Skip to content

Group synchronization (Entra / IdP)

Import groups from your external directory provider into Forra to use them in:

  • Sharing of Assistants, Skills, or External Services (visibility by group).
  • The IdP-managed provisioning mode (access and roles driven by groups).

Prerequisites

  • An external user-groups service is configured in the External Services tab (typically Microsoft Entra ID). If you do not see a service in the User Groups tab, contact the Forra team to have one added.
  • An account on your external directory with permission to read groups and their members (e.g., for Entra: GroupMember.Read.All, Directory.Read.All).

1. Connect the sync account

In Tenant Admin → User Groups tab → Synchronization credentials section:

  1. Click Connect.
  2. Sign in with an account that has the privileges described above.
  3. Accept the OAuth consent.

This account's token is kept so Forra can refresh the groups automatically. The card then displays the authorized account and the date of authorization.

Important: this account is not the end user. It is a technical service account. If this account loses its permissions, synchronization will stop working — use Disconnect then Connect with another account.

2. Select the groups to synchronize

In the Groups section:

  1. Click Fetch groups. Forra queries the external directory and displays the full list of visible groups.
  2. Check the groups you want to use in Forra. Indicators:
  3. New: present in the directory, not yet imported.
  4. Local: already present in Forra (created manually or during a previous sync).
  5. Required: used by the IDP_MANAGED configuration; stays selected automatically.
  6. Click Save selection.

Unselecting a group already present in Forra opens a confirmation: the group will be excluded from future synchronizations, and shares referencing it will no longer be resolved.

3. Run a synchronization

In the Synchronization actions section:

  • Dry-run synchronization — simulated execution, with no writes. Displays the groups to create / update / ignore, memberships to add / remove, and users missing from Forra. Use this to validate a selection before applying it.
  • Synchronize groups — real execution. Creates and updates groups, adds and removes memberships.

Users are matched by email address.

4. Check the result

The Synchronization history section lists each run with its status, trigger (Manual or Automatic), and counters: affected groups, memberships added / removed, users provisioned / reactivated / disabled.

Click on a row to open the details.

Automatic synchronizations

Once the credentials are connected and at least one group is selected, Forra refreshes the groups automatically at regular intervals. No action is required to keep the groups up to date.

Edge cases

  • Name conflict: if an existing Forra group has the same name as an unselected directory group, it remains locally managed (not overwritten by the sync).
  • User removed from the required group (IDP_MANAGED mode): their Forra account is disabled on the next synchronization.
  • User not found: if a member of the IdP group has no corresponding Forra account (unknown email), they are listed in the sync report's ignored users — they will be integrated as soon as they sign in or get invited.

See also