You can have an organisation's employees created and updated automatically from the user administration they already keep themselves. That way you no longer need to import CSV files, and if someone disappears from the linked group, they are automatically set to inactive in 2LRN4.

There are two sources, and you choose per organisation which one to use:

• Microsoft Entra, for organisations that work with Microsoft 365. That is what the rest of this page is about.
• Google Workspace, for organisations that work with Google. That has its own page: Synchronising from Google Workspace.

You will find both in the platform under the same menu item, User synchronisation, at the organisation. What they do is the same: create and update employees, take over departments, and set employees who have left to inactive. They only differ in what the customer has to arrange on their side, and in which data comes along.

If an organisation works with neither, the CSV import remains available.

One rule applies to both: the synchronisation works one way. Changes flow from the customer's user administration to 2LRN4, never the other way around.

Synchronising with Microsoft Entra

The synchronization with Microsoft Entra synchronizes the following attributes: first name, last name, email address, login, department, manager, status (disabled), PreferredLanguage and Country.

Please note:

• Azure import is the basic level, which allows departments to be changed in the future using all available options.
• CSV import is the next level, which restricts department changes made via Azure import.
• Administrator assignment is the highest level, which blocks changes via imports entirely. If a department is assigned by an administrator, it cannot be modified via imports.

Instructions

Step-by-step instructions to synchronize 2LRN4 with your Microsoft Entra ID (via the User synchronisation menu).

• You need at least a Microsoft Azure Premium P1 license.
• If you create new departments, you still need to enroll them in the appropriate categories and courses.

1. Go to https://portal.azure.com/#home.
2. Click Microsoft Entra ID.
3. Create a security group in Microsoft Entra containing all users who need access to 2LRN4.

• Navigate to Groups and select New Group.
• Enter the group name and properties.
• Add one test user to verify the connection later.

1. Preferably create separate groups per role (e.g. admin, manager, user). Start with one user and expand later.
2. Return to Home and open More services.
3. Select Identity from the left-hand menu.
4. Open Enterprise applications and click New application.
5. Choose Create your own application, give the app a name, and select registration for Microsoft Entra ID.
6. Select Multitenant (accounts in any organizational directory) and register the app (leave Redirect URI empty).
7. Go to App registrations and open your newly created app.
8. Open Certificates and secrets and create a New client secret.
9. Copy the Secret value and store it securely (you will need it in 2LRN4).
10. Copy the Application (client) ID.
11. Add the required API permissions Degegate: User.Read.All, User.ReadBasic.All; Application: Directory.Read.All, GroupMember.Read.All, Group.Read.All-machtigingen) and grant Admin consent.
12. Assign the previously created security group under Users and groups in the Enterprise application.
13. Copy the Tenant ID from Microsoft Entra (you will need it in 2LRN4).
14. Go to https://portal.2lrn4.com and open User synchronisation. On this screen, Microsoft Entra and Google Workspace are listed one below the other, each with its own connections.
15. Under Microsoft Entra, create a new connection and enter the Tenant ID, Client ID and Client Secret.
16. First create a synchronisation schedule (see Scheduling Azure AD synchronization below), then test the connection via Users → Import from Azure AD. Since 3 August 2026 the import screen asks for an existing schedule.
17. Warning: do not synchronize the admin group as “users”. This may lower permissions and lock you out.

Scheduling Azure AD synchronization

1. Go to Synchronisation schedules and create or edit a schedule. At the top of the schedule screen there is now a Source option; for Entra, leave it set to Microsoft Entra and nothing else changes. Existing schedules are already set correctly.
2. Create a separate schedule for each security group you want to synchronize (and per connection if you use multiple connections).
3. Use the security group object ID as the Group ID, select the correct role and define the schedule.

Tip: schedule the admin group (customer/admin) last, for example 30 minutes after the other groups. This helps prevent and resolve permission conflicts.

Errors and solutions

Automatic deactivation when a user leaves the Entra group

Since 25 July 2026 the user synchronization with Entra (Azure AD) does two things. It adds and updates: new members of the linked security group get an account, and existing accounts are updated. And it cleans up: a user who is no longer a member of the group is set to inactive in 2LRN4. This way the LMS automatically keeps pace with your Entra administration and former employees no longer have access.

When is a user deactivated?

At the next scheduled synchronization, if the user:

1. was previously synchronized via that Entra group, and
2. is no longer a member of the group, and
3. is not a member of any other linked Entra group.

The user is then set to inactive and can no longer log in. The account itself remains; nothing is deleted.

When does it not happen?

• Manually created users that never came in through the synchronization are left untouched.
• 2LRN4 administrators and partner accounts are never deactivated by the synchronization.
• If the user is still a member of another linked group, the account simply remains active.
• To prevent mistakes, the synchronization skips the cleanup entirely when the retrieved member list is empty, when it contains nested groups, or when an unusually large part of the group would drop out at once. In those cases a message appears in the synchronization log and nothing happens.

How do you reactivate someone?

Set the user back to active manually via Users → edit, or add the person to the Entra group again; the account will then be picked up again at the next synchronization.

Good to know

• Deactivation does not happen the moment someone disappears from Entra, but at the next scheduled synchronization.
• After the integration is first set up, the very first synchronization serves as a baseline: no one is deactivated yet. The automatic cleanup starts from the second synchronization onwards.
• Every deactivation is recorded in the synchronization log, so it can be audited afterwards.

Reading the synchronisation status

The synchronisation schedule overview shows how each connection is doing:

• Last synchronisation shows when the connection last actually ran, including the result; on failure the reason is recorded as well.
• If a scheduled run lies well in the past, the label Overdue appears.
• The Access column shows whether the connection's client secret is still valid. An expired secret makes the synchronisation stop silently; renew the secret in Entra and update the connection.

A missed run is caught up automatically, and a daily check flags connections that no longer work or are behind.