The synchronization with Microsoft Entra synchronizes the following attributes: first name, last name, email address, login, department, manager, status (disabled), PreferredLanguage and Country. The synchronization works one-way only: from Microsoft Entra to 2LRN4 (not the other way around).

Please note:

• Azure import is the basic level, which allows departments to be changed in the future using all available options.
• CSV import is the next level, which restricts department changes made via Azure import.
• Administrator assignment is the highest level, which blocks changes via imports entirely. If a department is assigned by an administrator, it cannot be modified via imports.

Instructions

Step-by-step instructions to synchronize 2LRN4 with your Microsoft Entra ID (via the Azure Graph menu).

• You need at least a Microsoft Azure Premium P1 license.
• If you create new departments, you still need to enroll them in the appropriate categories and courses.

1. Go to https://portal.azure.com/#home.
2. Click Microsoft Entra ID.
3. Create a security group in Microsoft Entra containing all users who need access to 2LRN4.

• Navigate to Groups and select New Group.
• Enter the group name and properties.
• Add one test user to verify the connection later.

1. Preferably create separate groups per role (e.g. admin, manager, user). Start with one user and expand later.
2. Return to Home and open More services.
3. Select Identity from the left-hand menu.
4. Open Enterprise applications and click New application.
5. Choose Create your own application, give the app a name, and select registration for Microsoft Entra ID.
6. Select Multitenant (accounts in any organizational directory) and register the app (leave Redirect URI empty).
7. Go to App registrations and open your newly created app.
8. Open Certificates and secrets and create a New client secret.
9. Copy the Secret value and store it securely (you will need it in 2LRN4).
10. Copy the Application (client) ID.
11. Add the required API permissions Degegate: User.Read.All, User.ReadBasic.All; Application: Directory.Read.All, GroupMember.Read.All, Group.Read.All-machtigingen) and grant Admin consent.
12. Assign the previously created security group under Users and groups in the Enterprise application.
13. Copy the Tenant ID from Microsoft Entra (you will need it in 2LRN4).
14. Go to https://portal.2lrn4.com and open Azure Graph.
15. Create a new Azure Graph configuration and enter the Tenant ID, Client ID and Client Secret.
16. Test the synchronization via Users → Import from Azure AD.
17. Warning: do not synchronize the admin group as “users”. This may lower permissions and lock you out.

Scheduling Azure AD synchronization

1. Go to Azure Graph Schedules and create or edit a schedule.
2. Create a separate schedule for each security group you want to synchronize (and per connection if you use multiple connections).
3. Use the security group object ID as the Group ID, select the correct role and define the schedule.

Tip: schedule the admin group (customer/admin) last, for example 30 minutes after the other groups. This helps prevent and resolve permission conflicts.

Errors and solutions

• Error messagePossible solutionInvalid_client / unauthorized_clientMost likely the Secret ID was copied instead of the Secret value. Create a new client secret and use the secret value.These users cannot be imported: invalid_clientCheck whether the token (client secret) is still valid and whether the Group ID is correct.Error 504 Gateway Time-outCheck whether the token is still valid and try again.Azure client errorVerify that the correct Application permissions have been added and that admin consent has been granted.Error 403: Action unauthorizedYou may have locked yourself out by synchronizing the wrong group with the wrong role. Contact support and use scheduled synchronizations.User(s) are not synchronizedCheck that the user has a unique email address and is a member of the synchronized security group.Disabled status is not synchronizedVerify that the user is disabled in AD, has a unique email address, and is a member of the security group.Synchronization is not executedAfter creating or modifying a schedule, it can take up to 24 hours before it runs.Accounts are not removed after synchronizationAccounts are never deleted. However, since 25 July 2026 a user who is no longer in the linked security group is automatically set to inactive; see the section 'Automatic deactivation when a user leaves the Entra group' below.Departments are not synchronizedAzure import is the basic level.
• CSV import restricts changes originating from Azure import.
• Administrator assignment or CSV import blocks changes via Azure import.

Automatic deactivation when a user leaves the Entra group

Since 25 July 2026 the user synchronization with Entra (Azure AD) does two things. It adds and updates: new members of the linked security group get an account, and existing accounts are updated. And it cleans up: a user who is no longer a member of the group is set to inactive in 2LRN4. This way the LMS automatically keeps pace with your Entra administration and former employees no longer have access.

When is a user deactivated?

At the next scheduled synchronization, if the user:

1. was previously synchronized via that Entra group, and
2. is no longer a member of the group, and
3. is not a member of any other linked Entra group.

The user is then set to inactive and can no longer log in. The account itself remains; nothing is deleted.

When does it not happen?

• Manually created users that never came in through the synchronization are left untouched.
• 2LRN4 administrators and partner accounts are never deactivated by the synchronization.
• If the user is still a member of another linked group, the account simply remains active.
• To prevent mistakes, the synchronization skips the cleanup entirely when the retrieved member list is empty, when it contains nested groups, or when an unusually large part of the group would drop out at once. In those cases a message appears in the synchronization log and nothing happens.

How do you reactivate someone?

Set the user back to active manually via Users → edit, or add the person to the Entra group again; the account will then be picked up again at the next synchronization.

Good to know

• Deactivation does not happen the moment someone disappears from Entra, but at the next scheduled synchronization.
• After the integration is first set up, the very first synchronization serves as a baseline: no one is deactivated yet. The automatic cleanup starts from the second synchronization onwards.
• Every deactivation is recorded in the synchronization log, so it can be audited afterwards.