Microsoft Entra settings

14 min read Updated 4 November 2026

Microsoft Entra (formerly Azure AD) is what backs Microsoft 365. These settings connect a school to its Microsoft tenant and control what Realsmart provisions there — accounts, groups, administrative units and Microsoft 365 licences.

Turning Entra sync on or off is done separately under School settings → Sync services (see Enable or disable sync services); this page controls how it behaves once on.

When it runs. The whole-school Entra sync runs every morning at 06:00 (UK time), Sunday to Friday, and works through the schools one after another, so a school's own run can start a little after 06:00. This page calls it "the daily sync". Changes you make to one person in Realsmart are sent within minutes instead — see How syncing works. To start a whole school's sync sooner, use Sync status → Quick run (Trigger a manual sync).

If you administer more than one school, you can apply these settings across many schools at once instead of repeating them per school — see Rolling out across a trust.

Before you start

You must be a school admin with sync settings permission, with the school selected in the switcher.
Turning Entra sync on is self-service in this app: toggle it under School settings → Sync services (Enable or disable sync services). There is no separate "we'll switch it on for you" step to unlock it — the toggle you control is the exact flag the provisioning service reads.
Connecting Entra requires an app registration in your Microsoft tenant, created by whoever administers your Microsoft 365. The app registration is where the tenant ID, client ID and client secret come from, and where the Microsoft Graph permissions the sync needs are granted. Set it up before entering the connection details below.

Set up the app registration in Microsoft Entra

Your Microsoft 365 administrator does this once: register an app called Realsmart Entra Sync, create a client secret, grant the Microsoft Graph application permissions that match what you switch on in Step 3, and grant admin consent. Set up the Entra app registration walks through each step and lists every permission and what it's for.

Steps

Step 1 — Open Microsoft Entra settings

Open Microsoft Entra settings for the school. The Connection section is shown first, with Provisioning, Profile details, Licences and Group email addresses sections alongside it. The page reopens on the section you used last, and the section is in the page address (?section=), so a link you copy opens on it.

Step 2 — Enter the connection details

In the Connection section:

Tenant ID — your Microsoft tenant's directory (tenant) ID, a GUID like 00000000-0000-0000-0000-000000000000.
Client ID — the application (client) ID of the app registration you created for Realsmart.
Client secret — the secret generated for that app registration. This is a masked field: once saved it shows as dots, and leaving it blank when you next edit keeps the stored secret unchanged. Only type into it to replace the secret (for example when the old one expires).
User principal domain — the domain that every account's Microsoft sign-in name and email address (its UPN) ends in: each person is provisioned as username@thisdomain. It must be a domain that is verified in your Microsoft tenant — either the built-in yourtenant.onmicrosoft.com, or a custom domain (e.g. yourschool.co.uk) you've verified in Entra.

Running a trust on one shared tenant? Give each school its own subdomain — e.g. school-a.yourtrust.co.uk, school-b.yourtrust.co.uk — and set the matching one here per school. Then each school's people get sensible, non-clashing addresses even though they share one tenant. Verify each subdomain in Entra first. If you also want each school's group email addresses on that subdomain, there's one extra one-off setup — see Group email addresses on your domain below.

Step 3 — Choose what to provision

In the Provisioning section, turn on the parts you want the sync to manage:

Sync passwords to Entra — send password changes made in Realsmart to accounts that already exist, not just new ones. See Step 4.
Sync groups — provision Entra groups and membership.
Create Teams — add a Microsoft Team to groups that sync. Turning it on asks you to confirm, because turning it off again doesn't remove Teams already made. Only takes effect while Sync groups is on. See Teams below.
Class Teams with Assignments — make an Education class Team, with Assignments and a Class Notebook, for each class. These are new groups beside your existing ones, need an Education licence and two more permissions, and teachers activate them. Off unless you turn it on, and turning it on asks you to confirm. See Class Teams with Assignments below.
Sync administrative units — provision Entra administrative units (a way of scoping admin over subsets of users). Realsmart makes one unit for each year group, and one each for Learners, Mentors, Governors, Observers and Admin, and keeps people in the right ones; each unit's name ends with your user principal domain (dots shown as dashes) so two schools in one tenant don't clash. Needs AdministrativeUnit.ReadWrite.All itself; without it Microsoft refuses every unit and Entra sync → Issues says so. It must also be on to use A unit Realsmart keeps up to date for the Microsoft 365 launchpad widgets.

