Apply sync settings across the trust

If you run a multi-academy trust, you often want the same sync set-up at every school: the same services switched on, one AD structure, the same Entra options, the same Apple format. Two trust-level areas in MAT overview do that without opening each school one by one. Both are under the Platforms group of the MAT sidebar and both need the Change sync, platform & API settings permission.

Switch services on or off for many schools — Sync settings

Open Platforms → Sync settings in MAT mode. The page is titled MAT sync settings, with the subtitle "Apply sync settings across multiple schools".

Sync settings, step 1 — Choose what to change

Under Settings to apply, each setting is a drop-down with Leave unchanged, Enable and Disable. Anything left on Leave unchanged is not touched.

These switches only turn a service on or off. They don't set up its credentials, and they don't change whether a service is in preview mode or live — each school keeps its own mode. A school you switch on that hasn't been set up yet will show as needing configuration; set it up on that school's own page. See Enable or disable sync services.

If two or more of your schools use the same Google domain, a notice appears: Shared Google domain detected — "N schools share {domain} — each person there is one Google account. Enable trust authority for them so schools stop removing each other's memberships." Switching Provision Subjects to Enable shows another: Subject groups are created on each school's next sync. Bulk-enabling skips the per-school preview, so look at the Subjects page for a school first if you want to see what it would create.

Sync settings, step 2 — Choose the schools

In the Schools card, tick each school you want, or use the header tick box to select them all. "N selected" shows the count. The Current column shows what each school already has, as small badges: MIS, Google, Entra, AD, Apple, Trust authority and Subjects.

Sync settings, step 3 — Apply

Select Apply to selected and confirm ("Apply these settings to the selected schools?"). A message says "N school(s) updated." The change is stored straight away and picked up on each school's next sync.

If you forget something you see "Select at least one school." or "Choose at least one setting to apply." Nothing is changed in either case.

Push shared integration settings — AD / Entra / Apple / Google / Calendar settings

Each integration has its own trust-wide page: Platforms → AD settings, Entra settings, Apple settings, Google settings or Calendar settings. You can also reach it from Apply across MAT at the top of that integration's settings page inside any school (admins who reach more than one school see that button). The page is titled with the integration, for example Active Directory — MAT settings or Calendar sync — MAT settings.

What "shareable" means

Not every setting can be pushed trust-wide. Each integration marks its fields as either shareable or per-school:

• Shareable fields are the ones that are normally identical across a trust — behaviour toggles, OU/path templates, default passwords (Google and AD), formats, prepends. Only these appear on this screen.
• Per-school fields are unique to each school and are deliberately left off this screen, so you can't accidentally overwrite them. These are the identity/credential fields: Google's domain and admin user, and Apple's SFTP host / user / password. Set those on each school's own settings page.

Active Directory's domain name, domain name without DC and UPN suffix are shareable, because many trusts run one domain across their schools. If your schools each have their own domain, leave those three unticked.

Whatever appears, nothing is pushed unless you tick it — untick a field and each school keeps its own value — and blank password/secret fields are never written, so you can't wipe a stored secret by accident.

Microsoft Entra is a special case. Trusts commonly run one Microsoft 365 tenant across all their schools, so Entra also exposes its connection details (tenant ID, client ID, client secret, UPN domain) on this screen. They behave like every other field — pushed only when ticked, left as-is per school when not. If your schools each have their own tenant, just leave those fields unticked and set them per school.

Entra's Group email addresses section is shareable as well, for a trust whose schools share one Microsoft 365 tenant and one Exchange Online app: tick the switch, the app ID and the tenant domain, and tick Exchange Online certificate to upload the .pfx and its password once. The certificate is checked before anything is applied — a wrong password or the wrong file stops the whole apply — and then replaces the certificate at every selected school. See Exchange Online app registration.

Entra's Group types to sync selector is shareable too, so you can standardise which kinds of group (Teachers of, Houses, Registration, Role, Year, Subjects, Groups) sync across the whole trust in one apply. Tick it and pick the types once; leaving every type unticked means "sync all types" on the schools you push to. The live Groups that will sync preview is per-school, so it appears only on each school's own Entra settings page, not here.

Before you start

• You must be a MAT admin — an admin who can reach more than one school — with Change sync, platform & API settings. The apply action re-checks this.
• Switch to MAT overview (the All schools option in the school switcher at the top of the page).
• Decide which settings you want to standardise and what their values should be.

