User import

User import allows you to bring users from groups defined in Microsoft Entra ID (Azure) into Gredit, avoiding manual creation one by one. The system also runs an automatic scheduled sync once per day.

Step 1 — Microsoft Entra ID

1. Data you will need

Data	Where to find it
Tenant (directory) ID	General info of the tenant or application
Application (client) ID	Application registration
Client secret (value, not the ID)	Certificates and secrets of the registration
Object ID of each Azure group to link to a Gredit role	Group page → Overview

2. Create (or review) the application registration

1. Go to the Microsoft Entra admin center (or the classic Azure portal → Microsoft Entra ID).
2. Go to App registrations → New registration (if one for Gredit doesn't exist yet).
3. Enter a clear name (e.g. Gredit - user import).
4. Account type: according to your organization (usually accounts in this directory only).
5. Register.
6. On the application page, copy:
   • Application (client) ID → will be the Client ID in Gredit.
   • Directory (tenant) ID → will be the Tenant ID in Gredit.

3. Client secret

1. In the same registration: Certificates & secrets → New client secret.
2. Enter a description and expiration date → Add.
3. Copy the value of the secret at that moment (you will not be able to see it again). That value is the Client secret in Gredit.

4. API permissions (Microsoft Graph)

The import in Gredit uses Microsoft Graph with application credentials (no interactive user).

1. API permissions → Add a permission → Microsoft Graph → Application permissions.
2. Add the permissions needed to list group members and users (e.g. GroupMember.Read.All or equivalents per current Graph documentation).
3. Click Grant admin consent for the directory.

5. Groups in Azure (reflected in Gredit as "roles")

In Gredit, each role to be synced needs the Object ID of the corresponding Entra group.

1. In Entra: Groups → All groups → New group (or use existing groups).
2. Typical type: Security.
3. Assign members (users or rules) per your organization.
4. Open the group → in Overview copy the Object ID (GUID).
5. That GUID is what you will paste in Gredit in the Identifier field of the corresponding role.
6. Repeat one group per role you want to sync (e.g. supervisors, auditors, etc.).

6. Users in the directory

• Users must exist in Entra (or be synced).
• They must be members of the groups to be used in Gredit.
• If a user does not belong to any group associated with a role in Gredit, they will not be included in the import.

---

Step 2 — Gredit

1. SAML provider configuration

1. Log in to Gredit.
2. Go to Configuration → SAML → Create SAML provider.

3. Fill in Tenant ID, Client ID, and Client secret.
4. Choose the Default role for users: this is the role applied when there is no match with roles defined by group Identifier.
5. Create the SAML configuration.

2. Roles: linking the group Object ID (essential)

1. Go to Roles.
2. Edit each role that should correspond to an Entra ID group.
3. In the Identifier field, paste the group's Object ID (GUID).
4. Save.
5. Repeat for each role you want to sync with a different group.

3. Import users

1. Go to Users → Import from SAML.
2. Run the import.

Once complete, the imported users will appear in the list.

Automatic import: the system runs a scheduled sync once per day, going through all import configurations that have complete credentials.