Choose which group types sync

With Sync groups on, Group types to sync lets you narrow which kinds of group go to Entra, instead of all of them. Tick any combination of:

Teachers of — the "teachers of" groups.
Houses — house groups.
Registration groups — registration / form groups.
Role groups — the fixed role groups (learners, mentors, teaching staff, non-teaching staff, governors, observers, Ofsted).
Year groups — year-group cohorts.
Subjects — subject groups from Provision Subjects.
Groups — the catch-all: classes and anything else, including groups you create by hand and any group that hasn't been classified into a type yet.

Ticking Groups (or leaving every type unticked) also picks up any group that has no type set yet — a backstop so an unclassified group never silently drops out of sync. The other types match only their own kind. Every list of types has Select all and Clear all links above it.

Leave every type unticked to sync them all — that's the default and matches how Entra behaved before this option existed. This filter only takes effect while Sync groups is on; with it off, no groups sync at all regardless of what's ticked. A per-group opt-out (Sync this group to Microsoft Entra, in the Entra settings card on the group's own edit page) still applies underneath — a group syncs only if its type is selected here and it's opted in.

Subjects is always listed. If Provision Subjects is off for this school, you'll see a note beside it — the option is harmless to tick, there simply aren't any subject groups to sync yet.

Preview which groups will sync

Below the type checkboxes, Groups that will sync previews exactly which groups match your current selection for this school — grouped by type, with a count you can expand to see the group names. It updates live as you tick and untick types, before you save, so you can confirm the scope is what you expect. It's hidden while Sync groups is off.

Teams

With Create Teams on, the sync gives a Microsoft Team to each group of the types ticked under Teams for these group types — for example classes and subjects, but not houses or year groups. Leave every type unticked to give a Team to every type that syncs. A type that doesn't sync under Group types to sync has no group, so it can't have a Team.

Owners: each class's teachers become its Team's owners, worked out the same way as Google Classroom teachers (the staff in the group, including staff in groups nested inside it). When a teacher leaves the class, the sync takes away the ownership it gave them. It never removes an owner your school added by hand in Microsoft, and never a Team's last owner.
Private: every group with a Team is made Private, so only its members can find it, join it or see its files. New groups are created Private.
Pupils are members, never owners.
These are standard Teams, not class teams, so they have no Assignments or Class Notebook. Unticking a type, or turning Create Teams off, doesn't remove Teams already made. For Assignments and Class Notebook, see Class Teams with Assignments.

Class Teams with Assignments

Class Teams with Assignments makes a Microsoft Teams for Education class Team, with Assignments and a Class Notebook, for each of your classes. It's off until you turn it on here, in the Provisioning section, and it needs two extra permissions and an Education licence. What it makes, who's in each Team, how long it takes and what to check when class Teams don't appear are in Class Teams with Assignments.

Step 4 — Passwords

New Microsoft 365 accounts get the person's own Realsmart password, or the school's default from School settings → Password — see Password settings. If a person has no readable password of their own and the school has no default for their type, the account is made with a random password nobody is told (sign-in through SmartLogin isn't affected; signing in to Microsoft directly needs a default password set or the password reset), and Entra sync → Issues lists it. There's no separate Entra password on this screen.

For accounts that already exist, Sync passwords to Entra in the Provisioning section works the same way as Google's password sync:

On: when someone's password changes in Realsmart (they change it, or an admin resets it), the next sync sends it to their Microsoft account. Passwords that haven't changed are left alone.
Off: Realsmart never changes the password of an existing Microsoft account, so people keep whatever password they have there.
Switching it back on sends each person's current Realsmart password on their next sync, including anyone who has since changed their password in Microsoft.
Skip password sync for these user types: tick a type (staff and admins, say) to leave their Microsoft passwords alone while still syncing everyone else's. Unticking a type later sends those people's current Realsmart password on their next sync.

Two Microsoft rules apply that Google doesn't have:

The Realsmart app needs the User Administrator role in your tenant (Entra admin centre → Roles and administrators → User Administrator → Add assignments, then choose the Realsmart Entra Sync app). Without it, Microsoft refuses every password change; the sync stops trying for that run and says so in the Entra log. Microsoft never lets the sync change an Entra admin's password.
Not for SmartLogin sign-in. If your domain signs in through SmartLogin (a federated domain), people never use their Microsoft password, and Microsoft won't change it. Leave the switch off.

A password can only be sent when Realsmart holds a current copy it can pass on. A few ways of resetting a password keep only a one-way record; that person's password is sent the next time it changes.

Profile details in Entra

The Profile details section puts details from your MIS — job title, department or year group, company, office or registration group, employee type, employee ID and extension attributes 10 to 13 — on each person's Microsoft account, for Outlook and Teams profile cards, staff directories and dynamic groups. A blank MIS value never clears what's already in Entra, and no extra Microsoft permission is needed. See Profile details in Entra for what each detail holds for staff and pupils.

