Synchronizing Users and User Groups using JIT Provisioning

JIT User and User Group synchronization leverages the Entra ID application that is entered for Secure Application Access. There are additional items that need to be configured to enable the correct APIs.

Use this task to synchronize users and user groups using Just-In-Time (JIT) provisioning.
  1. In the registered application, go to the Authentication section. Select ID tokens under Implicit grant and hybrid flows.
  2. Select Save.
  3. Under Token configuration select Add optional claim and select upn, family_name, and given_name.
  4. Select Add.
  5. If prompted, select the check box to turn on the Microsoft Graph profile permission and select Add.
  6. Select Add groups claim followed by Groups assigned to the application.
  7. Under ID section, select Group ID and select Add.
  8. Under API permissions select Add a permission.
  9. Select Microsoft Graph.
  10. Next, choose Application permissions. Under Select permissions:
    1. Filter on Group and select Group.Read.All.
    2. Filter on GroupMember and select GroupMember.Read.All.
    3. Filter on User and select User.Read.All.
    4. Click Add permissions to add them to the API permissions list.
  11. On the API permissions page, select Grant admin consent for <Company Name>.
  12. Under Overview, scroll to the bottom and select the Go to Enterprise Applications.
  13. Under Manage select Properties and set the Assignment Required option to Yes.
  14. Select Save.
  15. The final step in Entra ID is to assign Users and groups. Under Users and groups assign all groups that should be leveraged in Universal ZTNA.
  16. In Universal ZTNA, go to IAM > Identity Providers.
  17. Select the Sync Entra ID Users and User Groups option.
  18. Under Sync Users and User Groups select JIT (Just-in-time) from the Sync Using drop-down list.
  19. Select Validate.
9039102-00 Rev AA