Azure Entra ID AirSync Connector

This Article Describes Azure Entra ID Connector in DevRev

The Azure Entra ID AirSync connector imports identity and directory data from Microsoft Entra ID (formerly Azure Active Directory) into DevRev. It uses Microsoft Graph and supports an initial import followed by incremental syncs.

Data flows one-way from Microsoft Entra ID to DevRev. The connector does not create, update, or delete records in Microsoft Entra ID.

Supported data

The data available for import depends on the Microsoft Graph permissions granted to the application and your Microsoft Entra licenses.

Category	Supported data
Users and groups	Member and guest users, groups, and group memberships.
Roles	Directory roles and role memberships.
Applications	App registrations, service principals, application roles, and app role assignments.
Devices and contacts	Registered devices and organizational contacts.
Security and governance	User authentication methods, authentication methods policy, Conditional Access policies, eligible privileged roles, and lifecycle workflows.
Licenses and activity	License assignments, directory audit logs, and sign-in logs.
Custom attributes	User extension attributes, mapped to DevRev custom fields.

Importing user data is not the same as applying subsequent profile updates. See the FAQ at the end of this guide for incremental-sync limitations.

Prerequisites

Before you begin, ensure that you have:

Access to a Microsoft Entra ID organizational tenant.
Permission to register an application and an administrator who can grant tenant-wide consent for the required Microsoft Graph application permissions.
A DevRev organization with AirSync enabled and permission to install and configure the connector.
The licenses required for any optional data you want to import. Eligible privileged roles require Entra ID Premium P2; lifecycle workflows require Entra ID Governance.

The connector authenticates using OAuth 2.0 client credentials: a tenant ID, application client ID, and client secret. It does not require a user's interactive sign-in or a redirect URI.

Set up Microsoft Entra ID

1. Register an application

Sign in to the Azure portal.
Open Microsoft Entra ID > App registrations > New registration.
Enter a descriptive name, such as DevRev Azure Entra ID AirSync.
Select Accounts in this organizational directory only (Single tenant).
Leave Redirect URI blank and select Register.
On the application's Overview page, copy the Directory (tenant) ID and Application (client) ID.

2. Create a client secret

In the application registration, open Certificates & secrets > Client secrets.
Select New client secret.
Enter a description and choose an expiration period that follows your organization's security policy.
Select Add.
Copy the secret's Value immediately. Use the value, not the secret ID, when creating the DevRev connection.

Store the secret securely and rotate it before it expires. Do not include secrets in documentation, screenshots, or support requests.

3. Configure Microsoft Graph permissions

Open API permissions > Add a permission.
Select Microsoft Graph > Application permissions. Do not select delegated permissions.
Add the core permissions below.

Permission	Purpose
`User.Read.All`	Read users.
`Group.Read.All`	Read groups.
`GroupMember.Read.All`	Read group memberships.
`RoleManagement.Read.Directory`	Read directory roles and role memberships.
`Directory.Read.All`	Read directory data.

Add the following permissions only for the additional data you want to import.

Optional permission	Data enabled
`Application.Read.All`	Applications and service principals.
`Device.Read.All`	Registered devices.
`OrgContact.Read.All`	Organizational contacts.
`UserAuthenticationMethod.Read.All`	User authentication methods.
`Policy.Read.All`	Conditional Access policies and authentication methods policy.
`Organization.Read.All`	License information.
`AuditLog.Read.All`	Directory audit logs and sign-in logs.
`RoleEligibilitySchedule.Read.Directory`	Eligible privileged roles; requires Entra ID Premium P2.
`LifecycleWorkflows.Read.All`	Lifecycle workflows; requires Entra ID Governance.

Select Grant admin consent for [your organization] and confirm.
Verify that the required permissions show as Granted.

Administrator consent is required. Adding permissions without granting consent does not authorize the connector to read the data.

