Sync with Office 365

This describes how to set up Foxpass to sync your directory with Office 365.

Authorize your Foxpass account with Office 365

Go to the Foxpass 'Sync' page. Click on the "Office 365" tab. Choose 'Yes' from one of the dropdown menus, then click the "Authorize Account" button. Office 365 will then ask for offline access to your data, which Foxpass needs to access the directory data. Click "Accept" and you will be redirected to Foxpass. If you see a green checkmark at the top of the page, your credentials are good to go.

📘

A Note about Admin Permissions

Foxpass needs a specific set of Office 365 Administrator permissions in order to sync. A Global admin role works best, but you'd like to assign a minimal set of roles you can assign the Cloud application admin and User admin roles in tandem.

We recommend adding a second set of credentials as a back up in case the first set fails. This can happen when the administrator who authorized the sync leaves the company and has their Office 365 account disabled. You can authorize another set of credentials by having another administrator log into Foxpass and click the "Authorize Account for Sync" button.

If you have Azure Conditional Access policies enabled, make sure that they allow requests from Foxpass's servers.

Note: Make Sure Your Groups Are Ready For Sync

Groups created in Azure AD won't sync from Microsoft's Graph API. Additionally, groups without an email (like Security groups) do not sync with Foxpass by default. Read this documentation to learn more about the different types of Office 365 groups.

If you're not sure if your groups will work for sync, use the "all groups in my organization" endpoint in the Groups section of the Microsoft graph API explorer to see if the group is both returned from the API endpoint and has a mailing address associated with it.

If you would like to sync Security groups or other Office 365 groups that do not have an email associated with them, enable the Sync Groups Without Emails feature on the Sync page after configuring Group Sync.

Optional: Enable Group Sync Allowed list

If you have group sync enabled, you can have allowed list of groups, which get imported during sync. This is useful for organizations that only want to import a subset of their groups used in Foxpass. Once group sync is enabled, you'll see a field to add any group prefixes for adding to allowed list. During the group sync process, any groups that do not begin with that prefix are not synced with Foxpass.

Optional: Enable Allowed User list via Group Membership

If you have group sync enabled, you can add allowed users that belong to specific groups. This is useful for organizations that only want a subset of their directory to have access to Foxpass. Once group sync is enabled, you'll see a field to mark any groups which are allowed. During the group sync process, any users that are not a member of one of those groups are automatically marked as "inactive."

Optional: Enable Non Allowed User list via Group Membership

If you have group sync enabled, you can have a list of non allowed users that belong to specific groups. This is useful for organizations that have a large number of machine or role accounts that don't need access to Foxpass. Once group sync is enabled, you'll see a field to mark any groups to be ignored from syncing. During the group sync process, any users that are a member of one of those groups are automatically marked as "inactive."