Enter your search text in the box above

Select a result to preview

Azure-to-EasyVista-User-Sync

Azure (Entra ID) → EasyVista User Sync

Created: 2026-02-26
Author: Clawddy 🌀
Tags: #EasyVista #Azure #EntraID #ActiveDirectory #UserSync #Integration

Overview

This document covers all known options and best practices for syncing Azure AD (Microsoft Entra ID) users into EasyVista Service Manager's Employee Directory. The goal is to keep EasyVista employee records automatically populated and up-to-date from your authoritative source in Azure.

Option 1 — LDAP Pre-Import (Native EasyVista Integration)

What It Is

EasyVista's built-in integration path for importing Active Directory users into the Employee Directory. Works with on-premises AD or Azure AD via LDAP. This is the most native and fully supported option.

How It Works

  1. smoBackOfficeClient tool queries AD/LDAP on a schedule
  2. Data extracted into staging tables (E_LDAP_TEMP) in EVO_BACKOFFICE SQL database
  3. Normalization SQL scripts clean and filter the data
  4. Data moved to final E_LDAP_OK table
  5. Integration Models run to upsert into EasyVista Employee Directory

Key Requirements

Required Fields for Employee Import

An employee is only imported if ALL of these are present:

AD Attribute EasyVista Field Notes
Company Entity Required
sn Last Name Required
givenName First Name Required
sAMAccountName Login Required — unique ID

Full Attribute Mapping

AD Attribute EasyVista Field
sAMAccountName Login (unique key)
displayName Full Name
mail Email
telephoneNumber Phone
mobile Mobile
department Department
title Job
manager Manager Login
company Entity / Tenant
canonicalName Location Code
whenCreated Arrival Date
description Note
userPrincipalName UPN / Available Field

⚠️ Timestamps (lastLogon, accountExpires, etc.) are stored as Windows timestamp format. Use AD_DATE_CONVERT() SQL function to convert to standard date format.

Integration Models Needed

Model Option Connector
LDAP employees Insertion & Update Employee connector
LDAP employees - Managers Update only Employee connector

Scheduling

Can be fully automated via EasyVista's built-in integration scheduler. See: How to automate a Service Manager integration in EV docs.

✅ Best For

⚠️ Caveats

Option 2 — SAML 2.0 / SSO (Authentication Only)

What It Is

Azure AD configured as an Identity Provider (IdP) with EasyVista as the Service Provider. Enables login via Azure credentials — not a full user sync.

Supported Protocols

How It Works

Key Notes

✅ Best For

Option 3 — Power Automate / Logic Apps (Microsoft Graph API + EV REST API)

What It Is

An Azure-native automated workflow that:

  1. Queries Microsoft Graph API for all users in Entra ID
  2. Calls EasyVista REST API to create or update Employee records

Architecture

Entra ID / Graph API
    ↓ (scheduled trigger or event-based)
Power Automate / Logic Apps
    ↓ HTTP Action
EasyVista REST API (/api/v1/{account}/employees)

EasyVista REST API — Employee Endpoints

Method Endpoint Purpose
POST /api/v1/{account}/employees Create new employee
PUT /api/v1/{account}/employees/{id} Update existing employee
GET /api/v1/{account}/employees List employees

Auth: Basic auth (login:password) or Bearer token
Content-Type: application/json

Create/Update Payload Example:

{
  "last_name": "Smith",
  "first_name": "John",
  "login": "jsmith",
  "email": "jsmith@company.com",
  "phone": "555-1234",
  "department": "IT",
  "begin_of_contract": "01/01/2024"
}

Microsoft Graph API — Users Endpoint

GET https://graph.microsoft.com/v1.0/users
    ?$select=displayName,givenName,surname,mail,userPrincipalName,
             department,jobTitle,mobilePhone,businessPhones,
             accountEnabled,manager,companyName
    &$filter=accountEnabled eq true

Power Automate Flow Pattern

  1. Trigger: Recurrence (daily) or "When a user is added/modified" (event-driven)
  2. Action: HTTP — call Graph API /users with App Registration bearer token
  3. Loop: For each user:
    • Check if employee exists in EV (GET by login/UPN)
    • If exists: PUT to update
    • If not: POST to create
  4. Error handling: Log failures to a SharePoint list or email

App Registration Required

✅ Best For

⚠️ Caveats

Option 4 — Custom Script / PowerShell (Graph API + EV REST API)

What It Is

A scheduled PowerShell script (or Python, etc.) that replicates the Power Automate logic without the Microsoft licensing dependency.

Pattern

# 1. Get Azure AD token
$token = Get-MSGraphToken -TenantId $tenantId -ClientId $appId -ClientSecret $secret

# 2. Get all enabled users from Graph API
$users = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users?`$filter=accountEnabled eq true&`$select=displayName,givenName,surname,mail,userPrincipalName,department,jobTitle" -Headers @{Authorization = "Bearer $token"}

# 3. For each user, upsert to EasyVista
foreach ($user in $users.value) {
    $body = @{
        last_name  = $user.surname
        first_name = $user.givenName
        login      = $user.userPrincipalName
        email      = $user.mail
        department = $user.department
    } | ConvertTo-Json

    Invoke-RestMethod -Method POST -Uri "https://{ev_host}/api/v1/{account}/employees" `
        -Headers @{Authorization = "Basic {base64creds}"} `
        -Body $body -ContentType "application/json"
}

Scheduling Options

✅ Best For

Option 5 — Third-Party iPaaS (MuleSoft, Workato, etc.)

What It Is

Use an integration platform as a service to create a pre-built or custom connector between Azure AD and EasyVista.

Platforms with EasyVista Connectors

✅ Best For

⚠️ Caveats

Comparison Matrix

Option Complexity Cloud-Only Azure Real-Time Native EV Cost
LDAP Pre-Import Medium ⚠️ Needs AADDS No (scheduled) ✅ Yes Included
SAML SSO Low ✅ Yes N/A (auth only) ✅ Yes Included
Power Automate Low-Medium ✅ Yes ✅ Optional Via connector Premium license
PowerShell/Script Medium ✅ Yes Scheduled REST API Free
iPaaS Low ✅ Yes ✅ Optional Via connector $$

Recommended: Option 3 or 4 (Power Automate OR PowerShell via Azure Automation)

Given:

Best combo:

  1. SAML SSO — For authentication (users log into EV with Azure credentials, MFA enforced)
  2. PowerShell via Azure Automation OR Power Automate — For user record provisioning (daily sync, filter enabled accounts only)
  3. LDAP Pre-Import — If an on-prem AD or AADDS is available, this is the most native path

Sync Cadence: Daily full sync + event-driven delta (new hire / termination triggers)

Best Practices

Data Quality

Security

Conflict Handling

Deprovisioning

Testing

Monitoring

References