> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/entra-id/entra-id-configuration.md). # Configure Entra ID Sync Configure Entra ID Sync credentials, cardholder matching, filters, and Command Centre privileges. The concept mirrors AD Cardholder Sync: Entra ID Sync uses the **REST API** to create and update cardholders, and **AD Single Sign-On** for authentication from the Entra ID Sync middleware server to the Gallagher server. ## Command Centre side **Operator group privileges (recommended):** Add Cardholder Notes, Create and Edit Cardholders, Delete Cardholders, Modify Access Control, Modify Operator Membership, View Operators, View Personal Data Definitions, View Site. ![The recommended Command Centre operator-group privileges for the Entra ID Sync REST operator](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-c77fcc3b8a7944f0019ae6973f7359a6a2141f76%2FSECHUB-ENTRA-02-operator-privileges.png?alt=media) ![Operator group membership for the Entra ID Sync operator, with Windows logon set for AD SSO](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-074599ddb9e48d09ec24ab32ea8978d13e61a2d0%2FSECHUB-ENTRA-01-operator-group-membership.png?alt=media) > **REST API Client:** if you ever change the operator privileges, you **must** click **Refresh Operator Privileges** in the REST Client item, then restart the Gallagher Entra ID Sync Service. If the Entra ID Sync UI Service Status shows **NOT AUTHORISED**, add the current Windows account to the local admin group, ensure it can log into the Configuration Client via SSO, and run the app as administrator. ![The Entra ID Sync UI showing a Service Status of NOT AUTHORISED](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-aab8f2756a62e3cd468c507b23b872cf7f5a7693%2FSECHUB-ENTRA-06-service-not-authorised.png?alt=media) ![Confirming the current Windows account is a local administrator (whoami + Administrators group membership)](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-36f34ed7c3635efde734e06737a52332a5b1e2e6%2FSECHUB-ENTRA-03-local-admin-requirement.png?alt=media) ## Credentials **Gallagher credentials:** URL `https://{Gallagher Server ip or hostname}:8904`, an **API Key** (from the REST Client item in Configuration Client), and the **Operator Group** name. **Entra ID credentials** (obtain from the IS team managing Microsoft Azure — Entra ID): **Region, Tenant ID, Client ID, Client Secret (Value)**. ## Matching a directory user to a cardholder (Unique ID) * **Primary Unique ID** — Entra ID Sync associates an Entra user with the cardholder whose **External ID** matches the Entra user's **Object ID**. When it creates a new cardholder, it stamps the Entra Object ID as the External ID (the two then match). * **Secondary Unique ID** — for cardholders that **already exist** in CC, select an **Entra Unique Lookup Field** and match it to a **unique PDF value**. ![Entra Replication Group dialog — "When Cardholder not in Entra" set to Remove from Command Centre, with the Unique ID Attributes tab (Entra Unique Lookup Field + CC Unique Lookup PDF)](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-50c19dafeaf11109cec05f7753cbde96dda2d8c6%2FSECHUB-ENTRA-04-replication-group-unique-id.png?alt=media) ## Cardholder filter — Valid Groups To be replicated, an Entra user must pass a **Valid Groups** filter. No Valid Groups specified means all users pass; otherwise only users in those groups pass, and are replicated per the filter's mappings. ![Entra-to-CC replication group running, with the Cardholder Filter's Valid Groups dropdown listing the mapped Entra groups](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-5c0831bbcf49ea91aceb9ef9481b3d661980ead6%2FSECHUB-ENTRA-05-entra-to-cc-valid-groups.png?alt=media) **Speed** of transfer to Command Centre depends on Entra ID's update speed, the number of near-simultaneous Entra changes, and the current CC workload. *** 🔗 **Related** * [Microsoft Azure Environment](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/entra-id/entra-id-microsoft-azure-environment.md). The Azure-side app registration and permissions. * [Deployment Options](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/entra-id/entra-id-deployment-options.md). Topologies and ports. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/entra-id/entra-id-configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.