Overview
Azure Active Directory (Microsoft Entra ID) Group Synchronization allows Custodia administrators to automatically assign Custodia Roles and Spend Profiles based on a user’s Azure group membership.
Once configured, Custodia will regularly synchronize Azure group memberships and automatically update user permissions, helping reduce manual administration and ensure access remains up to date.
Important: This feature is not included with all Custodia license levels. Please contact Custodia Support to confirm eligibility and enablement.
Prerequisites
Before configuring Azure Group Synchronization, Custodia must enable the following features for your tenant:
- Microsoft OAuth Provider
- Company/IDM Application Feature
To request enablement, contact Custodia Support at support@custodia.ai.
Step 1: Enable the Required Features
Contact Custodia Support and request Azure Group Synchronization.
The Custodia team will confirm that the following features have been enabled:
- Microsoft OAuth Provider
- Company/IDM Application Feature
Once enabled, proceed to the next step.
Step 2: Create or Verify the Azure Administrator User
Log in to Custodia as a Tenant Administrator.
Verify that the Azure Administrator has a corresponding Custodia user account using the same email address as their Microsoft account.
- If the user already exists in Custodia, proceed to Step 3.
- If the user does not exist, create the user before continuing.
Step 3: Connect Custodia to Azure
- Log in to Custodia using the Azure Administrator account.
Navigate to:
My Organization → Org Structure → Roles & Spend Profiles
Enable the option:
Synchronize Groups from Azure
- You will be redirected to Microsoft’s sign-in page.
- Sign in using your Azure Administrator credentials.
- Grant the requested permissions.
After successful authentication, you will be returned to Custodia.
A checked Synchronize Groups from Azure option confirms that the connection has been established successfully.
Step 4: Map Azure Groups to Custodia Profiles
Once connected, Custodia will display the Azure groups available within your organization.
Select the appropriate Custodia Role or Spend Profile for each Azure group.
Example
| Azure Group | Custodia Role / Profile |
|---|---|
| Client Success | Client Success |
| CloudOps | CloudOps |
Azure Groups:
Correlation with Custodia Profiles:
Step 5: Save and Allow Synchronization
After saving your mappings:
- Members of the Client Success Azure group will automatically receive the Client Success Custodia profile.
- Members of the CloudOps Azure group will automatically receive the CloudOps Custodia profile.
Custodia automatically synchronizes Azure group membership approximately every 30 minutes.
No manual action is required after configuration.
Verifying Synchronization
After the synchronization has completed:
- Open a user’s profile in Custodia.
- Review their assigned Roles and Spend Profiles.
- Confirm that the profile associated with their Azure group has been applied.
If changes were recently made in Azure, allow up to 30 minutes for the next synchronization cycle to complete.
Additional Notes
- Azure remains the source of truth for group membership.
- Changes made to Azure groups will automatically be reflected in Custodia during the next synchronization cycle.
- Removing a user from an Azure group will remove the associated Custodia profile during synchronization.
- Users must exist in Custodia before group synchronization can assign permissions.