User auto-provisioning in HighQ
Search
Search HighQ Support Help and Support.

This article applies to:

User auto-provisioning with Azure AD / Microsoft Entra ID

Setting up and using the HighQ user auto-provisioning feature with Azure Active Directory / Microsoft Entra ID.
The user auto-provisioning feature enables automatic synchronization of user data from Azure AD to HighQ. It ensures that user updates in Azure AD are automatically reflected in HighQ, enhancing security and efficiency.
Key concepts:
  • Azure AD Authentication: Single sign-on (SSO) setup allows users to access HighQ using their own SSO / 3rd party federation, i.e. work email and password.
  • User Management in Azure AD: Automates user creation, activation and deactivation in HighQ based on the client’s Azure AD.
  • Azure Cloud: The hosting environment for HighQ instances.
Prerequisites:
Before setting up the user auto-provisioning feature, ensure the following:
  1. You have a HighQ instance.
  2. Your HighQ instance is hosted on Azure Cloud.
  3. Your HighQ instance is upgraded to use Thomson Reuters Accounts. More info here.
note
Until Q1 2025 – existing instances that use the Appliance AD connector, cannot leverage Azure AD. Work is in progress to support migration in HighQ from AD to AAD.

End-to-end HighQ AAD user auto-provisioning setup

Part I: Professional Services prepare services provided by Thomson Reuters
note
HighQ Professional Services get all the required services up and running on the Thomson Reuters side:
  • Run a Thomson Reuters application in your Azure account
  • Establish connectivity
  • Provide permissions
Part II: Set up your Azure AD account
II.1) Execute command
To begin, you must execute the following command in your Azure account to install the Thomson Reuters application in your Azure account: 
az ad sp create --id "
<TR Application ID>
"
This command adds the Thomson Reuters application to your Azure account.
II.2) Configure Azure AD: Find the listed service
After executing the command, the HighQ User Sync App appears in 'Microsoft Entra ID' under the 'Enterprise applications' section of your tenant.
II.3) Configure Azure AD: Permissions
Navigate to Microsoft Entra ID and select
Enterprise Applications
.
Search for and select the Thomson Reuters application.
Navigate to
eastus2-prod-aadusersyncapp1-spn
.
Select
Permissions
 under the ‘
Security
’ section.
Click
Grant admin consent
 to grant the necessary permissions: Group.Read.All, GroupMember.Read.All, and User.Read.All
When prompted with the consent pop-up, click ‘
Accept
’ to confirm.
A message notifies you each time that the HighQ microservice communicates with your Azure instance:
Microsoft Entra ID message shown when communicating with the HighQ instance for the linked AAD user auto-provisioning
Part III: Provide Tenant ID and Group IDs
Retrieve your Tenant ID and the user Group IDs to sync to HighQ from Azure AD.
Share these details with the Professional Services team
 so they can configure your HighQ instance.
Professional Services will add this information to your instance, test the connection and ensure that all groups are recognised.
note
It is possible to check how many users would be synced per group
before
 running the sync. This helps to double-check expectations are met before users are synced.
Options available during setup:
  • Configure reporting: configure how long reports are retained, choose 1 month, 3 months or 6 months.
  • Which AAD Groups to sync. You must share your AAD Group IDs with Professional Services so these can be configured for you. Groups keep the same name in HighQ as in your AAD settings. 
  • The type of Role users have (internal/basic) for each of your AAD synced groups.
    Note that the basic role selection will be available in the next release.
     Roles can also be set by your HighQ System Admin or System User Admin in the HighQ User Management section.

User Management and sync

System Admins and System User Admins can access AAD-synced users in
System Admin
 >
User management
 >
AAD Groups
:
  
The
Azure AD user groups selected for sync
 window provides the following options:
  • Click
    Force sync now
     to run an ad-hoc sync if you do not want to wait until the next automated sync (which runs every 24 hours at midnight). The system displays a notification while the sync runs. A Sync Report is generated for every sync; forced syncs are listed in ‘Sync Reports’ with the report type ‘Manual’.
  • Select
    Sync reports
     to open the report page. Each time the sync service is run, forced or automatic, a report is produced. Each report lists which groups and users were synced. Also, any errors are detailed. Click
    Download
     to save the report as an Excel file.

