[Access Control] User Sync Settings (Microsoft Entra ID → Access Control)

Overview

• This article explains the procedure for Access Control administrators to manually or periodically synchronize user information from Microsoft Entra ID to Access Control.

Notes

1. The content of this article is based on the product specifications as of October 2026 and is subject to change without notice.
2. To configure user synchronization, you need Access Control global administrator privileges and Microsoft 365 global administrator privileges.
3. For instructions on how to access the Administration, please refer to the following article.
   How to Access the HENNGE One Access Control Administration
4. User synchronization must be configured for each domain.
5. Before performing user synchronization, you must register the required users in Microsoft Entra ID.
6. Passwords from Microsoft Entra ID are not synchronized to Access Control.
   After user synchronization is complete, be sure to set the initial password on the Access Control side.
7. Once periodic synchronization is enabled, user information will be synchronized every 1 hour.
   * The synchronization interval cannot be changed.
8. If you are already synchronizing users from Active Directory to Access Control, this procedure is not required.

Pre-checks

• For the domain to be synchronized, change the domain of non-user objects.
  Change UPN of non-user objects to onmicrosoft.com domain

Procedure 

1. From the Access Control Administration, go to [Provisioning Settings].

   

2. In the [Sync from Cloud Service] menu, select [+ Add Service].

   

3. On the Select Sync Service screen, select [Entra ID].

   

   If the [Use Saved Data] menu is displayed, select [Use Saved Data] and proceed to step 6.
   * This menu appears if you have already completed step 5, [Grant Required Permissions].

   

4. The Microsoft 365 login screen will appear. Log in with a global administrator account.
5. When the [Required Permissions] screen appears, select [Accept].
6. Check the domains to be synchronized, configure UPN Mode and User Deletion Tolerance, then click [Continue].
   • Domain
     Check the domains you want to synchronize.
   • User Deletion Tolerance
     If a user deletion process exceeding the set percentage is attempted, the process will be canceled to prevent unintentional mass deletion of users.
     Example: If the User Deletion Tolerance is set to 65%, the process will be canceled if 65% or more of all users would be deleted during synchronization.

   • UPN Mode
     Depending on the setting, the value set as the Access Control username will change.
     * The Access Control username cannot be changed later.

     [When UPN Mode is enabled]
     The UserPrincipalName attribute in Microsoft Entra ID will be synchronized as the Access Control username.
     Example: If the user's UserPrincipalName attribute is "user@example.com", the username will be "user@example.com".
     [When UPN Mode is disabled]
     The value before the "@" in the UserPrincipalName attribute in Microsoft Entra ID will be synchronized as the Access Control username.
     Example: If the user's UserPrincipalName attribute is "user@example.com", the username will be "user".

     

7. When the [Required Permissions] screen appears, check [Consent on behalf of your organization] and select [Accept].
   * If you proceed to the next screen without this screen appearing, authentication has already been completed. Please proceed to the next step.

   

8. For each target domain, click [Start Sync Preview] to output the expected user synchronization results.
   * If you have multiple domains, perform the sync preview for each domain.

   

9. Select [Download Result] and check the downloaded sync preview result (csv file).
   * If you have multiple domains, check the results for each domain.
   * User Deletion Tolerance is not applied to the sync preview, so the preview may show user deletions exceeding the tolerance.

   

   Please be sure to check the sync preview results as follows.
   If there are unexpected Add, Delete, or Update users in the sync results, click [Cancel], edit the user information as needed, and try again.
   If you have any questions, please contact your HENNGE One onboarding representative.
   * The order of the user list in the sync preview output cannot be changed.
   * The rightmost column of the output user list displays the Immutable ID for each user.

10. If there are no issues, click [Continue].

    

11. Select [Set Up Periodic Sync] or [Sync Now], review the displayed notes, and if there are no issues, check the checkbox and click [Execute].
    * We recommend enabling periodic sync only after running the sync preview and Sync Now to confirm that synchronization works as expected.

    Sync Now
    Immediately synchronizes user information (Add, Delete, Update).
    * When you execute [Sync Now], user information (Add, Delete, Update) will be synchronized immediately, and users in HENNGE Access Control will be updated.
    Be sure to confirm that the sync preview results are as expected before executing.

    Set Up Periodic Sync
    Enables periodic synchronization of user information (Add, Delete, Update) from the source service to the destination service every 1 hour.

    About Synchronization (Add, Delete, Update)

    • Add: If a user exists only in the source service and not in the destination service, the user will be added to the destination service.
    • Delete: If a user does not exist in the source service but exists in the destination service, the user will be deleted from the destination service.
    • Update: If the same user exists in both the source and destination services and there are differences in items such as family name or display name, the value in the destination service will be updated to match the source.

    

12. Click [Check Sync Logs] to review the synchronization results.
    * If you selected [Set Up Periodic Sync], synchronization will not be performed immediately upon enabling periodic sync, so it will not appear in the sync logs right away.
    After enabling periodic sync, user information will be synchronized every 1 hour and sync logs will be output.
    For details on how to check the sync logs, please refer to the following article.
    [Access Control] How to Check Sync Logs

    

13. Set the initial password for each user in Access Control.
    Passwords from Microsoft Entra ID are not synchronized to Access Control for users created via user synchronization.
    Therefore, after synchronization is complete, the administrator must set the initial password in Access Control.
    * Users cannot log in to Access Control until a password is set.
    For instructions on how to set passwords, please refer to the following article.
    [Access Control] Bulk Update Users