Microsoft 365 licences

The Licences section has the sync give every student and member of staff a Microsoft 365 licence automatically — you choose one licence for students and one for staff from the licences your tenant owns, and each time the daily sync runs it licenses anyone who needs it, straight after it creates their account. It needs one extra permission to read your licence list. See Microsoft 365 licences for the full walkthrough.

Step 5 — Save, then test the connection

Select Save settings. Some changes ask you to confirm first (switching on Create Teams, Class Teams with Assignments or Take their licence back, or changing a licence people already have): read the box, then select Save these changes. Then go to Sync status → Test connection and select Test connection (can the sync sign in?) or Test permissions (can it do everything you've switched on?). They're read-only and change nothing. If the permissions check flags something missing, that's an app-registration permission to sort out — revisit the Microsoft Graph permissions (and remember to Grant admin consent after adding any), or ask your IT admin or the provisioning team. See Test connection / Test permissions.

After the first daily sync, check Entra sync → Issues. It lists anything the sync couldn't do — people it couldn't create, groups it couldn't update, a client secret that has expired — with what it means and what to do. See Entra sync issues.

Rolling out across a trust (MAT)

Running a multi-academy trust? You don't have to repeat this on every school. Any admin authorised for more than one school sees an Apply across MAT button at the top of this page. It opens Microsoft Entra — MAT settings (you can also reach it in MAT overview, under Entra settings), where you set the values once, tick which ones to push, choose the target schools, and select Apply to selected schools. You're asked to confirm, and any of the warnings above (for example for Create Teams or Class Teams with Assignments) are listed school by school before anything is written.

That screen mirrors the sections here — Connection, Provisioning, Profile details, Licences and Group email addresses. Only the settings you tick are written to the selected schools; anything left unticked keeps each school's own value, so you can push a single setting or a whole configuration without disturbing the rest. A few settings are per school only and aren't on the MAT screen: Only these classes and Use licence rules for groups and people.

Because a trust often runs a single Microsoft 365 tenant across all its schools, the Connection details (tenant ID, client ID, client secret, user principal domain) can be pushed here too. If your schools each have their own tenant, leave the connection fields unticked and set them per school above. A blank client secret is never written, so you can't overwrite a school's stored secret by accident.

The MAT screen pushes configuration — each school still needs Entra sync switched on under its own Sync services (Enable or disable sync services).

For the full walkthrough — selecting schools, applying, and reviewing per school — see Apply sync settings across the trust.

Group email addresses on your domain

By default, a synced group's email address ends in …@yourtenant.onmicrosoft.com. To give your groups addresses on your own domain instead — e.g. [email protected] — there's a one-off setup: set the User principal domain to your own domain (Step 2), add it as an accepted domain in Exchange Online, register an Exchange Online app with a certificate, then switch on Set group email addresses on our domain in the Group email addresses section and upload the certificate. Exchange Online app registration walks through all of it, including what to expect afterwards and renewing the certificate. The .pfx file and its password only ever go into that upload — never email them to anyone, including Realsmart.

What the daily Entra sync does and doesn't touch

Two things are worth knowing about how the daily push behaves, because both affect what you'll see in Entra afterwards.

Only what changed is sent. The sync compares each account against what it last successfully pushed and sends only real differences, rather than rewriting every account every day. The practical consequence: if someone edits an account directly in the Microsoft portal — a display name, an account disabled, a sign-in name — Realsmart no longer quietly overwrites that the following day. Realsmart still owns those fields, so the next change made on the Realsmart side will push over the top of the manual edit. A manual sync (Sync status → Quick run, see Trigger a manual sync) follows the same rule, so it won't put a portal edit back either. To put an account right, change that detail in Realsmart, or contact Realsmart support, who can run a full push for the school.

A frozen school is genuinely frozen. While a school's provisioning window is paused, the daily Entra push skips that school completely — the same way the Google push does — and records the skip in the logs. That also means its "last synced" time stops advancing until the window reopens: expected, not a fault. See Cloud sync paused for what still works during the pause and how to send an individual user through early.

Signing in with Realsmart credentials

Everything above creates and maintains the Microsoft 365 accounts. To let people sign in to Microsoft 365 with their existing Realsmart / SmartLogin login — instead of a separate Microsoft password — you federate your domain to SmartLogin. That's a separate, advanced step done with Realsmart, and it comes after your sync is connected and users exist. See Single sign-on to Microsoft 365 with SmartLogin.

Was this guide helpful?

We read every response — it decides what we rewrite next.