This is particular useful if you want all of your employees to use SSO and have non-license users in Entra ID for your frontline workers.
Enabling it for the client (same as SSO)
The functionality is enabled from the client list by adding a business email domain as shown below. For instance for SameSystem, the domain would be @samesystem.com.
When the feature is enabled, a new field will appear in the general tab for all employees called "Business email". This exists alongside the standard email field.
The standard email will still be used for all communication, while the business email purely will be for SSO and for employee sync.
SameSystem will automatically generate new business emails for each employee based on their first name and last name. And if there's duplicates, it'll add a number in the end. If the employee already have a company email in Entra ID, then it's possible for admins to overwrite the automated business email to that.
An employee named Lars Larsen from @samesystem.com would get the following email lars.larsen@samesystem.com. If there's two with identical names, the next one would be lars.larsen2@samesystem.com.
Enabling it in Entra ID
To enable it in Entra ID, you must find the Tenant ID in your Entra ID environment. Go to Entra ID (Also called "Identify" from Microsoft 365 Admin Center) and then to the overview and copy the ID as seen in the screenshot below.
Take this Tenant ID and add it to the following field in "Users"-tab in General settings.
Next you take the following link: https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=3fa78507-9b71-4fd5-8dcb-13132e247c0c.
Replace YOUR_TENANT_ID with the previously used Tenant ID and input it in the url of your browser and proceed. This will prompt a permission validation as seen below.
SameSystem uses both Application and Delegated permissions. SameSystem will use application permission to create, update and delete (not permanently) users in Entra ID. SameSystem cannot add licenses. Furthermore, SameSystem will use delegated permissions to reset password, which means that the user requesting a password reset must have the necessary permissions/accesses to do so in Entra ID.
After clicking accept, the user gets to an error message like the one below. This is currently intended and is because there's no redirect to another page.
To validate that the permissions have been given, go back to Entra ID and then to Applications -> Enteprise Applications. From here you should see an application called "SameSystem user sync" and an application ID, which should be identical to the one seen in general settings (see previous steps).
Enabling it on the titles
Final step is to enable it for the titles that must login through SSO. This is done through title-based settings and the tab called "Azure", as seen below. Enable the setting called "Azure AD user sync".
How it works
Now that everything is enabled, you'll see that newly created employees and updated employees in SameSystem will be pushed to Entra ID. Existing employees will not automatically be pushed to Entra ID.
The following fields are synchronised:
Name
Title
Department
Email
Phone
Welcome emails and password change
The logic around welcome emails and password changes depends on the configuration of SSO and Employee Sync.
SSO enabled + Employee Sync disabled:
No "Welcome" emails
No "Reset password" emails
Hides "Change password" for employee
Hides "Reset password" for manager
SSO enabled + Employee Sync enabled:
New "Welcome" email (contains business email and temporary password).
New "Reset password" email (contains temporary password).
Hides "Change password" for employee
Displays "Reset password" for manager
SSO disabled + Employee sync enabled:
Normal "Welcome" email
Normal "Reset password" emails
Displays "Change password" for employee
Displays "Reset password" for manager