Entra-only Customer and User Management (Preview)
Overview
Entra-only management lets you connect a Microsoft Entra tenant to an Atria customer and manage its users directly through the new Atria UI. It is designed for customers whose identities are managed in Microsoft Entra ID and who do not need corresponding users or organisational units in Active Directory (AD).
An Atria Directory identifies the directory used to manage a customer's identities. Selecting the Entra directory gives that customer an Entra-specific provisioning and synchronization flow. Customer and user changes skip AD-specific processing, so administrators do not need to supply AD usernames or select an OU structure for these identities.
This brings tenant onboarding, user administration, per-user license selection, and synchronization into the customer's Atria experience. Service desks can manage cloud identities without maintaining AD objects solely to support those users in Atria.
Entra-only customer and user management is being introduced as a preview feature in Atria 15.34. This initial release makes the new experience available while we continue to develop and improve it in future releases.
The feature is controlled by the Atria.MSOL.Entra.Prototype feature toggle and must be enabled before use. Management is available in the new UI. Review the Known Limitations before getting started.
How this differs from the existing implementation
The existing Microsoft Online service connects tenants through the Azure AD service and makes Microsoft Online user plans available for provisioning. It also supports provisioning users into both AD and Azure AD. Entra-only management adds a directory-based flow for customers who need cloud identities without corresponding AD objects.
| Area | Existing Microsoft Online implementation | Entra-only management |
|---|---|---|
| Customer setup | Connect a tenant through the customer's Azure AD service and configure Microsoft Online plans. | Select the Entra Atria Directory during customer creation, then choose a Microsoft connection, tenant, and Sync Policy. |
| Identity provisioning | Supports the existing AD-based customer and user flows, including simultaneous AD and Azure AD provisioning. | Creates and manages Entra identities without corresponding AD customer OUs or users. |
| User details | AD-based users use AD-specific account and OU settings. | AD username, SAM Account Name, and OU controls do not apply. |
| Licensing | Microsoft Online user plans control service provisioning and license assignments. | Select licenses per user in the new experience, including during user creation. |
| Synchronization | Uses the existing Azure and AD synchronization flows appropriate to the customer. | Synchronizes eligible users from the connected Entra tenant. Entra-only customers are excluded from the legacy AD user sync job while the feature is enabled. |
| Administration | Existing customers continue through their established management flow. | Entra-only customers and users are managed in the new UI; legacy management is read-only and directs you to the new UI. |
Enabling the feature preserves the existing behaviour for non-Entra customers. It does not convert an existing AD customer into an Entra-only customer.
Before you start
Ensure that:
- Your Atria installation includes the Entra-only feature and the feature toggle is enabled.
- The Entra Atria Directory has been configured and is available during customer creation.
- The Microsoft Online service and its web service connection are configured and working. See Microsoft Online Service Deployment.
- You have a working Tier 1, Tier 2, or Direct Microsoft connection and access to the tenant you want to connect. See Partner Center connections or Direct connections.
- The tenant is not already connected to another Atria customer.
- Your Atria role permits the customer and user actions you intend to perform. User synchronization requires Create User permission.
Enable the feature
An administrator must enable Atria.MSOL.Entra.Prototype before creating or managing Entra-only identities. On the Provisioning Server, use a PowerShell session with the Atria.Tools commands available and access to the Atria Platform API.
Look up the feature in your environment, then enable it using its returned unique ID:
$entraFeature = @(Get-AtriaFeature | Where-Object {
$_.Name -eq 'Atria.MSOL.Entra.Prototype'
})
if ($entraFeature.Count -ne 1) {
throw 'Expected one Entra prototype feature. Check the installed Atria version and feature configuration.'
}
Enable-AtriaFeature -FeatureUniqueId $entraFeature[0].UniqueId
Get-AtriaFeature -FeatureUniqueId $entraFeature[0].UniqueId |
Select-Object Name, UniqueId, IsEnabled
Confirm that IsEnabled is True, then open the new UI and check that the Entra directory is available when creating a customer. Enabling the toggle does not replace the directory and Microsoft connection setup described above.
The feature must remain enabled to use Entra-only workflows. When disabled, Entra user creation, synchronization, and user deletion requests are blocked. Existing Entra-only customers do not fall back to AD provisioning. Standard AD customer workflows continue to use their existing behaviour.
Create an Entra-only customer
- In the new UI, open Customers > New Customer and enter the customer's normal details.
- Select the Entra Atria Directory, shown as Microsoft Entra ID in the directory selection.
- Open the Microsoft tenant configuration step and select a Microsoft connection.
- Select the tenant to connect:
- For Tier 1 or Tier 2, search for the tenant and select the matching result. A single matching result is selected automatically.
