Microsoft Entra groups
Let Microsoft Entra ID keep group members up to date automatically through SCIM provisioning
Last updated on
With provisioning, Microsoft Entra ID sends your users and groups to Tillor. If you link an Entra group to a Tillor group, the members of that group follow Entra: anyone you add in Entra gets the group's tasks and views, and anyone you remove or disable loses them. Nobody has to sign in again for this.
Entra uses the SCIM protocol for this. Tillor itself reads nothing from your Microsoft tenant: Entra decides which users and groups it sends. Only during Quick setup does your browser talk to Microsoft to create the app for you.
What does and does not happen
- Existing members only. Entra does not create Tillor accounts. Someone who is not yet a member of your organisation does not count until you invite that person. As soon as they become a member, they are immediately in their linked groups
- No data of non-members. For people without a Tillor account, Tillor stores no name or email address, only an unreadable code that lets Tillor recognise them if they become a member later
- Nothing without a link. An Entra group only changes something in Tillor once you link it to a Tillor group under Entra groups not linked
- One to one. A Tillor group belongs to at most one Entra group
- The name stays Tillor's. If you rename the group in Entra, you see the new name after Entra ·, but the Tillor group keeps its own name
- Nested groups are not expanded. A group that is a member of another group does not count as a member. If you want those people too, assign the nested group separately in Entra and link it to the same or another Tillor group
- Signing in does not change. People simply sign in with Microsoft, see Sign-in
Before you start
You need:
- In Tillor, the Edit settings permission
- In Microsoft Entra, the Cloud Application Administrator or Application Administrator role (or higher)
- An Entra licence that allows automatic provisioning to custom apps (Microsoft Entra ID P1 or higher)
Make sure your colleagues have the same Microsoft account or the same email address in Tillor as in Entra. That is how Tillor recognises who is who, see How Tillor recognises people.
Quick setup
If you are an Entra administrator yourself, Tillor sets up the link for you in one go.
- Go to Support > Settings and choose Groups
- Under Microsoft Entra, click Set up with Microsoft and then Sign in and set up
- In the Microsoft window, sign in with your administrator account and give consent. Microsoft asks for permission to manage apps and provisioning and to read your groups
Tillor then creates the app in Entra, fills in the tenant URL and the token, has users recognised by their Microsoft account and has Entra send the type of each group along. After that the synchronisation starts and Tillor immediately sends you and all your groups, so you do not have to wait for the first synchronisation. Finally, Tillor reads the type of each group and whether a Team belongs to it. You see each step being ticked off. Tillor does this in the background: you can close the window or even the page. If you click Set up with Microsoft again later, you see how far it is, or for up to an hour after it finished whether it succeeded or failed. After that you can start again with Set up again.
Entra sends all your users and groups in the process. You do not have to choose anything beforehand: the groups appear under Entra groups not linked and change nothing until you link them. To do so, continue at Link groups in Tillor. The members of the groups follow with the first synchronisation. That takes a few minutes, and a few hours for large organisations.
Tillor only uses the access for this setup. It goes encrypted to the background task and is not stored anywhere afterwards; Microsoft lets it expire by itself after about an hour. If you go through Set up with Microsoft again, Tillor finds the same app again and does not create a second one.
Quick setup creates a new token. A token you pasted into Entra by hand earlier stops working afterwards. If the setup stops halfway, click Retry.
If signing in does not work, for example because your organisation blocks consent for apps, or if you want Entra to send only certain groups, set up the link by hand as described below.
Manual setup
Create a token in Tillor
- Go to Support > Settings and choose Groups
- At the top is Microsoft Entra. If the link is already set up, click Connection
- Copy the Tenant URL. It looks like
https://…/api/orgs/<organisatie>/scim/v2 - Click Generate token and copy the token that appears
The token is shown only once. Paste it into Entra straight away. If you lose it, click Replace token and use the new token.
