For the complete documentation index, see llms.txt. This page is also available as Markdown.
Step 8 — Set Up Provisioning
Create the Outbound Provisioning connector — the connector that writes identities and accounts out to your Entra ID or Active Directory target. This is the core of what AOH Sync does. Unlike the Account Import and Identity Ingestion connectors (created automatically when you add a Source or Target System), you create this connector deliberately. (~5 minutes)
1
Open Connectors and review the categories
Navigate to Connectors in the left sidebar. The page shows three connector categories:
Identity Ingestion — auto-created when you added your Target System; reads your directory's current state.
Account Import — auto-created when you added your Source System; brings Account records into AOH Sync.
Outbound Provisioning — what you are about to create; writes identities and accounts out to your target directory.
Connectors page showing the three connector categories — Identity Ingestion, Account Import, and Outbound Provisioning — with auto-created connectors already listed in the first two categories
The Connectors page after completing Steps 6 and 7. Identity Ingestion and Account Import connectors are already present. Outbound Provisioning is empty until you create one.
Click + New Connector to open the creation wizard.
2
Step 1 of 4 — Choose your Source System
Select the Source System this connector should read Account data from.
New Connector wizard Step 1 of 4 showing a list of available Source Systems to choose from
Choose the Source System you connected in Step 6.
3
Step 2 of 4 — Choose your Target System
Select the Target System this connector should provision identities into.
New Connector wizard Step 2 of 4 showing a list of available Target Systems to choose from
Choose the Target System you connected in Step 7.
4
Step 3 of 4 — Confirm connector details
Review and confirm the connector name and settings. The Display Name is auto-filled based on your source and target selection.
The identity mode is set automatically from the target you chose. The identity-matching key is configured per attribute in the mapping editor after the connector is created.
If you selected an Active Directory target, you can optionally set a Target OU Distinguished Name to control which organisational unit provisioned accounts land in.
New Connector wizard Step 3 of 4 showing the Display Name field (auto-filled) and an optional Target OU Distinguished Name field for Active Directory targets
The Display Name is auto-filled. For Active Directory targets, set the Target OU Distinguished Name if you want provisioned accounts in a specific OU.
5
Step 4 of 4 — Set a schedule and create
Optionally choose a Sync Schedule from the preset options, then review the summary and click Create Connector.
Schedule option
When the connector runs
Every 15 min
Continuously throughout the day
Every hour
Once per hour
Daily 9 AM UTC
Once per day at 9 AM UTC
Weekdays 8 AM UTC
Monday through Friday at 8 AM UTC
On-demand only
Only when you trigger a manual run
New Connector wizard Step 4 of 4 showing the Sync Schedule dropdown with preset options and a Create Connector button
Choose a schedule, review the summary, and click Create Connector. You can change the schedule at any time from the connector's Schedule tab.
How to check it worked
The new connector appears under Outbound Provisioning on the Connectors page.
