Microsoft Entra
Microsoft Entra ID: provision users from ChartHop
The Microsoft Entra app keeps your Entra ID directory in sync with ChartHop. ChartHop is the source of truth. When someone joins, changes roles, leaves, or comes back, ChartHop updates their Entra account and group memberships for you.
The app sends data one way, from ChartHop to Entra. It reads your directory to match people and find what changed. The only thing it writes back to ChartHop is each person's Entra user ID, which it saves on their ChartHop profile so it can find them again on the next sync.
What the app does
When this happens in ChartHop | ChartHop does this in Entra |
|---|---|
A new person starts | Creates their Entra user with a temporary password they must change at first sign-in |
A mapped field changes (title, department, name, manager) | Updates only the fields that changed |
A person departs | Turns off sign-in for their account. The account stays in Entra. |
A former employee is rehired | Turns sign-in back on for their existing account |
A person starts or stops matching a group rule | Adds them to or removes them from that Entra group |
A manager is removed in ChartHop | Clears the manager in Entra |
Fields synced by default
ChartHop field | Entra field |
|---|---|
First name | givenName |
Last name | surname |
Preferred name | displayName (the name people see in Teams and Outlook) |
Title | jobTitle |
Department | department |
Manager | manager |
You can add your own mappings on top of these, for example ChartHop location to Entra officeLocation, or employee ID to employeeId. You can also turn off any default mapping you don't want.
How ChartHop matches people
The first time ChartHop syncs a person, it matches them to their Entra account by work email. It checks the Entra mail field first, then userPrincipalName (the sign-in name), so it can match people who don't have a mailbox yet.
Once it finds a match, ChartHop saves the person's Entra user ID on their ChartHop profile. Later syncs use that ID, so the match holds even if the person's email changes. If the saved ID no longer exists in Entra, ChartHop falls back to matching by email.
Managers are matched the same way. If someone's ChartHop manager doesn't have an Entra account, ChartHop leaves the manager blank in Entra and lists that person in the sync log.
Group rules
A group rule links a ChartHop filter to an Entra group. Anyone who matches the filter is added to the group, and anyone who stops matching is removed.
Examples:
- Everyone in the Engineering department goes into the Engineering group in Entra.
- is:manager goes into a Managers group.
- All active employees go into an All Employees group.
You pick groups from a dropdown that lists the groups in your Entra tenant, so you don't have to type group names. ChartHop only manages the groups you set up rules for. It leaves people's other group memberships alone.
Before you start
- You need Tech Owner access or higher in ChartHop.
- You need a Microsoft Entra Global Administrator to grant consent. ChartHop asks for consent once per tenant.
- People's work emails in ChartHop must match their mail or sign-in name in Entra.
Set up the app
Step 1: Install the app. In ChartHop, go to Apps, find Microsoft Entra, and click Install.
Step 2: Grant admin consent. Sign in with your Entra Global Administrator account and approve the permissions ChartHop requests. This connects ChartHop to your tenant. Nobody else has to sign in.
Step 3: Review field mappings. Check the default mappings and add any custom fields you want, like office location or employee ID.
Step 4: Add group rules. Choose an Entra group, then enter the ChartHop filter for who belongs in it.
Step 5: Run a dry run. Run Export dry run CSV to see every change ChartHop would make, without writing anything to Entra. Check the file before you continue.
Step 6: Test with one person. Before you turn on the daily sync, test with one test user. Go through the workflows you care about: create, update, depart, and rehire.
Step 7: Turn on the sync. Once the dry run looks right, turn on the scheduled sync. After that, ChartHop runs a full sync on schedule and also updates a person right away when their ChartHop record changes.
Sync settings
You choose which actions ChartHop takes:
- Create users: create Entra accounts for new people.
- Deactivate users: turn off sign-in when people depart.
- Reactivate users: turn sign-in back on for rehires.
- Days before start: how many days before a new hire's start date ChartHop creates their account, so it's ready on day one.
- Deactivate time: an optional time of day to turn off sign-in on a person's last day.
When departures take effect
- Involuntary departures: sign-in turns off on the person's end date.
- All other departures: sign-in turns off the day after the end date. If you set a deactivate time, it turns off at that time on the end date instead.
How the sync runs
- Scheduled full sync: compares everyone in ChartHop with your Entra directory and makes any updates needed.
- Change-based sync: when a person's record changes in ChartHop, ChartHop updates that person's Entra account and groups right away.
- CSV exports: Export CSV and Export dry run CSV show you the current state and the changes ChartHop would make.
Every request ChartHop sends to Microsoft shows up in the sync log. If Microsoft limits how fast ChartHop can send requests, ChartHop waits and retries automatically.
Hybrid tenants and on-premises Active Directory
Some organizations sync users from an on-premises Active Directory into Entra. Microsoft blocks cloud apps from editing those users, so ChartHop skips them. The sync log names each skipped person by email and Entra ID so you know why they weren't updated.
ChartHop still updates cloud-only users in the same tenant. To manage users who come from on-premises Active Directory, make the changes in Active Directory, or move those users to cloud-only accounts in Entra.
FAQ
Does the app import data from Entra into ChartHop? No. The app writes people data to Entra and saves only each person's Entra user ID back in ChartHop. To bring people data into ChartHop, use an HRIS integration, SFTP, or a CSV upload.
Does ChartHop delete Entra accounts when someone leaves? No. ChartHop turns off sign-in and keeps the account, so you can turn it back on if the person is rehired.
Is this the same as Microsoft SSO? No. Microsoft SSO lets people sign in to ChartHop with their Microsoft account. The Entra app creates and updates Entra accounts. You can use both.
What happens if I clear a field in ChartHop? ChartHop clears the matching field in Entra. Microsoft requires some fields, like display name and sign-in name, so ChartHop never clears those.