Microsoft Entra ID

The Microsoft Entra ID integration (formerly Azure AD) automatically creates and updates your ECARD users from your Microsoft directory. Once it's set up, a new hire appearing in your directory creates their ECARD user, and a job change updates their record — with no manual entry.

What it does

Synchronize users from Entra (automatic creation of ECARD users).
Synchronize groups (optional) and import only certain groups.
Filter users by attributes (department, job title, site, and so on).
Map fields from Entra to ECARD fields / custom attributes, including your extension attributes.
Assign groups / tags automatically based on Entra values.
Synchronize profile photos.
Choose an import mode per field: how far Entra is authoritative over each field of an existing card (see Import mode, field by field).

Setting it up

Open Integrations → Microsoft Entra ID.
Connect your Microsoft directory (an administrator authorization on the Microsoft side is required).
Choose the groups and filters to synchronize (by department, job title or site).
Configure the field mapping and the assignment of groups/tags.
Run a first full synchronization.

After this first full synchronization, updates can happen in real time. The synchronization history and errors can be viewed directly in the integration.

Example

You only want to synchronize the sales team: select the Entra group "Sales" and add a filter on the department. Only those users are created in ECARD, with the "Sales" tag assigned automatically.

Field mapping

Each mapping row links an Entra attribute (the source) to an ECARD field or a custom attribute (the target). The list of sources is organized into three families.

Entra ID fields — the directory's standard properties: first and last name, email, job title, company, phone numbers, address, department, office.
On-premises extension attributes — extensionAttribute1 through extensionAttribute15, inherited from your Active Directory and surfaced by Entra Connect. This is most often where the employee number, branch or legal entity lives.
Directory extensions — the attributes created in your tenant, shaped as extension_{application id}_{name}. The list only appears once detection has been run (see below).

To map an attribute onto a custom attribute, use the Add custom attribute button at the bottom of the table — see Groups, tags & entities. If your space has none yet, you can create one straight from this table: the Create your first custom attribute button opens the form, and the mapping row is filled in automatically once the attribute exists. On an existing row, the Create a custom attribute… entry at the bottom of the target list does the same. This requires the Custom attributes add-on.

Detecting extension attributes

The 15 extension attributes exist in every directory, but most of them are empty. The Detect extension attributes button samples up to 100 users from your tenant and tells you:

which ones actually contain data, with a sample value and the number of users concerned;
the directory extensions declared in your tenant.

The sample values then appear on the right of each entry in the dropdown, which saves you from mapping an empty attribute. Run the detection again after creating a new directory extension on the Microsoft side.

The button sits at the top of the Mapping tab: a single detection feeds both the field mapping and the group and tag assignment described below. Detected extensions are remembered, so they stay available when the page reloads without running the analysis again.

A screenshot of the detection results panel would help visualize this step.

Assigning groups and tags

Still in the Mapping tab, the Group & tag mapping section lets you pick one Entra attribute that feeds ECARD groups and one that feeds tags. The attribute's value becomes the group or tag name: a user whose department reads "Sales" joins the "Sales" group, created if it does not exist.

The available sources are exactly the same as for the field mapping — standard fields, on-premises extension attributes and detected directory extensions — plus two special entries:

None — turns the assignment off for that target;
Entra groups — uses the selected Entra groups themselves rather than an attribute.

The assignment follows the value over time: if a user's department changes in Entra, they leave the old group and join the new one. Groups and tags you assigned manually are never touched.

Pick a low-cardinality attribute (department, branch, legal entity). An attribute that is unique per person — employee number, email — would create one group per user.

An attribute that is absent from the Entra response is treated as "no information": the group or tag already assigned is kept. Only a value that is explicitly empty in Entra removes the assignment.

Run a full sync to apply a new mapping to members that were already imported.

Import mode, field by field

Every mapping row carries its own mode, picked from the dropdown in the "Import mode" column. Each option restates its effect, so the three behaviours can be compared at a glance.

Mode	On an existing card	Field locked
Always overwrite	The field is taken from Entra on every sync, and cleared if the value disappears there.	Yes
Fill if empty	The field is filled only while it is still empty in ECARD. An entered value is never overwritten, nor cleared.	No
Don't import	The field is not taken from Entra at all.	No

So you can let Entra be authoritative over job title and department while your users stay in charge of their own mobile number.

A newly created card is always populated for every imported field, whatever its mode: on a brand-new card, "Always overwrite" and "Fill if empty" amount to the same thing. The mode only separates them on later syncs.

A screenshot of the open Import mode dropdown, showing the three options and their descriptions, would help visualize this choice.

Locked fields

A field set to Always overwrite becomes read-only in ECARD: a padlock on the user's record and a read-only field on the edit link, with the note "Some fields are managed by Microsoft Entra ID and locked here." This is deliberate: without that lock, a manual correction would be overwritten at the next sync, silently.

Fields set to Fill if empty or Don't import are never locked — the sync does not touch a value that is already filled in, so there is nothing to protect. To make a field editable, switch it to "Fill if empty".

Connectors already in place

If your connector existed before per-field modes arrived, it was carried over automatically, with nothing for you to do: every imported field inherits the connector-wide write mode you had chosen, and every unticked field becomes "Don't import". The connector-wide setting disappears from the Settings tab.

One nuance: the retired connector-wide "Disabled" mode (existing cards were never updated, but new cards were still populated) has no exact per-field equivalent. Those fields become Fill if empty, the closest match: new cards stay populated, nothing is ever overwritten or locked, and fields left empty on older cards will be filled at the next sync.

Troubleshooting

The wrong people show up (or none). Check the selected groups and filters; run a full synchronization again after any change to the filters.
A field stays empty. Check the mapping (an attribute that's empty on the Entra side stays empty in ECARD), then the write-back mode: in "Disabled", no value is written to an existing card.
A value entered in ECARD is overwritten at every sync. That is Always mode. Switch to Only if empty if your users need to be able to correct their own information.
A field cannot be edited (padlock). It is managed by Entra in Always mode. Disable its row in the mapping, or change the mode.
An extension attribute is missing from the list. Run Detect extension attributes: directory extensions are only offered once they have been detected. The same detection feeds both the field mapping and the group and tag mapping.
An automatic group or tag isn't updating. Check that the source attribute is actually populated in Entra: an attribute absent from the response is deliberately treated as "no information" and never removes an existing assignment.
New entries don't appear. Look at the synchronization history to spot a possible error.

More details: Synchronization & import.

Good to know

This setup requires an Admin role on the ECARD side and administration rights on the Microsoft Entra side.
ECARD custom attributes can receive Entra values via the mapping — see Groups, tags & entities.
For term definitions, see the Glossary.

On this page