example, if you make a mistake. Reauthorize: Allows you to provide different credentials to reauthorize the originally configured Microsoft tenant. Remove Integration: Disconnects your Microsoft account from Syncro, including all mappings and syncing between Microsoft and Syncro Tenants. See also: What Happens When You Remove an Integration for more information. |
| Individual Tenants for a CSP integration | Yes | Unmap Syncro Tenant: Removes the association between the Microsoft and Syncro Tenants. For example, if you make a mistake. |
| Cloud Solution Provider (CSP) Tenant integration | No |
Reauthorize CSP: Allows you to reintegrate after resolving authentication errors using the same credentials, or to provide different credentials to reauthorize the originally configured Microsoft tenant. Remove CSP Integration: Disconnects your Microsoft account from Syncro, including all child tenants, their mappings, and syncing between Microsoft and Syncro Tenants. See also: What Happens When You Remove an Integration for more information. |
What Happens When You Remove the Integration
If you no longer want to link your Syncro and Microsoft accounts, or if you want to reset the Syncro-Microsoft connection to start fresh, you can. Simply select “Remove All Integrations” from the Integrate button menu:
IMPORTANT: When you remove the Syncro-Microsoft integration, you'll:
- Completely disconnect your Microsoft account(s) from Syncro,
- Remove all Microsoft Tenants and the mapping between Microsoft and Syncro Tenants,
- Remove the Syncro application from Microsoft and associated Microsoft data from Syncro,
- Prevent Syncro from syncing data with Microsoft moving forward. (For example, your End Users will remain in Syncro but will no longer be updated if/when updates are made in Microsoft.)
However, removing this integration will NOT delete any data from your Microsoft accounts.
Whenever you want, you can re-enable the integration, but you might need to wait a few minutes for Syncro to remove the prior integration.