Configure my Entra tenant

Overview

RingSync reads your Microsoft Entra ID directory through Microsoft Graph using an application authorization (client_credentials) executed server-side. You connect your tenant in one of two modes:

Shared (recommended, ~30 seconds) — one-click admin consent on RingSync's multi-tenant app. Nothing to register on your side, no secret to handle.
Custom (~10 minutes) — you register your own multi-tenant Entra app and paste its client ID and secret into the RingSync wizard. Recommended for organizations with strict SecOps policies that want to own the client ID and secret.

Which mode should I pick?

Pick Shared unless your security policy requires you to own the app registration and its secret. Both modes use the exact same Graph permissions and both enforce that only assigned users can sign in.

Prerequisites

A Global Administrator role in the Entra tenant (required to grant admin consent).
A RingSync back-office account.
For Custom mode: the ability to register an app and create a client secret in the Entra portal.

Multi-tenant is mandatory in Custom mode

In Custom mode the app you register must be multi-tenant ("Accounts in any organizational directory"). RingSync rejects single-tenant apps during onboarding.

Graph permissions used (both modes)

RingSync requests these Application permissions, which require admin consent:

Permission	Type	Why
`User.Read.All`	Application	Read the full user directory
`GroupMember.Read.All`	Application	Resolve transitive Entra group membership
`Application.Read.All`	Application	Read `appRoleAssignedTo` (who may use the app) and app metadata to validate the sign-in audience

See Graph permissions for the full rationale, auditing and revocation.

Mode A — Shared (recommended)

1. Request the installation

In the RingSync dashboard, click Install RingSync on my tenant. You are redirected to the Microsoft admin-consent screen.

The Microsoft screen lists the permissions being requested:

openid profile email (delegated) — used for the mobile login.
User.Read.All, GroupMember.Read.All, Application.Read.All (application) — used by RingSync to synchronize the directory.

Click Accept. A Service Principal for the RingSync app is created in your tenant, and you are redirected back to RingSync, which finishes the configuration automatically — including setting appRoleAssignmentRequired = true on the service principal.

3. Complete the tenant name

In the finalization wizard, enter the name shown to users on mobile (for example, your company name). That's it.

Mode B — Custom

1. Register the RingSync app in your tenant

Open the Azure portal → Microsoft Entra ID → App registrations → New registration.
Set Name to RingSync.
Set Supported account types to Accounts in any organizational directory (Multi-tenant).
Leave Redirect URI empty (the mobile app uses RingSync's own identity app, not this one).
Click Register.

Note the Application (client) ID and the Directory (tenant) ID.

Do not choose single-tenant

If you select a single-tenant account type, onboarding will be refused. The app must be multi-tenant.

2. Grant the Microsoft Graph permissions

In the app, go to API permissions → Add a permission → Microsoft Graph → Application permissions.
Add:
- User.Read.All
- GroupMember.Read.All
- Application.Read.All
Click Grant admin consent for <your tenant> and confirm.

3. Create a client secret

Go to Certificates & secrets → New client secret.
Set a description (RingSync) and an expiration of 24 months (the maximum).
Copy the secret Value immediately — it is shown only once.

Secret expiration

A client secret expires. When it does, Graph calls fail and sync stops. Note the expiry date and rotate the secret before then by creating a new one and re-pasting it in the wizard. Automatic rotation of custom secrets is not available in v1.

4. Enter the configuration in RingSync

In the RingSync dashboard, choose Manual configuration (Custom) and paste:

Directory (tenant) ID
Application (client) ID
Client secret value

RingSync validates the configuration by calling Graph, stores the secret encrypted in its vault, sets appRoleAssignmentRequired = true on the service principal, and runs a first pull of appRoleAssignedTo.

Authorize the users who may use RingSync (both modes)

Only users assigned to the RingSync enterprise application can sign in — Entra issues a token only to assigned users thanks to appRoleAssignmentRequired = true.

In the Azure portal, go to Enterprise applications → RingSync → Users and groups.
Click Add user/group and select individual users, or an Entra group (Microsoft 365 or Security).
Click Assign.

RingSync discovers these assignments through a background pull every 15 minutes. To pull immediately, click Refresh on the Users page of the RingSync dashboard.

Group-based assignment vs group filtering

Assigning a group here controls who may use the app. Choosing which groups' members are actually synced to phones (or excluded) is a separate, Pro and above feature — see Group selection & exclusion.

Verify the connection

In Enterprise applications → RingSync → Properties, confirm Assignment required? is Yes.
In the RingSync Users page, confirm your assigned users appear in the directory grants list after a refresh.
From a phone with an assigned account, open the mobile app, tap Continue with Microsoft, and confirm the directory appears and a first sync succeeds.

Troubleshooting

A user can't sign in / sees no directory — they are not assigned to the RingSync enterprise app, or the assignment pull hasn't run yet. Assign them and click Refresh.
Onboarding refused in Custom mode — the registered app is single-tenant. Re-register it as multi-tenant.
Sync stops working after months — the custom client secret likely expired. Create a new secret and re-enter it in the wizard.
Permissions look insufficient — confirm admin consent was granted for all three application permissions (not just added). See Graph permissions.

Was this page useful?

Report what is missing →

← Previous

Deploy the app

Graph permissions