- For a Direct connection, the tenant is taken from the connection; no tenant search is required. Direct connections already in use are not offered.
- Select the Sync Policy for the customer. Review its settings before synchronizing users.
- Review the tenant selection and provision the customer. A tenant must be selected, and duplicate tenant connections are blocked.
- Check the customer and connection status before starting user administration or synchronization.
For a Tier 1 connection, the customer experience supports Microsoft Customer Agreement attestation. Where an accepted agreement is missing, subscription synchronization is skipped, the connector remains pending, and the customer overview explains the missing agreement. Complete the agreement process before continuing. Direct connections do not require this agreement step.
When editing an existing Entra-only customer, you can update normal customer details and the Sync Policy. The directory assignment is read-only, and an active connector retains its Microsoft connection and tenant.
Create and manage users
Open the Entra-only customer in the new UI and create a user. The creation page identifies that the user will be created in Entra and that AD-specific properties do not apply.
Enter the user's supported profile details, including their name, UPN, Mail Nickname, and Recovery Email as required. The customer's Entra directory is selected by default, and only one directory can be selected for a user. Select the required licenses during creation, then submit the user for provisioning.
Usage Location is derived from the country configured on the Customer Connector. It is not entered or edited on the user page. Confirm the connector country is correct before provisioning users.
Existing Entra users can be edited through the new UI without supplying AD account or OU values. Their Entra directory assignment is preserved when changes are saved. Supported lifecycle actions include enabling, disabling, and deprovisioning the user in Entra.
Deprovisioning an Entra user requests removal of that user from Microsoft Entra. Use Disable when you intend to disable the account. Check the operation's completion status and the deletion limitations below.
Synchronize users from Microsoft Entra
From the Entra-only customer's interface, use the user synchronization action to bring eligible tenant users into Atria. The operation uses the customer's connector and selected Sync Policy.
New eligible users are created in Atria and linked to their Entra identities. Existing users are matched within the customer by normalized UPN or username and updated with supported Entra profile values. Synchronization does not change an existing user's password or role assignments, and it does not copy Usage Location from the Entra user.
Review the synchronization result for synchronized, skipped, and failed users. Resolve reported errors before treating the import as complete. Policy filtering and deletion synchronization have limitations in this preview; see the limitations below.
Licensing and billing
Per-user license selection is part of the Entra management experience. Assigned licenses and their assignment history feed into Atria billing records alongside Entra customer and user records.
In Atria licensing usage reports, Entra-only customers are represented as AzureAD usage and Entra-managed users as MSOL usage. Existing equivalent service usage is not counted a second time. These report labels do not mean that corresponding AD objects have been created.
Common Questions
How do I migrate a customer to Entra Only? Please contact our support for assistance.
How do I migrate a Customer from Entra Only to Hybrid? This is not supported in this current release, we plan to have this as a feature in the near future.
What are the licensing costs? Customers and users are billed in the same way as your existing Active Directory-based customers, on a per-user, per-service basis.
In addition, each user synchronised with a customer will incur the applicable MSOL licence cost.
What about other services? Can they be provisioned to these users? At this stage, only Workspace is supported. To enable this, please contact our support term. Custom services are additionally unsupported but there is a potential workaround if you contact our support team.
Known Limitations
This is the first preview release of Entra-only management. The following limitations apply to the preview experience. We will improve these areas and expand the feature in future releases.
- New UI management only. Entra-only customers and users cannot be modified through the legacy UI. Entra customers will not be supported in the Old UI
- Directory and tenant reassignment are not part of customer editing. Editing preserves the Entra directory assignment and active Microsoft connection and tenant. This flow does not provide an AD-to-Entra migration procedure.
- Entra Usage Location is customer-derived. A separate Usage Location cannot be entered for each user in this yet The Customer Country is set to the users usage location.
- User synchronization updates supported properties only. Passwords and role assignments are not synchronized, and Usage Location comes from the Customer Country.
- The Atria Feature must be enabled is required for ongoing operations. Turning it off blocks Entra user creation, synchronization, and deletion rather than switching them to the AD flow.
| Area | Known limitation |
|---|---|
| Synchronization policy | Include/exclude group filtering, guest eligibility, and other Sync Policy options may not behave consistently in this preview. Review which users were synchronized or skipped after each run. |
| Deletion synchronization | Automatic removal of Atria users whose linked Entra users no longer exist may not complete as expected. Check the synchronization results and affected users. |
| Customer deletion | Customer deprovisioning may fail in some scenarios. If you have any issues please contact our support team. Additionally, Partner Relationships and Subscriptions are not removed during deprovisioning. |
| Missing Microsoft Online connection | Starting Entra customer creation without a valid Microsoft Online web service connection can fail. Configure and verify the connection before onboarding customers. |