Entra ID Sync for Assets

Documentation · sellerkit

This walks through setting up the import in the order you will actually do it. It takes about five minutes, and most of that is Microsoft's consent screen.

Before you start

• Jira Service Management with Assets (Premium or Enterprise).
• You are a Jira administrator.
• Someone who can grant admin consent in your Microsoft Entra tenant. That is usually a Global Administrator or a Privileged Role Administrator. The permissions requested are read-only.

1. Create the import

In Jira go to Assets, open the object schema you want the users to land in, then Schema configuration → Import → Create import. Choose Microsoft Entra ID from the list, then Configure app.

2. Register an application in Microsoft Entra ID

This is the longest part and you only do it once. It takes about three minutes. You need a role that can grant admin consent — usually Global Administrator or Privileged Role Administrator.

a. Create the registration. In the Microsoft Entra admin centre go to Identity → Applications → App registrations and choose New registration.

• Name: anything you will recognise later, for example Jira Assets import.
• Supported account types: Accounts in this organizational directory only.
• Redirect URI: leave it empty. The app signs in as itself, so there is nowhere to redirect to.

Press Register. The overview page now shows Application (client) ID and Directory (tenant) ID. You will paste both into Jira.

b. Grant the two read-only permissions. In the registration, go to API permissions → Add a permission → Microsoft Graph → Application permissions. Tick exactly these:

• User.Read.All
• Group.Read.All

Then press Grant admin consent for <your tenant>. Both rows must show a green tick in the Status column. If they do not, the import will fail with an AADSTS error saying privileges are insufficient.

Choose Application permissions, not Delegated. Delegated permissions need a signed-in person, and the point of this app is that nobody is signed in at 02:00.

c. Create a client secret. Go to Certificates & secrets → Client secrets → New client secret, give it a description and an expiry, and press Add.

The table now shows two columns, Value and Secret ID, side by side. Copy the Value. It is the longer one and it is shown only once — leave the page and it is gone for good, and you will have to create another. If you paste the Secret ID by mistake, Jira will tell you so rather than failing later.

Note the expiry date. Microsoft will not warn you. When the secret expires the import starts failing, and the run log will say Microsoft refused the credentials (invalid_client). Create a new secret and paste it in again.

d. Paste the three values into Jira on the import configuration screen and press Connect. The connection is tested immediately, so you find out now rather than at 02:00 tomorrow.

3. Choose the attributes

Tick what should become an Assets attribute. Entra object ID is always included and cannot be unticked — it is what makes a person the same object on the next run rather than a new duplicate.

Ticking fewer attributes makes the import faster and asks Microsoft for less. You can change the list later; objects that already exist keep the attributes they already have.

4. Choose who comes across

Leave everything unticked to bring the whole tenant. Otherwise:

• Only accounts that are enabled — leaves out disabled accounts.
• Members only — leaves out guest accounts.
• Only these departments — one department per line.
• Advanced filter — a Microsoft Graph $filter, added to the above with AND. It is checked when you save: an unbalanced quote, or a property Graph cannot filter on without extra headers, is refused with the reason rather than failing later where you cannot see it.

5. Choose when it runs

Hourly, every six hours, daily or weekly. You pick the hour and, for weekly, the day. The minute is chosen for you, derived from the import itself, so that every customer who picked "daily at 02:00" does not call Microsoft on the same second and collect a rate limit each.

Choose Do not run automatically if you would rather press Import yourself.

6. Save, then import

Saving sends the attribute mapping to Assets, which is what enables the Import button. Press it once to see the first run; after that the schedule takes over.

Reading the run log

The configuration screen opens on the last run: how many were read from Entra, how many were written to Assets, and how many were skipped. Underneath, why.

Some notes you may see:

• "N users had no value for Account enabled." Microsoft returned nothing for that property. The attribute is left empty rather than guessed — an account that might be disabled is never written as enabled.
• "N records had no Entra object ID." Those cannot be matched to an Assets object and were skipped.
• "Entra did not return X for N users." That one is our bug, not your configuration. Please report it.

If a run fails

• Microsoft refused the credentials (invalid_client) — almost always an expired client secret. Create a new one in the Azure portal and paste it in again.
• Microsoft Graph refused the request (HTTP 403) — admin consent was not granted, or was later revoked, or the permissions were added as Delegated instead of Application. Check that both rows have a green tick.
• Microsoft Graph asked us to slow down — a rate limit. The run continues by itself; nothing is lost.
• Assets refused the data — usually the schema was changed by hand after the mapping was saved. Save the configuration again to resend it.

Turning it off

Set the schedule to Do not run automatically, or press Disconnect, or delete the import. Deleting removes the app's settings, run log and stored secret with it. Assets objects already created stay, because they are yours. Deleting the client secret or the whole application registration in Microsoft Entra stops any further reading immediately, whatever Jira thinks.