> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/getting-started/08-connect-target-system.md).

# Step 7 — Connect a Target System

Connect the Microsoft Entra ID or Active Directory tenant that AOH Sync provisions identities into. Adding a Target System automatically creates an Identity Ingestion connector that reads your directory's current state. (\~10 minutes)

{% stepper %}
{% step %}
**Open Target Systems and start the wizard**

Navigate to **Target Systems** in the left sidebar. Click **+ Add Target System**. The setup wizard opens at **Step 1 of 4**.

![Add Target System wizard Step 1 of 4, showing two selectable cards — Entra ID (cloud-only) and Active Directory (hybrid) — plus a Search Microsoft gallery field and a Provider template dropdown defaulting to Custom SCIM](/files/foRlPVRozFmfPXHIO7xQ)

*Step 1 of 4: choose your provisioning topology. Use the Search Microsoft gallery field to find a vendor template (Workday, BambooHR, ServiceNow, and others) if needed. The Provider template defaults to Custom SCIM.*

Choose one of the two provisioning topologies:

* **Entra ID (cloud-only)** — provision identities directly into Microsoft Entra ID. No on-premises agent is required. Choose this option if your organisation manages identities entirely in the cloud.
* **Active Directory (hybrid)** — provision identities into an on-premises Active Directory domain via a provisioning agent. Choose this option if you have an on-premises AD environment that must remain the authoritative directory.

Optionally use the **Search Microsoft gallery** field to find a vendor provider template, or leave **Provider template** at the default **Custom SCIM** for generic API-driven inbound provisioning. Click **Next** when ready.
{% endstep %}

{% step %}
**Complete the Azure setup checklist**

**Step 2 of 4** shows the Azure setup checklist. Work through each item in the Azure Portal before continuing:

1. Create an **Enterprise Application** in your Entra ID tenant for AOH Sync provisioning.
2. In the Enterprise Application, open **Provisioning** and set **Provisioning Mode** to **Automatic**.
3. Under **Admin Credentials**, create a **Client Secret** for AOH Sync to authenticate.
4. Grant the following Microsoft Graph permissions to the Enterprise Application (these are provisioning permissions, separate from the sign-in App Registration you created in Step 1 of Getting Started):

| Permission                        | Purpose                           |
| --------------------------------- | --------------------------------- |
| `AuditLog.Read.All`               | Read audit log entries            |
| `Directory.Read.All`              | Read directory data               |
| `Group.ReadWrite.All`             | Manage group memberships          |
| `Synchronization.ReadWrite.All`   | Manage provisioning configuration |
| `SynchronizationData-User.Upload` | Upload user provisioning data     |
| `User.Read.All`                   | Read all user profiles            |
| `User.ReadWrite.All`              | Create and update user accounts   |

![Add Target System wizard Step 2 of 4 showing the Azure setup checklist with numbered items for creating an Enterprise Application, configuring Inbound Provisioning, creating a Client Secret, and granting Microsoft Graph permissions](/files/HMQZftWPA1647TAgE9up)

*The wizard provides a Full Microsoft guide link for detailed Azure Portal instructions at each checklist item.*
{% endstep %}

{% step %}
**Enter the Enterprise Application credentials**

**Step 3 of 4**: enter the credentials from the Enterprise Application you just configured, then click **Add Target System**.

![Add Target System wizard Step 3 of 4 showing credential fields — Display Name, Tenant ID, Client ID, Client Secret, Region, and optional Sync Schedule](/files/ETdvMvl8tnCnLJv53h43)

*Enter the Display Name, Tenant ID, Client ID, and Client Secret from your Enterprise Application. Optionally set a Region and a Sync Schedule.*

| Field             | Where to find it                                                 |
| ----------------- | ---------------------------------------------------------------- |
| **Display Name**  | A friendly name for this target in AOH Sync                      |
| **Tenant ID**     | Your Entra ID tenant's Directory (tenant) ID in the Azure Portal |
| **Client ID**     | The Application (client) ID of the Enterprise Application        |
| **Client Secret** | The client secret value you created in step 2                    |
| **Region**        | The Azure region your tenant is homed in                         |
| **Sync Schedule** | Optional — you can also configure this later on the connector    |
| {% endstep %}     |                                                                  |

{% step %}
**Confirm the Identity Ingestion connector**

After saving, the Target System appears in the **Target Systems** list. AOH Sync also automatically creates an **Identity Ingestion connector** for it — this connector reads your directory's current state so AOH Sync can match incoming Accounts against existing directory records before provisioning.
{% endstep %}
{% endstepper %}

## How to check it worked

The new target appears in the **Target Systems** list, and an **Identity Ingestion** connector for it appears on the **Connectors** page.

## Related

* [Step 8 — Set Up Provisioning](/getting-started/09-set-up-provisioning.md)
* [Target Systems](/feature-reference/target-systems.md)
* [Microsoft Entra Permissions Requested](/trust-security-and-data-handling/entra-permissions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/getting-started/08-connect-target-system.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.