[Access Control] User Sync Settings (Access Control → Microsoft 365)

Overview

This article explains the configuration procedure for customers who want to manually or periodically synchronize user information from Access Control to Microsoft Entra ID.

Notes

1. The content of this article is based on product specifications as of October 2026 and is subject to change without notice.
2. To configure user synchronization, you need global administrator privileges for Access Control and global administrator privileges for Microsoft 365.
3. For instructions on how to access the Administration, please refer to the following article.
   [Access Control] How to log in to the Administration
4. User synchronization must be configured for each domain.
5. Before executing user synchronization, you must register the required users in Access Control in advance.
6. Users created in Microsoft Entra ID via user synchronization from Access Control will not be assigned Microsoft 365 licenses.
   If necessary, please assign Microsoft 365 licenses to users after synchronization.
7. After enabling periodic synchronization, user information will be synchronized every hour.
   *The synchronization interval cannot be changed.
8. The user attributes synchronized to Microsoft 365 are: [Family name], [Given name], [Display Name], and [UserPrincipalName].
   Passwords from Access Control are not synchronized to Microsoft 365. In addition, for synchronization with Microsoft 365, the email address is retrieved from Microsoft 365 and reflected in Access Control.
9. If you are already synchronizing users from Active Directory to Microsoft Entra ID, this procedure is not required.

Pre-checks

• For the domain to be synchronized, please change the domain of non-user objects.
  Change UPN of non-user objects to onmicrosoft.com domain

Procedure

1. From the Access Control Administration, go to Provisioning Settings.

   

2. From the Sync from Access Control menu, click + Add Service.

   

3. On the Select Sync Service screen, click the service you want to synchronize.
   If only [Entra ID] is displayed (such as during the initial sync), click [Entra ID].

   

   If the Use Saved Data menu is displayed, click the target tenant from Use Saved Data and proceed to step 6.
   *This menu appears if you have already completed step 5 ([Grant] for [Requested Permissions]).

   

4. The Microsoft 365 login screen will appear. Log in with a global administrator account.
5. The [Requested Permissions] screen will appear. Click [Grant].

6. Select the domain to synchronize, change the settings as needed, and click [Continue].

   • Domain
     Check the domain(s) to be synchronized.
   • User Deletion Threshold (%)
     If the percentage of users to be deleted exceeds the set threshold, the process will be canceled to prevent unintentional mass deletion of users.
     Example: If the User Deletion Threshold is set to 65%, the process will be canceled if more than 65% of users are to be deleted during synchronization.

   

7. The [Requested Permissions] screen will appear. Check [Consent on behalf of your organization] and select [Grant].
   *If this screen does not appear and you proceed to the next screen, authentication has already been completed. Please proceed to the next step.

   

8. Click [Start Sync Preview] for each target domain to output the expected user synchronization results.
   *If you have multiple domains, please run the sync preview for each domain.

   

9. Select [Download Result] and check the downloaded sync preview result (CSV file).
   *If you have multiple domains, please check the results for each domain.
   *The User Deletion Threshold is not applied to the sync preview, so the preview may show user deletions exceeding the threshold.

   

   Please be sure to check the sync preview results with reference to the following.

   If the sync results include unexpected Add, Delete, or Update users, click [Cancel], edit the user information as needed, and try again.
   If you have any questions, please contact your HENNGE representative or HENNGE One Technical Support.
   *The order of users in the output user list cannot be changed.
   *The output user list includes the Immutable ID for each user.

10. If there are no issues, click [Continue].

    

11. Select either [Set up Periodic Sync] or [Sync Now], and click [Execute].
    *It is recommended to perform a sync preview and Sync Now, confirm that the synchronization is as expected, and then configure periodic synchronization.

    • Sync Now
      Immediately synchronizes user information (Add, Delete, Update).
      *When you execute [Sync Now], user information (Add, Delete, Update) will be synchronized immediately and Microsoft 365 users will be updated.
      Please execute only after confirming that the sync preview results are as expected.
    • Set up Periodic Sync
      Synchronizes user information (Add, Delete, Update) from the sync source service to the sync destination service every hour.
    • About Synchronization (Add, Delete, Update)
      • Add: If a user exists only in the sync source service and not in the sync destination service, the user will be added to the sync destination service.
      • Delete: If a user does not exist in the sync source service but exists in the sync destination service, the user will be deleted from the sync destination service.
      • Update: If the same user exists in both the sync source and sync destination services, and there are differences in items such as family name, given name, or display name, the value in the sync destination service will be updated to match the sync source.

    

12. Click [Check Sync Logs] to confirm the synchronization results.
    *If you selected [Periodic Execution for Entra ID], synchronization will not be performed at the time periodic sync is enabled, so it will not appear in the sync logs.
    After enabling periodic sync, user information will be synchronized every hour and sync logs will be output.
    For details on how to check sync logs, please refer to the following article.
    [Access Control] How to check sync logs
    *Once you have confirmed that user synchronization has completed successfully, please be sure to contact your HENNGE One implementation representative or support desk.

    

If you are using multiple domains and want to configure user information for another domain later, please refer to the following procedure.
Add a domain for periodic user synchronization in Access Control (Access Control → Microsoft 365)