Sync with Microsoft Entra ID

Available on: Enterprise

Firezone can automatically synchronize users and groups from your Microsoft Entra ID directory. This eliminates the need to manually create and manage users in Firezone. You can add multiple Entra directories to sync from different tenants.

Overview

Firezone uses Microsoft Graph API to read users and groups from your Entra directory. When you complete the setup flow, you'll authorize Firezone to access your directory with read-only permissions.

Firezone also subscribes to Microsoft Graph change notifications for your directory, so changes you make in Entra are generally reflected in Firezone within moments. See Sync timing for details.

Setup

Step 1: Start the Directory Sync setup in Firezone

  1. In your Firezone admin portal, go to Settings → Directory Sync.
  2. Click Add Directory and select Microsoft Entra ID.
  3. Enter a name for this directory to easily identify it in the Firezone portal (e.g. "Entra ID").

Step 2: Choose a sync mode

Select how you want Firezone to sync groups from your directory:

Only groups assigned to the Firezone Directory Sync Enterprise Application in your Entra tenant will be synced. This gives you fine-grained control over which groups appear in Firezone.

This option requires Entra ID P1/P2 or higher. It will not work with Entra ID Free.

To assign groups to the Firezone Directory Sync application:

  1. Sign in to the Azure portal.
  2. Go to Microsoft Entra ID → Enterprise applications.
  3. Search for Firezone Directory Sync and select it.
  4. Go to Users and groups.
  5. Click Add user/group to assign specific groups.

Make sure you select the Firezone Directory Sync application and not the Firezone Authentication application. Groups must be assigned to the Directory Sync application for this sync mode to work.

Only users who are members of the assigned groups will be synced to Firezone.

All groups

All groups from your Entra directory will be synced to Firezone. Use this option if:

  • You're using Entra ID Free (which doesn't support app assignments for groups).
  • You want to sync all groups without managing assignments.

With All groups, every group in your directory will appear in Firezone. For large directories, consider using Assigned groups only to limit which groups are synced.

Users originally created from this directory may also be removed if they no longer belong to any synced groups.

Step 3: Verify and save

A Microsoft Entra Global Administrator or Privileged Role Administrator must complete the Verify Now step to authorize and verify the tenant.

Click Verify Now to authorize Firezone to access your Entra directory. You'll be redirected to Microsoft to sign in and grant permissions.

Verify you're signing into the correct tenant before granting permissions. The tenant ID will be captured during this step.

If successful, you'll see a confirmation message. Click Save to complete the setup.

Sync timing

Changes in your Entra directory are generally reflected in Firezone nearly immediately. Firezone subscribes to Microsoft Graph change notifications for users and groups, so the following changes flow to Firezone as they happen:

  • A user is added to or removed from a synced group, including through nested groups.
  • A user is disabled or deleted. Their Firezone identity is removed and they are signed out of all sessions.
  • A user's name or email address changes.
  • A group is renamed or deleted.

Firezone runs a full sync once a day to reconcile anything that may have been missed. To trigger a full sync immediately, click Sync Now on the directory card in Settings → Directory Sync.

With Assigned groups only, change notifications cover the groups you've already assigned to the Firezone Directory Sync application. Assigning a new user or group to the application, or removing an assignment, is picked up by the next full sync. Click Sync Now to apply it right away.

Disabled and deleted users

Firezone removes deleted Entra users as soon as Microsoft Graph notifies it of the change, and at the latest on the next full sync. It also filters out users where Microsoft Entra marks accountEnabled as false.

  • API-side filtering: When Firezone streams group members from Microsoft Graph, it requests only users where accountEnabled eq true.
  • Defense in depth: Firezone also re-checks accountEnabled after receiving user payloads, including batched lookups for directly assigned users.
  • Defensive handling: If Microsoft Graph omits accountEnabled unexpectedly, Firezone logs the event and skips that user instead of treating them as active.

Once a synced Entra user is deleted or disabled, their Firezone identity is removed. This signs them out of Firezone and prevents new sign-ins through the synced Entra identity.

Troubleshooting

"Unauthorized" or "Access Denied" error

This typically means the permissions were not granted correctly during setup. We recommend editing the directory in Firezone, clicking Reset Verification then click Verify Now. You should be asked to grant the appropriate permissions.

If you need to delete the Enterprise App in the Entra Portal, first disable the sync in the Firezone portal. After deleting the Enterprise App return to Firezone, edit the Entra directory sync, click Reset Verification, and then click Verify Now.

Groups not syncing (Assigned groups only)

If you're using Assigned groups only and groups aren't appearing:

  1. Verify you have Entra ID P1/P2 or higher.
  2. Check that the groups are assigned to the Firezone Directory Sync Enterprise Application in the Azure portal.

Users not syncing

Users are synced based on their group membership. If a user isn't syncing:

  1. Verify the user is a member of a group that's being synced.
  2. For Assigned groups only, ensure the user's group is assigned to the Firezone Directory Sync application. New assignments are picked up by the next full sync, so click Sync Now to apply them right away.
  3. Wait for the next full sync or click Sync Now.

Changes are not appearing right away

Most changes arrive within moments, but Microsoft Graph does not guarantee delivery time for change notifications and can delay or drop them under load. If a change hasn't appeared after a few minutes, click Sync Now to run a full sync. The daily full sync also picks up anything that was missed.

Wrong tenant

If users or groups from the wrong tenant are syncing, remove the directory and add it again. During the Verify Now step, ensure you're signing into the correct Microsoft account and tenant.

Need help? See all support options.

Found a problem with this page? Open an issue
Last updated: September 04, 2026