Create an app in Entra
- Open the Microsoft Entra admin centre
- Go to Identity > Applications > Enterprise applications and click New application
- Click Create your own application
- Give the app a name, for example Tillor, choose Integrate any other application you don't find in the gallery (Non-gallery) and click Create
If you already have an enterprise application for Tillor, you can use that too.
Connect provisioning
- In the app, open Provisioning and click Get started (or New configuration)
- Set Provisioning Mode to Automatic
- Under Admin Credentials, enter:
- Tenant URL: the Tenant URL from Tillor
- Secret Token: the token from Tillor
- Click Test Connection. Entra must report that the connection succeeded
- Click Save
Check the attributes
Under Mappings, open the Provision Microsoft Entra ID Users line:
- Set externalId to objectId (by default it says mailNickname). Tillor then recognises someone by their Microsoft account, even if the email address differs
- Leave userName (← userPrincipalName), active and emails[type eq "work"].value (← mail) as they are
Leave Provision Microsoft Entra ID Groups switched on. The default settings (displayName, externalId ← objectId, members) are fine.
If you want to see in Tillor what kind of group it is, add these attributes to the groups. Under Show advanced options, first choose Edit attribute list for customappsso and add the target attributes, then Add New Mapping for each line:
| Source in Entra | Target attribute | Type |
|---|---|---|
Expression Join(",", [groupTypes]) | urn:ietf:params:scim:schemas:extension:tillor:2.0:Group:groupTypes | String |
| securityEnabled | urn:ietf:params:scim:schemas:extension:tillor:2.0:Group:securityEnabled | Boolean |
| mailEnabled | urn:ietf:params:scim:schemas:extension:tillor:2.0:Group:mailEnabled | Boolean |
| onPremisesSyncEnabled | urn:ietf:params:scim:schemas:extension:tillor:2.0:Group:onPremisesSyncEnabled | Boolean |
urn:ietf:params:scim:schemas:extension:tillor:2.0:Group:mail | String | |
| description | urn:ietf:params:scim:schemas:extension:tillor:2.0:Group:description | String |
If a source is missing from Entra's list, skip that line. Entra cannot send whether a Team belongs to a group this way; Tillor only sees that through Set up with Microsoft.
You may leave other attributes as they are. Tillor does not store them.
Assign groups
- In the app, open Users and groups and click Add user/group
- Choose the groups Tillor should receive, for example Reception, and click Assign
- Under Provisioning > Settings, check that Scope is set to Sync only assigned users and groups
Entra sends a group together with its members. You do not have to assign the members separately.
Start provisioning
Under Provisioning, set Provisioning Status to On and click Save.
The first round can take a while, depending on the number of users. After that Entra sends the changes about every 40 minutes. If you want to update one person immediately, use Provision on demand in Entra.
Link groups in Tillor
Refresh Settings > Groups. At the top is the Microsoft Entra line with the last synchronisation and how many groups are linked. Below your Tillor groups is Entra groups not linked with the groups that were sent but do nothing yet. Click Show if the list is closed and use the search field to find a group. For each group, choose under Link to… what should happen and then click Save. With Revert you discard your choices. A Tillor group can only be attached to one Entra group; groups that are already linked cannot be chosen again.
| Choice | What happens |
|---|---|
| Create new | Tillor creates a group with the name from Entra and fills it with the recognised members |
| An existing group | The members of that group are replaced by the recognised members from Entra. If Entra has not yet sent the members of that group, the current members stay until the synchronisation delivers them |
From now on, Entra updates the members at every synchronisation. The linked group disappears from the list, and in your Tillor groups it says Entra · [name] under the group, with what kind of group it is.
Linking is only done from Entra groups not linked. A Tillor group you manage by hand, such as IT, is not linked from the group itself.