Install and connect in DevRev

Open the DevRev Marketplace and search for Azure Entra ID.
Open the listing and install the connector in your DevRev organization.
Go to Settings > Integrations > AirSyncs and start a new AirSync using Azure Entra ID.
Create a connection and enter the credentials from your application registration.

Connection field	What to enter
Connection name	A descriptive label, such as Production Entra ID.
Tenant ID / Subdomain	Your directory tenant ID or tenant domain, such as `contoso.onmicrosoft.com`.
Client ID	The application's Application (client) ID.
Client secret	The client secret Value.

Complete connection validation and save the connection.
Select the tenant data to import, review the available object and field mappings, and start the import.

For the general import workflow, see AirSync overview.

Run and manage syncs

Initial import

The initial import reads the selected data from your tenant and creates the mapped records in DevRev. The available data depends on the application's permissions and tenant licenses. Import duration varies with tenant size, selected data, and Microsoft Graph throttling.

Incremental sync

After the initial import, incremental syncs retrieve changes using Microsoft Graph delta queries where supported. Some data, such as activity logs, uses time-windowed queries instead.

Incremental sync supports group name and description changes, group membership additions and removals, and role membership changes. User profile updates and object deletions have the platform limitations described in the FAQ.

Periodic sync

To keep supported data updated automatically, open the import's menu in Settings > Integrations > AirSyncs and configure periodic sync from Microsoft Entra ID to DevRev. Choose a frequency appropriate to your data-freshness requirements and tenant size.

Review sync status and reports regularly. If you add another data category, grant its required permissions and administrator consent before syncing it.

Troubleshooting

Issue	What to check
Authentication fails	Verify the tenant ID, client ID, and client secret value. Check for extra spaces and an expired secret. If necessary, create a replacement secret and update the DevRev connection.
Permission denied or data is missing	Confirm that the required application permissions are present and administrator consent has been granted. Check the sync report for permission warnings.
Optional governance data is missing	Verify that the tenant has the required license: Premium P2 for eligible privileged roles or Entra ID Governance for lifecycle workflows.
Import is slow or appears stalled	Review sync progress and the report for errors or throttling. Initial imports of large tenants can take longer. Contact DevRev support if progress stops or failures persist.
User profile changes do not appear	See the user-profile limitation in the FAQ. Extracting a change does not mean AirSync can apply it to an existing DevRev user record.
Deleted Azure records remain in DevRev	This is an AirSync platform limitation. Deleting a source object does not delete its corresponding DevRev record.
Custom attributes are missing	Confirm that the extension attributes exist in Microsoft Entra ID and review their DevRev field mappings.

When contacting support, include the connection name, tenant ID, sync timestamp, error message, and whether the problem occurred during an initial or incremental sync. Do not share the client secret.

Frequently asked questions

Does this connector modify Microsoft Entra ID data?

No. The connector is read-only on the Microsoft Entra ID side. It imports data into DevRev and does not write changes back to Azure.

Can I connect multiple tenants?

Yes. Create a separate connection for each tenant, using that tenant's application registration and credentials.

Are guest users imported?

Yes. Both member users and guest users are included. User-level filtering is not currently supported by this connector.

What data is not imported?

The connector does not import user passwords, file attachments, documents, email content, calendar data, or Teams messages. Activity-log availability is limited by the source tenant's retention window.

Does incremental sync update groups and memberships?

Yes. On incremental sync, the connector supports:

Group name and description updates.
Group membership additions and removals.
Role membership changes.

Are user profile updates and object deletes supported?

Initial user import is supported, but the following changes are not applied because of AirSync platform limitations:

User profile updates: Changes to an existing DevRev user (devu) record's display name, full name, or email are not applied during incremental sync, even when the connector extracts the change from Microsoft Entra ID.
Object deletions: Deleting an object in Azure does not delete the corresponding object in DevRev.

Group membership removal is supported and is distinct from object deletion. Removing a user from a group can update the membership relationship without deleting the user or group record.

Was this article helpful?