> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/help-and-support/faq.md). # FAQ Answers to the questions AOH Sync administrators ask most often. *** ## General **What does AOH Sync do?** AOH Sync reads identity data from your HR system and writes it to Microsoft Entra ID (formerly Azure Active Directory). When a person is hired, changes roles, or leaves, AOH Sync ensures their Entra ID account and group memberships reflect the HR record automatically. **What HR systems does AOH Sync support?** AOH Sync connects to HR systems through a Connector. Supported connection methods include REST API and SFTP file export. Workday and BambooHR are common sources; any HR system that exposes employee data via API or structured file export can be integrated. Contact support at for a specific compatibility question. **What is the target identity system?** The current target is Microsoft Entra ID. AOH Sync writes directly to Entra ID using Microsoft's standard directory interfaces. It manages users, group memberships, and directory attributes. **Does AOH Sync replace Entra ID or Azure AD Connect?** No. AOH Sync is not an identity provider and does not replace Azure AD Connect. It automates the provisioning and deprovisioning of identities inside Entra ID based on what your HR system says. Your existing Entra ID policies, MFA settings, and conditional access rules remain in effect. *** ## Authentication & access **How do I log in to AOH Sync?** AOH Sync uses your organization's Entra ID for authentication — there are no separate AOH Sync credentials. Go to your AOH Sync URL and click **Sign in with Microsoft**. Complete any MFA prompt your organization requires. **I see "Access Denied" when I try to log in. What should I do?** This usually means one of three things: you have not been granted an AOH Sync role, you are signing in with a personal Microsoft account instead of your work account, or your session has expired. Ask your AOH Sync Administrator to check your access under **Administration** → **Access Management**. See [Access Management](/administration/access-management.md) for details on roles. **Why can I not see a particular feature?** AOH Sync uses role-based access control. The features visible to you depend on the role your Administrator has assigned. Roles are described in [Roles & Permissions](/core-concepts/roles-and-permissions.md). *** ## Sync behavior **How often does AOH Sync sync data?** Sync frequency is configured per Connector. Most organizations run an incremental Sync on a schedule (commonly every 15–60 minutes) and a full Sync nightly. You can also trigger a Sync manually at any time. See [Connector Schedule](/feature-reference/connectors/schedule.md) for configuration details. **What triggers a sync?** A Sync runs when the schedule fires or when you click **Run Now** in the Connector view. Schedules are configured in **Connectors** → your Connector → **Schedule**. **Why was a user skipped during sync?** AOH Sync skips a record when required fields are missing (email address, first name, last name, or employee ID), when the record matches an exclusion rule, or when no changes are detected since the last Sync. The Sync log in **Connectors** → your Connector → **Sync History** shows the reason for each skipped record. **Can I edit user data directly in AOH Sync?** No. AOH Sync treats your HR system as the source of truth. All changes to identity data must be made in the HR system; AOH Sync propagates them to Entra ID on the next Sync. **What data does AOH Sync read from my HR system?** AOH Sync reads identity-related attributes only: names, work email, employee ID, department, job title, manager reference, location, and employment dates. It does not access salary, compensation, personal addresses, or any other HR data outside identity attributes. The exact fields synced depend on your Connector's Field Mapping configuration. *** ## Groups & memberships **How are users assigned to Entra ID groups?** Group membership rules are defined in your Connector's [Field Mappings](/feature-reference/connectors/field-mappings.md) configuration. Rules match HR attributes (such as department or job title) to Entra ID groups. When an employee's attributes change, AOH Sync updates their group memberships on the next Sync. **A user is not in the right group. What should I check?** First confirm the employee's attributes in your HR system are correct. Then check whether the relevant group rule in AOH Sync matches those attributes. Most group discrepancies trace back to an HR record that does not yet match the rule criteria, or to a Sync that has not run since the HR change. **Can I manually add a user to a group that AOH Sync manages?** Manual changes to Entra ID groups managed by AOH Sync will be overwritten on the next Sync. If you need a user in a group for a reason not captured in HR, ask your Administrator to create a rule that covers the case, or exclude that group from AOH Sync management. *** ## Data & security **Where is my data stored?** AOH Sync is deployed as a single-tenant virtual machine in your own Azure subscription. Identity data flows through your instance and is written to Entra ID; it is not stored in any shared or third-party system. See [Where Your Data Lives](/trust-security-and-data-handling/data-residency.md) for full details. **Is data encrypted?** Yes. All data in transit uses TLS. Credentials and secrets are stored in AOH Sync's built-in [Vault](/administration/vault.md), which is part of your deployment and runs entirely within your Azure subscription. See [Encryption](/trust-security-and-data-handling/encryption.md). **What permissions does AOH Sync hold in Entra ID?** AOH Sync uses a Microsoft App Registration that you create and control. The permissions granted are documented in [Microsoft Entra Permissions Requested](/trust-security-and-data-handling/entra-permissions.md). **Who can see my data?** Access to AOH Sync is controlled entirely by your Administrator through role assignments. All actions are recorded in the Audit Log. See [Audit & Status Logs](/administration/audit-and-status-logs.md). *** ## Errors & failures **What happens when a sync fails?** Failed records are isolated — they do not block the rest of the Sync. Each failure is logged with a reason code. AOH Sync retries failed records on the next scheduled Sync. You can see failures on the Dashboard and drill into details in the Connector's Sync History. **What do common error messages mean?** See [Troubleshooting](/help-and-support/troubleshooting.md) for a list of common symptoms and how to resolve them. *** ## Related * [Troubleshooting](/help-and-support/troubleshooting.md) * [Contact Support](/help-and-support/contact.md) * [How AOH Sync Works](/core-concepts/how-aohsync-works.md) * [Roles & Permissions](/core-concepts/roles-and-permissions.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.aohwv.dev/help-and-support/faq.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.