# Microsoft Entra ID (Azure Active Directory) Integration

Microsoft Entra ID (previously called Azure Active Directory, or Azure AD) is Microsoft's cloud identity and access management service. When you connect Cloud Voice to Microsoft Entra ID, your directory becomes the source of truth for your phone system: users and groups flow into Cloud Voice automatically, and people can sign in to the Cloud Voice App with the same Microsoft account they already use.

This guide is the starting point for the integration. It explains what the connection provides, what you need before you begin, and links to the step-by-step topics for setting it up and keeping it running.

## Requirements

Before you set up the integration, confirm that both sides meet the following:

| Item | Requirement |
|------|-------------|
| Microsoft Entra ID | Any of the following plans: Free, Office 365 apps, Premium P1, or Premium P2 |
| Cloud Voice | Version 84.21.0.66 or later |

:::note
The setup procedure depends on your Cloud Voice version:

- **Version 84.22.0.138 or later** supports the simplified method, in which the Microsoft Entra application is configured for you automatically.
- **Versions earlier than 84.22.0.138** use the legacy method, which requires you to create the application manually.

Use the setup link below that matches your version.
:::

## What the integration provides

- **User and group synchronization**: A one-way sync maps your Microsoft Entra ID users and groups into the Cloud Voice directory. When you change a synced user or group in Entra ID, the update is applied to Cloud Voice on its own, so you administer people in one place.
- **Automatic extension assignment**: Cloud Voice creates and assigns an extension for each synced user, giving them access to the platform's unified communications (UC) features (calling, voicemail, presence, and the Cloud Voice App).
- **Single sign-on (SSO)**: Synced users can sign in to the Cloud Voice App securely with their Microsoft account, with no separate password to manage.
- **Outlook contact synchronization**: Personal Outlook contacts, along with shared contacts from Outlook shared mailboxes, sync one-way into Cloud Voice and the Cloud Voice App. Synced users can then find and call those contacts from the Cloud Voice App.
- **Teams presence synchronization**: A synced user's Microsoft Teams presence is reflected on their Cloud Voice extension.

:::caution
Synchronization only runs one way, from Microsoft Entra ID into Cloud Voice. Make all changes to synced users and groups (names, membership, and so on) in Entra ID. If you edit a synced user or group directly in Cloud Voice, the next synchronization overwrites your change with the value from Entra ID.
:::

## Set up the integration

Work through these topics in order:

1. Connect Cloud Voice to Microsoft Entra ID. Choose the method that matches your version:
   - Version 84.22.0.138 or later: [Integrate Cloud Voice with Microsoft Entra ID](/pbx/integrations/azure-ad/integrate-cloud-voice-cloud-voice-with-azure-active-directory/)
   - Versions earlier than 84.22.0.138: [Integrate Cloud Voice with Microsoft Entra ID (Legacy)](/pbx/integrations/azure-ad/integrate-cloud-voice-cloud-voice-with-azure-active-directory-legacy/)
2. [Synchronize users from Microsoft Entra ID to Cloud Voice](/pbx/integrations/azure-ad/synchronize-azure-ad-users-to-cloud-voice-cloud-voice/)
3. [Synchronize groups from Microsoft Entra ID to Cloud Voice](/pbx/integrations/azure-ad/synchronize-azure-ad-groups-to-cloud-voice-cloud-voice/)
4. [Synchronize Microsoft Outlook contacts to Cloud Voice](/pbx/integrations/azure-ad/synchronize-microsoft-outlook-contacts-to-cloud-voice-cloud-voice/)
5. [Enable Microsoft Teams user presence synchronization](/pbx/integrations/azure-ad/enable-microsoft-teams-user-presence-synchronization/)
6. [Allow users to sign in to the Cloud Voice App with SSO](/pbx/integrations/azure-ad/allow-users-to-log-in-to-cloud-voice-app-uc-clients-with-sso/)

:::tip
Steps 2 and 3 use synchronization rules that decide which users and groups are brought in. Start with a small, well-defined group to confirm that extensions are created as you expect, then widen the rule once you are happy with the result.
:::

## Manage the integration

Once the connection is live, use these topics to keep it healthy:

- [Schedule automatic directory synchronization](/pbx/integrations/azure-ad/schedule-automatic-directory-synchronization/): pick when Cloud Voice pulls updates from Entra ID.

:::note
Cloud Voice runs an automatic directory synchronization at 00:30 every day by default. Change the schedule only if that time does not suit your organization.
:::

- [Manually perform a directory synchronization](/pbx/integrations/azure-ad/manually-perform-a-directory-synchronization/): run a sync right away, for example to apply a new synchronization rule or push recent Entra ID changes without waiting for the daily run.
- [Update the client secret for the integration](/pbx/integrations/azure-ad/update-client-secret-for-azure-active-directory-integration/): refresh the credential that links Cloud Voice to the Microsoft Entra application.

:::caution
The client secret is set with an expiration date when it is created. If it expires, directory synchronization stops working. Update the client secret before its expiration date to avoid an interruption.
:::

- [Pause Microsoft Entra ID synchronization](/pbx/integrations/azure-ad/pause-azure-active-directory-synchronization/): temporarily hold syncing so updates from Entra ID do not overwrite the synced data.
- [Disable the Microsoft Entra ID integration](/pbx/integrations/azure-ad/disable-azure-active-directory-integration/): suspend the integration temporarily (for example during troubleshooting) while keeping the existing configuration.
- [Disconnect the Microsoft Entra ID integration](/pbx/integrations/azure-ad/disconnect-azure-active-directory-integration/): remove the current integration, which you need to do before connecting a different directory.

:::caution
Disabling and disconnecting are not the same. Disable is a temporary pause that keeps your configuration, so use it for troubleshooting. Disconnect removes the current integration and is what you use before switching to a different directory. If you only need a short break, disable rather than disconnect.
:::