After each group name it shows what kind of group it is in Entra. With the buttons above the list you show only one kind.
| Label | What it is |
|---|---|
| Security | An ordinary security group, often the group you want to link |
| Mail-enabled security | A security group with an email address of its own |
| Distribution list | Only an email list |
| Microsoft 365 | A group with a shared mailbox and a SharePoint site, sometimes with a Team |
| Windows Server AD | Comes from your local Active Directory (hybrid) and is managed there |
| Dynamic | Entra decides the members itself with a rule |
| Teams | A Team belongs to it |
| Type unknown | Tillor does not know the type yet. Go through Set up with Microsoft again |
SharePoint site groups, such as Owners, Members and Visitors of a site, are not Entra groups. They never reach Tillor. What you do see is the Microsoft 365 group behind the site.
How Tillor recognises people
For each user Entra sends, Tillor looks for an existing member of your organisation:
- First by the Microsoft account the person signs in to Tillor with (the Entra object ID, if you set externalId to objectId)
- Otherwise by email address: the work address from Entra, or the userPrincipalName if that is an email address
If Tillor finds nobody, or the user is disabled in Entra, they do not count in the group. As soon as the person becomes a member of the organisation, they count straight away. If you enable them again in Entra, they count at the next synchronisation.
What happens when something changes in Entra
| In Entra | In Tillor |
|---|---|
| Member added to a linked group | Joins the Tillor group (if they are a member of the organisation) |
| Member removed from the group | Leaves the Tillor group |
| User disabled (Account enabled off) | Leaves all linked Tillor groups. Their Tillor account remains |
| User or group no longer assigned to the app | Entra sends a disable or delete, with the same effect |
| Group deleted | Under the Tillor group it says Removed in Entra. Members were kept. The Tillor group remains with its last members and is no longer updated |
Removing someone from your organisation altogether is done in Tillor, under Organisation. Entra only manages the group members.
What you see in the activity log
In the activity log you see:
- Every change to the members of a Tillor group that Entra makes, with who joined or left. It is recorded in the name of the system, not of a user
- Every synchronisation round from Entra, one line per round. A round in which Entra sends nothing is not shown
- Who linked or unlinked an Entra group to a Tillor group, and who replaced the token
Change or stop the link
- Unlink: on the Tillor group, click Unlink. The Tillor group stays as it is and you manage it by hand again. The Entra group comes back under Entra groups not linked
- Another Tillor group: unlink, then link the Entra group to another group under Entra groups not linked. The previous group keeps its members, but is no longer updated
- Stop altogether: in Entra, set Provisioning Status to Off, or delete the enterprise application
Replace the token
In the Microsoft Entra line, click Connection and then Replace token if the token has leaked or if you need it again. The old token stops working immediately. Paste the new token into Entra under Provisioning > Admin Credentials > Secret Token and click Save. Until you do, the synchronisation in Entra fails.
Troubleshooting
Set up with Microsoft stops at a step
The step shows Microsoft's message. Usually your account lacks the administrator role or the consent. Check the roles under Before you start and click Retry. Tillor reuses the app and provisioning that were already created.
Test Connection fails
Check that the Tenant URL was copied in full, including /scim/v2, and that the token is the one generated last. After Replace token, an old token no longer works.
A group is not in the list
Wait until the first synchronisation is done and refresh the page. If you set up the link by hand, Entra only sends groups that are assigned to the app: check Users and groups in the app and wait for the next round, or use Provision on demand.
Someone is missing from the Tillor group
- Is that person a member of your Tillor organisation? Entra does not create accounts
- Does the email address in Entra match the one in Tillor? Otherwise set externalId to objectId, so that Tillor recognises them by their Microsoft account. That only works if they have already signed in to Tillor with Microsoft once
- Is the user enabled in Entra?
- Are they a direct member of the group, and not through a nested group?
My manual change disappears
For a linked group, Entra is the source. Change the members in Entra, or unlink the group.
More details about a failed round
In Entra, open Provisioning > Provisioning logs. There you see for each user and group what Entra tried and what answer Tillor gave.