> ## Documentation Index
> Fetch the complete documentation index at: https://docs.regentra.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID Integration

> Connect Entra ID for SSO authentication, user and device sync, and compliance evidence collection.

The Microsoft Entra ID integration connects your Azure AD tenant to Regentra for single sign-on, user and device synchronization, and automated compliance evidence collection.

## What it provides

* **SSO authentication** — Staff and portal users sign in with their Entra credentials
* **User sync** — Entra users are imported as portal contacts automatically
* **Device sync** — Intune-managed devices are imported as assets
* **Compliance evidence** — Conditional access policies, MFA status, and device compliance states are collected as evidence for compliance frameworks

## Setup

<Steps>
  <Step title="Navigate to integrations">
    Go to **Settings → Integrations → Microsoft Entra ID**.
  </Step>

  <Step title="Start admin consent">
    Click **Connect** to initiate the Azure AD admin consent flow. You will be redirected to Microsoft's login page.
  </Step>

  <Step title="Grant consent">
    Sign in with a Global Administrator or Privileged Role Administrator account and approve the permissions requested by the Regentra application.
  </Step>

  <Step title="Verify connection">
    After consent, you are redirected back to Regentra. The integration status should show **Connected**.
  </Step>
</Steps>

<Note>
  The admin consent flow grants Regentra read access to users, groups, devices, and directory data. No write permissions are requested.
</Note>

## What syncs

| Entra object     | Regentra object | Details                                       |
| ---------------- | --------------- | --------------------------------------------- |
| Users            | Portal contacts | Display name, email, department, job title    |
| Devices (Intune) | Assets          | Hostname, OS, serial number, compliance state |
| Groups           | Contact groups  | Used for portal access control                |

## Sync frequency

* **Identity sync** (users, contacts, devices) runs every **4 hours** on the hour
* **Evidence collection sync** (conditional access policies, MFA status, device compliance signals) runs every **6 hours**, offset 15 minutes from the identity sync to avoid Graph API contention
* **Manual sync** can be triggered at any time from the integration settings page

<Info>
  The initial sync may take several minutes depending on the size of your Entra directory. Subsequent syncs are incremental and faster.
</Info>

## Per-company sync

For MSP customers operating multiple client tenants, Regentra also exposes a **per-company Sync With M365 button** on the PSA Company detail page (**PSA → Companies → \[company]**). This pulls a fresh snapshot of users + devices for that one customer without waiting for the next 4-hour cycle.

The button handles two states:

* **Not yet connected to a tenant** — click redirects to Microsoft for admin consent on the customer's tenant; on return, the initial sync queues automatically
* **Already connected** — click queues an Inngest sync job that runs in the background; the page shows "Sync queued" and contacts + devices refresh on the next load

Per-company syncs are blocked for archived companies (see [archive flow](/psa/companies-contacts#archiving-and-deleting-companies)) — restore the customer first if you need to re-pull their tenant data.

Intune fetch failures are surfaced explicitly in the audit log (no more silently-swallowed errors) — if a sync completes with 0 devices when you expect more, check the audit log for the underlying Graph API response.

## SSO for staff login

When Entra SSO is enabled, your team members can sign in to [app.regentra.io](https://app.regentra.io) using their Microsoft credentials. This uses the OAuth2 authorization code flow. See [SSO settings](/settings/sso) for configuration details.

## SSO for portal login

Portal SSO is configured separately for each client. When a client's Entra tenant is connected, their end users can sign in to the support portal using their corporate Microsoft accounts. Enable this under **PSA → Support Portal** (or the **Support Portal** Settings tile) → **Authentication** tab, within the client's context.

## Device sync deduplication

If you also use the [Level.io RMM integration](/integrations/level-rmm), devices may appear from both sources. Regentra deduplicates assets by matching on serial number and hostname. When a match is found, the records are merged — Entra provides compliance state and Intune data, while Level.io provides RMM agent details and warranty information.

<Tip>
  If you see duplicate assets after enabling both integrations, they will be automatically merged on the next sync cycle.
</Tip>