> For the complete documentation index, see [llms.txt](https://docs.duplocloud.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duplocloud.com/docs/armor/access-control/azure-ad-okta-user-sync.md). # Azure AD & Okta User Sync User Sync provisions and deprovisions HelpDesk user accounts directly from your Azure AD or Okta directory, instead of an admin adding each [User](/docs/armor/access-control/users.md) by hand. {% hint style="info" %} This is distinct from **Microsoft SSO Login** — SSO controls how a user authenticates; User Sync controls whether their account and group membership exist in HelpDesk in the first place. They're independent features, though for Azure AD both happen to reuse the same app registration credentials. {% endhint %} ## How it works DuploCloud polls your directory on a timer rather than exposing an endpoint for your IdP to push to — it reads two specific group names from Azure AD (via Microsoft Graph) or Okta (via Okta's Groups API): * **`HelpDesk-Admin`** — members are synced in as HelpDesk Administrators * **`HelpDesk-UG-`** — members are synced in as regular Users, and added to a [User Group](/docs/armor/access-control/user-groups.md) named ``, which is created automatically the first time it's seen Each sync pass: * Creates an account for any group member not already in HelpDesk * Updates a synced user's role and group membership to match current directory group membership * Reactivates a previously-deactivated synced user if they reappear in a relevant group * Deactivates a synced user who's no longer in any relevant group — this is a deactivation, not a deletion; their account and history are preserved ## What this doesn't touch User Sync only manages accounts it created. A manually-created user is never modified or deactivated by sync, even if their email later shows up in one of the synced groups. In the Users list, an IdP-synced account shows a lock badge and can't be edited or deleted manually — to change a synced user's access, change their group membership in Azure AD/Okta instead. ## Setup There's no in-app screen for connecting a directory — enabling and configuring User Sync (tenant/client credentials for Azure AD, domain and API token for Okta, and the sync interval) is a deployment-time setting, done by your DuploCloud ops contact rather than from within the product. It's off by default. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.duplocloud.com/docs/armor/access-control/azure-ad-okta-user-sync.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.