Supported directory types
RingSync currently supports two directory sources:
- Microsoft Entra ID (formerly Azure AD) — the primary supported platform with full delta sync support.
- Google Workspace — supported in the same onboarding flow; see the Google Workspace connection guide for specifics.
This article gives a general overview. For step-by-step Entra ID instructions, see Connecting Microsoft Entra ID.
Choose your connection mode (Entra ID only)
When connecting an Entra ID tenant, you select between two modes:
Shared mode (recommended) RingSync uses its own pre-registered multi-tenant app to access your directory. Your global admin clicks the Install RingSync button, completes the Microsoft admin-consent screen, and a Service Principal is created in your tenant automatically. No credentials are shared with RingSync.
Custom mode
You register your own Entra application and paste the Client ID and Client Secret into the RingSync wizard. Your app must be registered as multi-tenant (single-tenant apps are rejected). Required API permissions: User.Read.All, GroupMember.Read.All, Application.Read.All (all Application permissions, requiring admin consent).
App secrets registered in Entra expire (typically after 1 or 2 years depending on your policy). When the secret expires, all syncs for this directory will fail. See Token expired for recovery steps, and plan to rotate the secret before it expires.
Define the sync scope
After the directory is connected, open Settings in the back office to configure which users are synchronised:
- All users — every active, non-guest user in your Entra tenant with a valid email address is synchronised.
- Selected groups — only members of the Entra groups you specify are synchronised. Useful for large tenants where not everyone needs their contacts updated. (Requires Pro plan or above.)
- Excluded groups — regardless of the scope above, members of excluded groups are never synchronised. Useful to exclude service accounts or contractor groups. (Requires Pro plan or above.)
Guest users (userType == "Guest") are always excluded, regardless of scope. Disabled accounts are removed from phones during the next sync.
Run your first sync
- From the back-office Dashboard, confirm your directory appears with status Connected.
- Ask one of your enrolled users to open the RingSync mobile app.
- In the app, the directory appears as a card on the Directories screen. Tap the card to open it, then tap Sync now.
- The app fetches users via the RingSync proxy (no direct connection to Microsoft from the phone) and writes contacts to the device's native address book.
- Once complete, the card shows the number of contacts added, updated, and removed.
The first sync is always a full sync because no delta link exists yet. Subsequent syncs are incremental and much faster.
What gets synchronised
| Entra field | Native contact field |
|---|---|
givenName + surname | First and last name |
mail | Work email |
businessPhones[0] | Work phone |
mobilePhone | Mobile phone |
jobTitle | Title |
department | Department |
companyName | Company |
| Profile photo | Contact photo |
Users without a first name, last name, or email address are skipped automatically.
Next steps
- iOS install and permissions — enrol your first device.
- Sync scope and groups — advanced group filtering.