Skip to main content
Entra ID can keep Console groups and their members in sync with your Entra groups. Console creates one group per Entra group you assign. You then decide in Console which workspaces each group can reach. Group provisioning runs in the same enterprise application as user provisioning, and Entra turns it on by default. There is no second connection to set up. The steps at a glance:
  1. Before you start: check that user provisioning works and that your tenant has Entra ID P1 or P2.
  2. Check the group mapping (Entra admin): confirm Entra’s three default rows. Usually nothing to change.
  3. Assign the groups (Entra admin): assign them to the application and test one.
  4. Give the synced groups access to workspaces (Console admin): add each group to the workspaces it should reach.

1. Before you start

  • User provisioning works. Follow SCIM user provisioning from Microsoft Entra ID first. A group member can be added only once their Console account exists.
  • SSO users are matched, not duplicated. If people already sign in with SSO, check the section Users who already sign in with SSO of the user guide. Otherwise Entra adds a duplicate account to the group, and the person, still signing in to their old account, gets none of the group’s access.
  • Entra ID P1 or P2. Assigning groups to an application requires one of these licences.
  • The API key owner is a Company Admin. Group provisioning uses the same account as user provisioning; nothing more to do if you followed the user guide.

2. Check the group mapping

  1. In the enterprise application, open Provisioning > Attribute mapping.
  2. Click Provision Microsoft Entra ID Groups and check that Enabled is Yes (Entra’s default).
  3. Make sure the mapping holds exactly these rows, which are Entra’s defaults: Delete any other row: Console rejects an update that contains an attribute it does not store.
  4. Click Save.
Keep externalId mapped to objectId. When a SharePoint datasource enforces document permissions, Console grants an Entra group’s access to the Console group carrying that group’s object id. Without it, every document shared with the group is held back until an admin binds the group by hand.

3. Assign the groups

  1. Open Users and groups and click + Add user/group.
  2. Select the groups to sync and click Assign.
  3. Test with one group: Provisioning > Provision on demand, pick the group, select a few members, click Provision. Check that the group and its members appear in Console, under the company’s groups in the admin panel.
Assigning a group also brings its members into scope, so Entra creates their accounts too. Only direct members are synced: Entra does not provision the members of nested groups. The next provisioning cycle, about every 40 minutes, picks up the change. Provision on demand pushes one group immediately.

4. Give the synced groups access to workspaces

Entra syncs who is in each group. It does not decide what the group can reach in Console. In the Console admin panel, add each synced group to the workspaces it should access, with the role it should have there. From then on, adding someone to the group in Entra gives them that access, and removing them takes it away. The admin panel steps are in How to Manage Groups? (Administration > Identity & Access Management > Group Management).

What happens in Console

Console’s built-in groups (the company-wide group and each user’s private group) are never read or changed by Entra.
Manage the membership of synced groups in Entra. A member added or removed in the Console admin panel drifts from Entra and can be undone by a later sync.

Limits and troubleshooting

Errors appear in Provisioning > Provisioning logs. Filter on Status: Failure and open the entry.