Sync your clients' users and technicians from Microsoft Entra ID to SuperOps, so your contact list stays accurate without manual updates.
Keeping contact details current across tools takes time. The Entra ID integration manages the identity of your clients' workforce in one place and keeps their information updated in SuperOps automatically.
What is Microsoft Entra ID?
Microsoft Entra ID (formerly Azure Active Directory, or Azure AD) is Microsoft's identity and access management (IAM) service. Organizations use it to manage employee access to resources and applications.
When you connect Entra ID to SuperOps, user and technician records in SuperOps update whenever they change in Entra ID.
Before you begin
The integration is a one-way sync from Entra ID to SuperOps. Changes made in Entra ID flow into the corresponding mapped client in SuperOps; changes made in SuperOps are not sent back.
You need an active, paid Azure subscription.
You need admin access to the Azure portal to create an enterprise application and configure provisioning.
Generate a URL and token in SuperOps
Navigate to Settings > Marketplace > MS Entra ID under the User Management section and click Generate tokens.
2. The Entra configuration page lists the steps to connect SuperOps with Entra ID. Your MSP's URL and token are generated automatically. Use them to import your technicians from Entra ID.
3. Scroll to the Client tokens & URL section to generate provisioning credentials for your individual client tenants.
4. Click the copy icon next to the generated tenant URL or token to copy the value to your clipboard.
Create an enterprise application in Entra ID
Sign in to the Azure portal and go to Microsoft Entra ID → Enterprise applications → New application.
2. Click Create your own application. Enter a name for the application, select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
3. In the new application, go to Manage → Users and groups and click + Add user/group.
4. Under Users and groups, click None Selected, choose the users or groups you want to sync to SuperOps, and click Select.
5. Once you’re done, click Assign at the bottom of the page.
📝Note: You can also assign groups if your Microsoft Entra licensing supports group-based assignment.
Group assignments can provision their members into SuperOps. The groups themselves aren’t created as standalone records in SuperOps.
Connect Entra ID to SuperOps
Admin credentials are no longer entered on the Provisioning page. They now live on a separate Connectivity page.
In the left pane of your enterprise application, go to Manage → Connectivity.
Under Select authentication method, choose Bearer authentication.
Paste the client's URL from SuperOps into Tenant URL and the client's token into Secret token.
4. Click Test connection. Entra ID requires a successful test before you can save.
5. Once the test succeeds, click Save.
📝 Note: If you open Provisioning → Admin Credentials, you'll see a banner that admin credentials have moved. The link in that banner takes you to the same Connectivity page.
Configure attribute mappings
Attribute mappings determine which Microsoft Entra ID fields populate the corresponding fields in SuperOps.
Go to Manage → Provisioning. Provisioning Mode is already set to Automatic.
Next, expand the Mappings tab. You'll see two mappings, both enabled: Provision Azure Active Directory Groups and Provision Azure Active Directory Users.
3. Click Provision Azure Active Directory Users. On the Attribute Mapping page, confirm that Enabled is set to Yes and that all three Target Object Actions (Create, Update, Delete) are selected.
4. Scroll down to the Attribute Mappings table. It lists each customappsso Attribute (the SCIM attribute SuperOps receives) next to the Microsoft Entra ID Attribute it pulls from. Click Edit on a row to change its source, or add a new mapping for any attribute that's missing.
Use the table below to map Entra ID attributes to the fields SuperOps supports.
SuperOps field | Source attribute (Potential Entra ID attribute) | Target attribute (SCIM attribute) |
userPrincipalName | userName | |
First name | givenName | name.givenName |
First name (if givenName and surname are empty) | displayName | displayName |
Last name | surname | name.familyName |
Phone number | telephoneNumber | phoneNumbers[type eq "work"].value |
Reporting manager | manager | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager |
Designation | jobTitle | title |
Business function | department | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department |
If a record has no first name (givenName) or last name (surname), SuperOps uses displayName as the first name. Map displayName alongside givenName and surname to cover these records.
📝 Note: Designation and Business function are only imported for technicians.
5. Click Save. Your completed user mapping should look like this:
6. Go back to Mappings and click Provision Azure Active Directory Groups. Review the default group mappings, make any changes you need, and click Save.
Configure settings and start provisioning
On the Provisioning page, expand Settings.
Choose a Scope:
Sync only assigned users and groups syncs only the users and groups you assigned previously.
Sync all users and groups syncs everyone in your Entra ID tenant.
3. Optionally, select Send an email notification when a failure occurs to get alerted about sync errors, and Prevent accidental deletion to stop large numbers of users from being deleted in a single sync.
4. Set Provisioning Status to On and click Save.
5. Your Entra ID integration is now live. Client users and technicians in SuperOps update automatically whenever their information changes in Entra ID.
💡 Tip: To test with one user before the full sync runs, use Provision on demand in the left pane.
Removing users
⚠️ Important: Users you remove in Entra ID aren't deleted from SuperOps immediately. To delete them right away:
Go to the Deleted users list in SuperOps.
Select the users you want to remove and click Delete permanently.
If you take no action, SuperOps removes these users automatically after 30 days.