Microsoft Graph directory sync

Schools connect their Microsoft Entra ID tenant via a single Grant admin consent button. trackED uses one central application registration — school staff do not enter client IDs or secrets.

School setup

1. Open the school workspace → Microsoft Graph.
2. Click Grant admin consent.
3. Sign in as a Microsoft 365 administrator and accept permissions.
4. Use Sync now to run the first directory comparison.

Platform setup (trackED operators)

Register a multi-tenant app in Azure with application permission User.Read.All and redirect URI:

{NEXT_PUBLIC_APP_URL}/api/microsoft-graph/admin-consent/callback

Set MICROSOFT_GRAPH_CLIENT_ID and MICROSOFT_GRAPH_CLIENT_SECRET in the deployment environment.

Findings

• Potential leavers — still in trackED, missing from Azure AD
• New directory users — in Azure AD, not yet in trackED
• Disabled in directory — trackED access active, Azure AD account disabled