Sync users with Azure AD | Gluu Documentation 📘

Goal: Keep Gluu users, plans and roles in sync with Azure AD using CSV-based bulk updates and the users API.

Get your API token and read our API basics before starting.

Before you start #

Plan: This sync uses the Gluu API, which requires the API & Connectors add-on.
Role: You need Account Owner/Admin (Manage account) access to generate an API token and run the sync.
Setup: Have your Gluu API token ready, and PowerShell with the Microsoft Graph module if pulling users directly from Azure AD.

Bulk update users (CSV) #

Use CSV (RFC 4180). Header names are case-insensitive.

Supported columns #

Email – user’s email.
Fullname – first + last; ignored if Firstname/Lastname present.
Firstname, Lastname – preferred over Fullname.
Plan – ESSENTIAL, ADVANCED or NONE.
Location – site/department etc.
Roles – comma-separated role names (case-insensitive). Unknown names are ignored (shown in dry run).
RoleOperation – add (only add new) or replace (default; removes unlisted roles).
ExtId – your unique ID. We match on ExtId first, then fall back to Email.

Delete users #

Use IncludeAllUsers when you pass the full current list; users not in the CSV will be removed. Account Owners and Process Owners cannot be deleted until reassigned—dry run will report this.

Dry run: Test the import and see intended changes before applying.

API operation #

Use the token from above. Start with dryrun. To fetch current users, see list of users.

You’re done once a dry run shows the expected changes and you’ve re-run the request without dryrun to apply them.

Get users from Azure Graph #

Connect-MgGraph -Scopes "User.Read.All"
get-mguser -all | select displayname, givenName, Surname, Mail | Export-Csv -Encoding UTF8 -Path temp.csv

Rename headers to:

"Fullname","Firstname","Lastname","Email"

Example POST with more columns:

$content =
'fullname;firstname;lastname;email;roles;plan
John Wayne;John;Wayne;user1@local.test;"my role 1, my role 2";ADVANCED'

Invoke-RestMethod -Uri "https://api.gluu.biz/users/sync" -Method POST `
  -ContentType "csv/text" -Headers @{ "content-encoding" = "utf-8"; "Authorization" = "Bearer g_xxxx"} `
  -Body $content

That is it

FAQ – Sync users with Azure AD #

What plan or add-on do I need to sync users via the API?

This sync uses the Gluu API, which requires the API & Connectors add-on. It is not included in the Core, Essential, or Advanced plan on its own.

How does Gluu match a row in my CSV to an existing user?

Gluu matches on ExtId first if you provide one, and falls back to matching on Email otherwise. This lets you use your own external identifier as the stable key across syncs.

Will syncing delete users who aren't in my CSV?

Only if you set IncludeAllUsers, which tells Gluu you're passing the full current list—any user not included is then removed. Account Owners and Process Owners can't be deleted until they're reassigned; a dry run will report this.

What's the difference between RoleOperation add and replace?

add only adds the roles listed in the CSV without touching a user's other roles. replace is the default—it removes any roles not listed in the CSV, so the user's roles exactly match what you sent.

Should I test a sync before applying it?

Yes. Use dryrun to see the intended changes—including any unknown role names or users who can't be deleted—before running the sync for real.