What this connection does
Personnel onboarding syncs your Microsoft 365 directory into iCompaas so you can track who has access, who is an admin, and each person's MFA posture — evidence your auditors ask for. Authorisation happens on Microsoft's own sign-in screen with read-only Graph scopes (User.Read.All, UserAuthenticationMethod.Read.All, Directory.Read.All, Policy.Read.All); iCompaas never sees your password and never gets write access.
Connect the source
- In the app, open Onboarding → Personnel onboarding and click Add source → Microsoft 365.
- Enter a Source label (3–60 characters, e.g. Engineering Directory) — a friendly name to identify this source in your dashboard.
- Click Save & authorize. An authorization popup opens — allow pop-ups from the iCompaas site if your browser asks.
- Pick the Microsoft account to sign in with and approve the requested read permissions. If your organisation requires admin consent for Graph directory access, sign in as (or ask) a Global Administrator.
- Personnel sync begins automatically — the source moves from Awaiting auth to Syncing and then Synced.
What gets synced
Names, primary and recovery email, phone number, admin status, 2FA enabled/enforced flags, suspension state and employment type. Use View personnel list to see the synced people.
Managing the source
- Sync now — trigger a manual re-sync from the source's row actions.
- Edit — only the label can be changed. To re-authorize, remove the source and add it again.
- Remove — stops future syncs; existing personnel data remains until the next sync cycle.
Troubleshooting
- "Popup was blocked" — allow pop-ups for the iCompaas site and click Save & authorize again.
- "Need admin approval" during Microsoft sign-in — your tenant requires admin consent for directory read scopes; complete the authorization with a Global Administrator account.
- "Microsoft OAuth configuration missing" — contact support; this is a configuration issue on our side, not yours.