Enable or disable sync services
Enable or disable sync services
The Sync services tab of School settings is the master on/off switch for each integration — Google Workspace, Microsoft Entra, Active Directory and Apple School Manager. It answers "is this service on for this school?". Each service's detailed configuration (credentials, domains, OUs, options) lives in its own settings area, reached from Configure → here.
Before you start
- You must be a school admin with sync settings permission.
- Make sure a school is selected in the switcher — this is a per-school screen, not available in MAT Overview.
Steps
Step 1 — Open the Sync services tab {#step-1}
Open School settings → Sync services. You will see one row per service, each with its current status and a Configure → link.
Step 2 — Toggle the service {#step-2}
Toggle the switch for the service you want to turn on or off.
A disabled service does not sync — the toggle is bound to the exact flag the provisioning service checks, so turning it off genuinely stops that service running for the school (it is not just hidden from the screen).
Step 3 — Save {#step-3}
Select Save sync services. The status for each service updates to reflect the change.
Service status
Each service shows one of:
- Disabled — off; it will not sync.
- Enabled — needs configuration — switched on, but the service is still missing settings it needs to run (for example a domain or credentials). Select Configure → to complete its setup.
- Enabled — on and configured.
Turning a service on is only half the job — an enabled service with no credentials will show needs configuration and will not do anything useful until you finish its setup.
Where each service is configured
Use Configure → next to a service to open its own settings area. Here is what each one covers, and the guide that walks it:
- Google Workspace — the connection to your Google domain (primary/secondary domain, admin user, the access Realsmart's service account needs), plus what to sync (users, groups, passwords, profile pictures). Its settings are split into sub-areas: Settings, OU settings, Classroom and Groups. See Google Workspace settings.
- Microsoft Entra — your Microsoft tenant details (tenant ID, client ID, client secret, user principal domain) and what to provision (groups, administrative units). See Microsoft Entra settings.
- Active Directory — on-prem AD is different: enabling it here generates a connector token (below), which you enter into the small AD sync app you install on a server at school. Start with Set up Active Directory sync, then fill in Active Directory settings.
- Apple School Manager — the SFTP details Apple gives you and the export format. See Apple School Manager settings, then use Apple operations to build and upload the export.
Active Directory connector token
Active Directory syncs via an on-prem agent (a small app you run on a Windows Server at school) that authenticates with a connector token unique to your school.
- When you enable Active Directory, a secure, globally-unique token is generated automatically (existing schools without one are fixed up the same way).
- The token is shown masked. Use Reveal to view it and Copy to paste it into the AD agent configuration.
- Regenerate creates a new token. This is confirmation-gated because the current token stops working the moment you regenerate — you must reconfigure the AD agent with the new value or its sync will fail.
Treat the token like a password — keep it secret; it is never written to logs. The same token (and your School ID) is also shown on the Set up Active Directory sync page.