---
title: Sync users with Azure AD
description: How to manage users and keep them up to date with synchronization from Azure Ad, Azure tenanant or other user database.
url: "https://gluu.biz/documentation/administration-and-integrations/sync-users-with-azure-ad/"
updated: "2026-09-01"
category: Administration and integrations
tags:
  - "API & Connectors"
  - Compliance
---

# Sync users with Azure AD

*Goal: Keep Gluu users, plans and roles in sync with Azure AD using CSV-based bulk updates and the users API.*

Get your API token and [read our API basics before starting](https://gluu.biz/documentation/api-technical/api-and-integration-basics/).

## Before you start

- **Plan:** This sync uses the Gluu API, which requires the API & Connectors add-on.
- **Role:** You need Account Owner/Admin (**Manage account**) access to generate an API token and run the sync.
- **Setup:** Have your Gluu API token ready, and PowerShell with the Microsoft Graph module if pulling users directly from Azure AD.

## Bulk update users (CSV)

Use CSV ([RFC 4180](https://datatracker.ietf.org/doc/html/rfc4180)). Header names are case-insensitive.

### Supported columns

- **Email** – user’s email.
- **Fullname** – first + last; ignored if **Firstname**/**Lastname** present.
- **Firstname**, **Lastname** – preferred over Fullname.
- **Plan** – ESSENTIAL, ADVANCED or `NONE`.
- **Location** – site/department etc.
- **Roles** – comma-separated role names (case-insensitive). Unknown names are ignored (shown in dry run).
- **RoleOperation** – `add` (only add new) or `replace` (default; removes unlisted roles).
- **ExtId** – your unique ID. We match on ExtId first, then fall back to Email.

### Delete users

Use **IncludeAllUsers** when you pass the full current list; users not in the CSV will be removed. Account Owners and Process Owners cannot be deleted until reassigned—dry run will report this.

**Dry run:** Test the import and see intended changes before applying.

## API operation

Use the token from above. Start with **dryrun**. To fetch current users, see [list of users](https://api.gluu.biz/api-browser#/operations/query-a3faa464-df62-4878-896e-fcbc04641e81).

You're done once a dry run shows the expected changes and you've re-run the request without **dryrun** to apply them.

## Get users from Azure Graph

```
Connect-MgGraph -Scopes "User.Read.All"
get-mguser -all | select displayname, givenName, Surname, Mail | Export-Csv -Encoding UTF8 -Path temp.csv
```

Rename headers to:

```
"Fullname","Firstname","Lastname","Email"
```

Example POST with more columns:

```
$content =
'fullname;firstname;lastname;email;roles;plan
John Wayne;John;Wayne;user1@local.test;"my role 1, my role 2";ADVANCED'

Invoke-RestMethod -Uri "https://api.gluu.biz/users/sync" -Method POST `
  -ContentType "csv/text" -Headers @{ "content-encoding" = "utf-8"; "Authorization" = "Bearer g_xxxx"} `
  -Body $content
```

That is it

## FAQ – Sync users with Azure AD

 **What plan or add-on do I need to sync users via the API?**

This sync uses the Gluu API, which requires the API & Connectors add-on. It is not included in the Core, Essential, or Advanced plan on its own.

  **How does Gluu match a row in my CSV to an existing user?**

Gluu matches on ExtId first if you provide one, and falls back to matching on Email otherwise. This lets you use your own external identifier as the stable key across syncs.

  **Will syncing delete users who aren't in my CSV?**

Only if you set IncludeAllUsers, which tells Gluu you're passing the full current list—any user not included is then removed. Account Owners and Process Owners can't be deleted until they're reassigned; a dry run will report this.

  **What's the difference between RoleOperation add and replace?**

add only adds the roles listed in the CSV without touching a user's other roles. replace is the default—it removes any roles not listed in the CSV, so the user's roles exactly match what you sent.

  **Should I test a sync before applying it?**

Yes. Use dryrun to see the intended changes—including any unknown role names or users who can't be deleted—before running the sync for real.