Import and Sync Users from Entra ID

Hideez Integrations – Import and sync users from AD

Overview

Hideez Enterprise Server integrates with Entra ID to support centralized user import, synchronization, and optional password rotation.

Hideez Enterprise Server also supports multi-domain environments. Users can be synchronized from multiple Entra ID domains and are matched by their email addresses. If two or more users from different domains share the same email, they will be merged into a single profile in Hideez Enterprise Server.

Integration Scenarios Hideez Enterprise Server supports two scenarios for integrating and managing users from Entra ID:

Scenario 1: Importing Users Only (Without Password Change)

Overview

• Users are synchronized based on membership in the Hideez Users Sync group.

• Domain passwords are not changed or updated.

• Assigning Hideez Keys is not required.

• You can optionally configure passwordless PC authentication via the Hideez Authenticator mobile application.

Prerequisites

Before syncing users from Entra ID, ensure the following conditions are met:

1. You are logged in as a user with administrator rights in Hideez Enterprise Server.

2. Integration with Entra ID is properly configured in Hideez Enterprise Server.

3. Target users are added to the designated Entra ID group:

   • Hideez Users Sync – required for any synchronization.

4. Enable Single Sign-On must be enabled during Entra ID setup.

5. Users have valid email addresses that will receive invitation emails from the server.

6. The workstation is joined to the Entra ID.

7. The Hideez Client is installed on the user’s workstation.

8. The workstation is approved in the Hideez Enterprise Server (see the Workstations section).

Steps

1. In Hideez Enterprise Server, navigate to Employees → Sync with Entra ID and click Sync Now.

Imported users will appear in the employee list, marked as synchronized from Entra ID and associated with a domain account.

Use Case: Passwordless Login with Hideez Authenticator

1. When a user is imported into Hideez Enterprise Server from Entra ID, they receive an invitation email.

2. The user receives an invitation email for the Hideez Server and chooses their authentication method.

3. Upon accessing the server, the user selects an SSO method and chooses the Hideez Authenticator mobile app.

4. The user logs in to the workstation using the method previously used (e.g., password).

5. The user scans a QR code in the Hideez Client and creates a passwordless account for PC unlock.

6. The user can unlock their PC by scanning a QR code displayed on the workstation screen.

7. The user can continue logging in to their workstation using the Hideez Authenticator app by scanning the QR code displayed on the PC screen.

Scenario 2: Importing Users with Automatic Password Change

Overview

This scenario enables you to import users from Entra ID and enforce automatic domain password changes using Hideez Keys.

• Each imported user is assigned a new, strong, randomly generated password.

• The password is updated both in Entra ID and securely stored on the user’s Hideez Key.

• This workflow requires Hideez Keys.

• Future password rotations are handled automatically based on a configured schedule.

Prerequisites

Before syncing users from Entra ID, ensure the following conditions are met:

1. You are logged in as a user with administrator rights in Hideez Enterprise Server.

2. Integration with Entra ID is properly configured in Hideez Enterprise Server.

3. Users are added to:

   • Hideez Users Sync group (for user import)

   • Security Key Auto Password Change group (for automatic password management)

4. The user must have a Hideez Key with one of the following statuses: "Ready", "Active", or "Reserved".

5. The workstation is joined to the Entra ID domain.

6. The Hideez Client is installed on the user’s workstation.

7. The workstation is approved in the Hideez Enterprise Server (see the Workstations section).

Steps

1. In Hideez Enterprise Server, navigate to Employees → Sync with Entra ID and click Sync Now.

   

Imported users will appear in the employee list, marked as synchronized from Entra ID and associated with a domain account.

1. Assign a Hideez Key to each user and provide the user with an activation code.

Use Case: First Login with a Hideez Key

After the key is assigned and the user receives their activation code:

1. Hideez Enterprise Server imports the user from Entra ID and changes the existing domain password in Entra ID to a new, strong password generated.

2. A new account record is created for the Hideez Key, and the password is securely assigned.

3. The user pairs or taps the Hideez Key to the workstation and activates it.

4. The user enters the activation code when prompted.

5. The updated password is securely written to the key and synchronized with Entra ID.

6. A new account with an updated password is securely written to the key and updated in Entra ID.

7. The user can continue logging in to their workstation using the Hideez Key in proximity mode (automatic unlocking when approaching the device).

Note: After the password is updated, neither the user nor the administrator can view or retrieve it.

Optional Features for Password Management

In addition to the automatic password update workflow, Hideez also supports optional manual and user-initiated password management features:

1. Administrator-Initiated Manual Password Changes

This scenario describes how an administrator can manually set or generate a new password for a domain user using the Hideez Enterprise Server interface.

2. User-Initiated Password Changes

This scenario describes how a domain user can change their own Entra ID password via the Hideez Client using a Hideez Key.

The user has two options:

• Change the password only on the Hideez Key (the domain password remains unchanged).

• Change the password in both Entra ID and the Hideez Key simultaneously.

Additional Note:

You can also enable FIDO2 passwordless authentication with Microsoft Azure AD for use with Windows 10. Please refer to this instruction for configuration guidance.