# Connecting Microsoft 365 to iCompaas

- Source: https://support.icompaas.com/support/solutions/articles/onb_personnel_m365-connecting-microsoft-365-to-icompaas
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Getting Started With iCompaas](https://support.icompaas.com/support/solutions/62000037934) › [Personnel Onboarding](https://support.icompaas.com/support/solutions/folders/personnel-onboarding)
- Last updated: 2026-07-15
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Estimated time: 5 minutes · requires: a Microsoft account that can consent to directory read permissions (typically a Global Administrator)

### What this connection does

Personnel onboarding syncs your Microsoft 365 directory into iCompaas so you can track who has access, who is an admin, and each person's MFA posture — evidence your auditors ask for. Authorisation happens on Microsoft's own sign-in screen with read-only Graph scopes (`User.Read.All`, `UserAuthenticationMethod.Read.All`, `Directory.Read.All`, `Policy.Read.All`); iCompaas never sees your password and never gets write access.

### Connect the source

1.  In the app, open _Onboarding → Personnel onboarding_ and click **Add source → Microsoft 365**.
2.  Enter a **Source label** (3–60 characters, e.g. _Engineering Directory_) — a friendly name to identify this source in your dashboard.
3.  Click **Save & authorize**. An authorization popup opens — **allow pop-ups from the iCompaas site** if your browser asks.
4.  Pick the Microsoft account to sign in with and approve the requested read permissions. If your organisation requires admin consent for Graph directory access, sign in as (or ask) a Global Administrator.
5.  Personnel sync begins automatically — the source moves from _Awaiting auth_ to _Syncing_ and then _Synced_.

### What gets synced

Names, primary and recovery email, phone number, admin status, 2FA enabled/enforced flags, suspension state and employment type. Use _View personnel list_ to see the synced people.

### Managing the source

-   **Sync now** — trigger a manual re-sync from the source's row actions.
-   **Edit** — only the label can be changed. To re-authorize, remove the source and add it again.
-   **Remove** — stops future syncs; existing personnel data remains until the next sync cycle.

### Troubleshooting

-   **"Popup was blocked"** — allow pop-ups for the iCompaas site and click _Save & authorize_ again.
-   **"Need admin approval" during Microsoft sign-in** — your tenant requires admin consent for directory read scopes; complete the authorization with a Global Administrator account.
-   **"Microsoft OAuth configuration missing"** — contact support; this is a configuration issue on our side, not yours.