User synchronization

The user sync runs automatically every 24 hours, set to run at midnight in your time zone. Each sync produces a report, where you can review the outcome of the sync.
note
Only users and groups synced with AAD are always classed as internal to the HighQ instance, rather than external. 
Terminology
  • AAD Group:
     a group that lives on and is managed by your Azure AD account.
  • AAD user:
     a user that lives on and is managed by your Azure AD account.
  • HighQ Synced Group:
     a group created on your HighQ instance as the result of a sync, based on the AAD Groups set up to sync.
  • HighQ Synced User:
     a user created on your HighQ instance as the result of a sync, based on the AAD Groups set up to sync.
  • System Group (HighQ):
     Only HighQ synced Groups and Users are updated during a sync, reflecting the latest set-up in HighQ and the respective AAD Groups and AAD users. 
Entities and Fields
Fields that are updated for
HighQ synced Groups
:
  • Group Name
    : updated to mirror the AAD Group Name.
  • HighQ Role:
     this value can be
    internal
     or
    basic
    . The role mirrors the set-up for that AAD Group sync on HighQ.
    Currently only internal is available; the next release will support basic role selection.
Fields that are updated for
HighQ synced Users
:
  • First name:
     supports up to 512 chars. Mirrors AAD User.First_Name.
  • Last name:
     supports up to 512 chars. Mirrors AAD User.Last_Name.
  • Business Phone:
     supports up to 512 chars. Mirrors AAD User.Business_Phone.
  • Email address:
     mirrors AAD User.Email.
  • Job Title:
     supports up to 512 chars. Mirrors AAD User.Job_Title.
  • MemberOf:
     mirrors the AAD User.MemberOf groups for only those AAD Groups that have been selected in HighQ to sync with.
  • Status:
     mirrors whether the user has been deactivated/removed from the AAD set-up.
How do my AAD updates translate in HighQ after the sync service run?
Depending on the entity, field and type of update within your AAD, HighQ will interpret and update the HighQ instance Synced Groups and Users.
  • AAD Group was removed:
     if an AAD Group is removed, then on the next sync run, each HighQ Synced Group is converted to a System Group and members of that group (if they are
    only
     members of that group) are switched to inactive in HighQ. These users are also unlinked from the System group.
    Note: if a HighQ Synced User belongs to another active HighQ Synced Group in HighQ, this user remains active, but there is no change in any other (non-synced) group where the user was manually added in HighQ.
  • AAD User was removed:
     if an AAD User is removed, then on the next sync, the HighQ Synced User is deactivated and unlinked from the HighQ Synced Group.
    Note: the user is removed from all HighQ Synced Groups with AAD, but there is no change in any other (non-synced) group where the user was manually added within HighQ.
  • AAD Group changes:
     Changes to AAD Groups selected to sync with HighQ is reflected in HighQ as follows:
    • AAD Group Name changed
      : this updates the linked HighQ Synced Group name on the next sync run.
    • AAD Users added to the AAD Group
      : HighQ Sync service validates if the users added to the synced AAD group already exist in HighQ – based on the email address in the HighQ instance Users base. If the user is not found in HighQ, then a new user is created and added as a member of the HighQ Sync group. If the user already existed in HighQ, then the user is added as a member of the HighQ Synced Group.
    • AAD nested Groups change
      : nested AAD Groups synchronised with HighQ. This means that if an AAD Group (AAD_Group_1) selected to be synced with HighQ has nested AAD sub-groups, these are ignored; users in the nested subgroup are also ignored. For example, the Sync service syncs AAD_Group_1 and all directly linked members but ignores any AAD sub-group (and users in the sub-group).
  • AAD User changes:
    • First name / Last Name / Business Phone / JobTitle
      : any changes made to AAD on these fields are reflected on the HighQ Synced User on the next sync. 
    • Email
      : changes on the email prefix (everything before the @), are updated for the HighQ Synced user on the next sync. Changes to the email suffix (everything after the @), are not supported via the AAD sync service. Contact Support for alternatives.
    • Status
      : if an AAD user is disabled in AAD, the related HighQ Synced user is deactivated in HighQ. If an AAD user is activated in AAD (and is in a HighQ Synced Group), the related HighQ Synced user will be activated in HighQ.
    • MemberOf
      : Depending on the group the user was added to in AAD, this is reflected in the HighQ synced groups.
    • Picture
      : changes on the AAD User picture are ignored. Picture sync is not currently supported.

Which updates on my HighQ instance might be overridden after the sync service run?

