For the complete documentation index, see llms.txt. This page is also available as Markdown.
Step 7 — Connect a Target System
Connect the Microsoft Entra ID or Active Directory tenant that AOH Sync provisions identities into. Adding a Target System automatically creates an Identity Ingestion connector that reads your directory's current state. (~10 minutes)
1
Open Target Systems and start the wizard
Navigate to Target Systems in the left sidebar. Click + Add Target System. The setup wizard opens at Step 1 of 4.
Add Target System wizard Step 1 of 4, showing two selectable cards — Entra ID (cloud-only) and Active Directory (hybrid) — plus a Search Microsoft gallery field and a Provider template dropdown defaulting to Custom SCIM
Step 1 of 4: choose your provisioning topology. Use the Search Microsoft gallery field to find a vendor template (Workday, BambooHR, ServiceNow, and others) if needed. The Provider template defaults to Custom SCIM.
Choose one of the two provisioning topologies:
Entra ID (cloud-only) — provision identities directly into Microsoft Entra ID. No on-premises agent is required. Choose this option if your organisation manages identities entirely in the cloud.
Active Directory (hybrid) — provision identities into an on-premises Active Directory domain via a provisioning agent. Choose this option if you have an on-premises AD environment that must remain the authoritative directory.
Optionally use the Search Microsoft gallery field to find a vendor provider template, or leave Provider template at the default Custom SCIM for generic API-driven inbound provisioning. Click Next when ready.
2
Complete the Azure setup checklist
Step 2 of 4 shows the Azure setup checklist. Work through each item in the Azure Portal before continuing:
Create an Enterprise Application in your Entra ID tenant for AOH Sync provisioning.
In the Enterprise Application, open Provisioning and set Provisioning Mode to Automatic.
Under Admin Credentials, create a Client Secret for AOH Sync to authenticate.
Grant the following Microsoft Graph permissions to the Enterprise Application (these are provisioning permissions, separate from the sign-in App Registration you created in Step 1 of Getting Started):
Permission
Purpose
AuditLog.Read.All
Read audit log entries
Directory.Read.All
Read directory data
Group.ReadWrite.All
Manage group memberships
Synchronization.ReadWrite.All
Manage provisioning configuration
SynchronizationData-User.Upload
Upload user provisioning data
User.Read.All
Read all user profiles
User.ReadWrite.All
Create and update user accounts
Add Target System wizard Step 2 of 4 showing the Azure setup checklist with numbered items for creating an Enterprise Application, configuring Inbound Provisioning, creating a Client Secret, and granting Microsoft Graph permissions
The wizard provides a Full Microsoft guide link for detailed Azure Portal instructions at each checklist item.
3
Enter the Enterprise Application credentials
Step 3 of 4: enter the credentials from the Enterprise Application you just configured, then click Add Target System.
Add Target System wizard Step 3 of 4 showing credential fields — Display Name, Tenant ID, Client ID, Client Secret, Region, and optional Sync Schedule
Enter the Display Name, Tenant ID, Client ID, and Client Secret from your Enterprise Application. Optionally set a Region and a Sync Schedule.
Field
Where to find it
Display Name
A friendly name for this target in AOH Sync
Tenant ID
Your Entra ID tenant's Directory (tenant) ID in the Azure Portal
Client ID
The Application (client) ID of the Enterprise Application
Client Secret
The client secret value you created in step 2
Region
The Azure region your tenant is homed in
Sync Schedule
Optional — you can also configure this later on the connector
4
Confirm the Identity Ingestion connector
After saving, the Target System appears in the Target Systems list. AOH Sync also automatically creates an Identity Ingestion connector for it — this connector reads your directory's current state so AOH Sync can match incoming Accounts against existing directory records before provisioning.
How to check it worked
The new target appears in the Target Systems list, and an Identity Ingestion connector for it appears on the Connectors page.