Steps

Integration settings, step 1 — Open the MAT settings for an integration

In MAT mode, open Platforms → Entra settings (or AD settings, Apple settings, Google settings, Calendar settings). The page is titled with the integration name, for example "Active Directory — MAT settings" or "Microsoft Entra — MAT settings".

Integration settings, optional — Copy from a school

If one school is already set up the way you want, start from it instead of typing every value. At the top of the page, Copy from a school lists the schools you can reach that already have settings for this integration (it only appears when at least one does).

1. Choose the school under School to copy from.
2. Under What to copy, keep the sections you want (for Active Directory: General, Staff, Students, Groups, Scripts, Advanced) and untick the rest.
3. Select Load settings. A message says "Loaded N settings from {school}. Choose the schools, then apply."

Every setting in the sections you chose now shows that school's value and is ticked — blank values too, so the schools you apply to end up matching it. A Loaded from {school} note explains this, with Clear to empty the form again. Settings in sections you didn't choose are left as they were. Loading writes nothing: you still untick anything a school should keep, choose the schools and apply, as below. The school you copied from is taken out of the selected schools.

Some settings can't be shown in the form, so the copy carries them straight from that school when you apply instead. The copy card names them, and the Loaded from note lists them under Also copied when you apply, each ticked — untick any you don't want:

• Passwords the school has set (for Active Directory, the default staff and student passwords; for Entra, the client secret). They move as stored and never appear on the page. A password you tick and type in the form wins over the copied one.
• Active Directory's year group mapping (%YG) and intake year mapping (%IY), with Students. Each school only takes the rows for year groups it actually has, so a primary school never picks up a secondary's year groups, and rows the source school doesn't have are kept.
• Active Directory's user exclusions, group exclusions and field mapping, with Advanced — the settings on the AD advanced page.

Only the identity fields that are per-school (see What "shareable" means) are never copied.

Integration settings, step 2 — Tick the settings to apply

The settings form mirrors the normal per-school page. Use the section tabs along the top (for example Connection, Provisioning, Licences — the sections depend on the integration) to move between groups of settings. Each section says "Tick a setting to push it; unticked is left as-is per school." Tick each field you want to push, and set the value you want it to have. Unticked fields are left untouched on the target schools — only ticked fields are changed. This means you can push just one setting, or a whole configuration, without disturbing anything else. At the bottom, a running count says "N settings ticked (across all sections) · N schools selected". The page reopens on the section you used last, and the section is in the page address (?section=), so a link you copy opens on it.

Integration settings, step 3 — Select the target schools

In the Schools panel, tick each school you want to apply to, or use Select all. The count of selected schools is shown. The list only ever contains schools you can reach — you can't go beyond your MAT access.

Integration settings, step 4 — Apply

Select Apply to selected schools and confirm ("Apply the ticked settings to the selected schools?"). Each ticked setting is written to each selected school, and a message says "Applied to N school(s)." Masked password fields left blank are not pushed, so you won't wipe a school's stored secret by accident.

Some changes cost something, for example switching calendar sync off deletes calendars. When a ticked change would do that at a school, a window titled Confirm across these schools ("Read this before applying — some of it cannot be undone.") lists each school and what it would lose. Choose Apply these changes to go ahead, or Cancel to stop. Nothing is written until you confirm.

If you tick the Exchange Online certificate and the file or password is wrong, you see "The certificate wasn't applied: …" and nothing is applied at all.

Integration settings, step 5 — Review per school

The change takes effect immediately in each school's stored settings and is picked up on the next sync run. To confirm, switch into a school and open the same integration's settings — the values you pushed will be there. Spot-check a couple of schools after a large roll-out.

Notes

• Only fields the integration marks shareable can ever be applied here — even if a request tried to smuggle in a per-school field, it would be refused.
• Applying only ever writes to schools you can reach; the selection is constrained to your MAT access on the server side too.
• This complements per-school setup: per-school identity and credential fields still have to be entered on each school — except Microsoft Entra's connection details and Active Directory's domain, which can optionally be pushed here (see above) when a trust shares one tenant or domain.

Related

• MAT Overview
• Enable or disable sync services
• Shared Google domain trusts
• Provision subjects as groups
• Google Workspace settings
• Microsoft Entra settings
• Active Directory settings
• Apple School Manager settings