Connect Microsoft 365 (Entra ID) to SuperIT

Connecting a team's Microsoft 365 tenant lets SuperIT sync the tenant's users and groups, add those users to the team, recognise them when they sign in on devices that run the SuperIT RMM agent, and read directory information through Microsoft Graph when it works on that team's tickets and chats. You connect it under Settings → Integrations → Identity provider.

A tenant Global Administrator is recommended to complete the consent, but SuperIT does not get Global Administrator rights. It gets the read-only application permissions listed in Permissions SuperIT requests. The Global Administrator only approves them.

For everything SuperIT can do once the tenant is connected, see What SuperIT can do in Microsoft 365. To make changes in Microsoft 365, such as password resets or offboarding, see Automate Microsoft 365 with workflows.

Before you begin

• You need the Admin role on the team. See Roles.
• You need someone who can sign in to that Microsoft 365 tenant with a Global Administrator account, so they can grant admin consent for the whole organisation. The app asks for this account: "Use an account with Global Administrator permissions in this team's Microsoft 365 tenant."

• Each team connects one Microsoft 365 tenant. Connect it on the team the tenant belongs to:

  • For an MSP, that is the customer's managed team, not your service provider team. Connect each customer's tenant on that customer's managed team.
  • For an internal IT team, it is your own team.

  See Team types.

Step 1: Start the connection

1. Switch to the team in the team switcher.
2. Go to Settings → Integrations → Identity provider. The page says "Connect your directory to sync users".
3. Select Connect Microsoft 365.

Step 2: Grant consent in Microsoft

1. Sign in with a Global Administrator account in that team's tenant.
2. Microsoft shows the permissions SuperIT requests. They are application permissions, so SuperIT reads the directory without a signed-in user. Review them before you accept.
3. Accept. Microsoft returns you to SuperIT, which checks that it can read the tenant's users before saving the connection. SuperIT then starts the first sync.

Microsoft sometimes shows an error page during consent even though the consent was recorded. SuperIT checks for the consent before it reports a failure. If the connection still isn't saved, select Connect Microsoft 365 again and repeat the consent.

Verify it worked

The connection card says "Microsoft 365 tenant connected to this team" and shows the Tenant ID, the number of Users, a status badge (Syncing, Synced, Sync Error, Canceled or Connected) and "Last synced …". When licence names have loaded, it shows "License information verified."

Permissions SuperIT requests

SuperIT's app registration requests application permissions in Microsoft Graph. With these permissions SuperIT can read the tenant but can't create, change or delete anything in it, and none of them is a directory role such as Global Administrator.

The consent screen in Microsoft shows the exact list SuperIT requests, so review it before you accept. It includes:

User and group sync needs only User.Read.All, Group.Read.All and LicenseAssignment.Read.All. The rest are used when SuperIT reads Microsoft Graph while it works on a ticket or chat.

These permissions belong to the connection only. Changes in Microsoft 365 use a separate, delegated Microsoft Graph credential that you create for workflow actions.

What syncs

SuperIT does not sync devices, sign-in activity, mailboxes, MFA methods or managers.

SuperIT syncs regularly, at least hourly. Group changes are picked up more often than user changes. It also syncs when you connect or reconnect. Select Sync Now to sync immediately, or Cancel to stop queued syncs; a sync that is already running finishes. Only one sync runs per tenant at a time.

Users who are removed in Microsoft 365 drop off the Add from MS365 list. Their SuperIT users and team memberships are kept.

To give people access to SuperIT, add them with Settings → User access → Add user → Add from MS365. See Add users from Microsoft 365 or your PSA.

Recognising users on their devices

When a user signs in on a device that runs the SuperIT RMM agent, the agent reports a session. With Microsoft 365 connected, SuperIT verifies the session automatically by matching the Windows sign-in to a synced Microsoft 365 account: by Entra object ID for Entra ID sign-ins, or by on-premises security identifier for domain accounts. A session is verified only when exactly one account matches. SuperIT checks sessions when devices report them and after every sync.

A verified session tells SuperIT which person is on which device, so it can find an end user's computer from their ticket or chat. Check it in the Session column under Settings → User access, or under Users & verification on a device's page. See Check each end user's ticket, identity and device links.

If a matched Microsoft 365 account has no SuperIT user yet, SuperIT creates one for it with the User role on the team. This user is inactive and has no password, so it can't sign in to SuperIT until you give it access. Automatic session verification is on for every Microsoft 365 connection, and there is no setting to turn it off.

What SuperIT can do with Microsoft Graph

When a team has a Microsoft 365 connection, engineers and admins can ask SuperIT about that tenant, and SuperIT can check it while it investigates the team's tickets. It can read user accounts and licences, groups and membership, mailbox settings and inbox rules, directory roles, Entra ID devices, SharePoint sites and service health. End users can't use it.

This access is read-only. Through the connection SuperIT cannot reset passwords, change users, groups or licences, or read email content, sign-in or audit logs, MFA methods, Defender alerts or Intune data.

To make changes, build workflow actions that use a delegated Microsoft Graph credential. See What SuperIT can do in Microsoft 365 for the full list.

Reconnect or remove the connection

• Reconnect opens the dialog Reconnect Microsoft 365. Select Continue to Microsoft to grant admin consent again. Use it when SuperIT starts asking for a new permission. A tenant administrator has to complete the consent, and a Global Administrator is recommended. Synced users, groups and tags are kept.
• To remove the connection, select the delete (trash can) icon on the connection card, then Delete in the Delete Connection dialog. This removes all synced users and can't be undone.

If something goes wrong

• "Admin consent completed but the required application permissions were not granted. In Entra, open Enterprise applications, SuperIT, Permissions, then Grant admin consent and try again." Do what the message says, then select Connect Microsoft 365 again.
• "Admin consent was not granted. Please accept the permissions to continue." The permissions were declined in Microsoft. Start again and accept them.
• "This Microsoft 365 tenant is already connected." The tenant is already connected to this team.
• "Microsoft denied access to license names. Use Reconnect and ask your Microsoft 365 tenant admin to approve the license permission. If already approved, wait briefly and use Sync Now to retry." Do what the message says: Reconnect, approve, then Sync Now if needed.
• "Microsoft license names could not be loaded. Use Sync Now to retry." Select Sync Now.
• "Some license information is incomplete. Use Sync Now to retry; contact support if this persists." Select Sync Now. If the message stays, contact [email protected].
• Add from MS365 is greyed out: the team has no Microsoft 365 connection yet.

Related

• What SuperIT can do in Microsoft 365
• Automate Microsoft 365 with workflows
• Teams and users
• What SuperIT can and can't do
• Command policies and approvals
• Set up SuperIT for your MSP