If you make certain changes within your HighQ Synced Groups and Users, these might be overridden by the AAD sync.
  • HighQ Sync Group was removed via ASP Admin:
     if  an AAD Sync Group is deselected the from the HighQ Sync Configuration to be synced, then on the next sync run, the HighQ synced group converts to a system group and all members of that group are rendered inactivate. However, any users that belong to
    other
     active HighQ Synced Groups remain active.
  • HighQ Sync User removed:
     This action is restricted.
  • HighQ synced Group changes:
    • Change name: not allowed via HighQ.
    • Change status: not allowed via HighQ.
    • Add / remove members: not allowed via HighQ.
  • HighQ synced User changes:
    • Change status. Although System Admin or System User Admins can only archive HighQ Synced Users; this will be overridden in next sync if an update for that user in HighQ is triggered by any changes for that user within AAD. 
    • Anonymize HighQ Synced Users is not allowed.
    • Role (internal/basic): Any changes of the user role internal / basic, will be overridden by the sync AAD group set up.
    • Memberships to System Groups: HighQ synced groups do not allow manually adding users within them. The users in HighQ synced groups are added/removed only via the sync service to reflect your AAD changes.
    • Picture: Sync service will not override the picture manually uploaded for the user within your HighQ.

Questions and answers

Q:
I would like to retire my Appliance/AD Connector so that I can use the new Azure AD User auto provisioning, can I?
A:
 Currently this is not supported. We are working to include this feature and target release in Q1 2025.
Q:
Can the sync run on a custom frequency, for example every 2 hours on the Azure AD user auto provisioning new offering?
A:
 Not in the phase 1. If there is enough interest from the customers, we can add it as part of the next phases. As an alternative to the current 24 hours sync, we do offer a ‘ad hoc’ manual sync which can be run any time by the System Admin or the System User Admin via the User management section.
Q:
Can behavior to make user Archive or Inactive be configured as with existing AD connector? on the Azure AD user auto provisioning new offering?
A:
 Not in phase 1. Currently if an AAD User was removed, then on the next sync run, HighQ Synced User will be inactivated and unlinked from the HighQ Synced Group. Note: the user will be revoked from all HighQ Synced Groups with AAD, but there will be no change in any other (non-synced) group where the user was manually added within HighQ. . If there is enough interest from the customers, we can add it as part of the next phases.
Q:
Will the Q1 2025 release include Basic User syncing? It was referenced as part of the "next release" earlier in this document.
Yes. It will allow to select the AAD group one wants to sync with, and then whether the corresponding HighQ Synced Group will be basic or internal -> which in turn will make the users (that belong to that group) basic or internal
Q:
Is there any max or min  user count I can sync with in my HighQ instance using the Azure AD user auto provisioning?
A:
 No, there is not.
Q:
Is it possible to add same users to Multiple groups?
A:
 Yes, you can add same uses to multiple groups. there is no limitations.
Q:
What if by mistake removed user from group?
A:
 You can add back to the same group and sync the user.
Q:
Can I remove the user from one group and add to another group?
A:
 Yes, you can remove it from one group and add same user to another group.
Q:
Is it possible to update user details after syncing?
A:
 Yes, you can update the user details. Note: for Phase 1 we are updating the following details only.
  • Firstname
  • Lastname
  • Jobtitle
  • eMail
  • Business number
  • Account enable/disable
Q:
How many users can we sync in one group?
A:
 You can sync as many users as per your need, you can sync max 50,000 user as per Azure limitations.
Q:
Can we disable users in Azure AD?
A:
 Yes, you can disable user in Azure and that will mark as Archived in HighQ
Q:
What if I change the group name in AAD after sync?
A:
 Yes, certainly you can change the name in AAD after sync.
Q:
Why is my mobile number not displayed in the correct format?
A:
 The sync service supports syncing normal business phone numbers to HighQ without formatting (in our first phase).
Currently, the business phone number is consumed as-is in the request body of the HighQ API. For example, if the business phone number is like 1555123456, the HighQ API works fine. However, if the number is formatted like 1-555-123456 (country code - area code - number), the HighQ API does not accept it. In such cases, the service first converts the number to the format allowed by the HighQ API, such as 1$555$123456.
Without converting the format would be like 1555123456:
 
With converting to the format allowed by the HighQ API, it would be like 1$555$123456 (future phase):
 

Related Content