Setting-Up a User Sync

Getting Started with User Sync

The Recognize user sync is a process that provides a way for companies to keep their Recognize user directory in sync with their corporate user directory. Once initial settings are established, the user sync options allow you to manage your users in Recognize automatically.

How it Works

We connect to the identity provider and user directory of your choice (see below) and synchronize the users based on a few parameters. You can sync your entire organization or you can pick groups to synchronize. You can also manually initiate a sync at any time via the Settings page in the company admin portal. The time it takes to execute a full sync depends on the size of your directory and the size of the queue in our background tasks server. For most of our customers, it can range from 15m to 2 hours. The user sync is run nightly or weekly depending on your subscription package.

How Sync Updates Existing Accounts

Sync updates supported employee attributes from your directory. For Microsoft sync, Recognize uses the Microsoft Graph user ID to match existing records across syncs.

Users no longer included in the configured directory sync are disabled. They lose account access, while recognitions they sent and points awarded to recipients remain. Review group scope carefully before changing which employees are included.

Identity Providers

We currently support user syncing through Yammer and the Microsoft Cloud (i.e, EntraID, formerly known as Azure AD). We offer an SFTP (secure file transfer protocol) option as well. To learn more, please see our Recognize SFTP Integration Guide.

If you do not want to or cannot sync your user directory, we support "just-in-time" user provisioning. This is where we create accounts and permit access to Recognize when a user logs in via OAuth or SAML. For SAML setup and authentication guidance, see our Single Sign-On (SSO) Overview for Recognize.

What information can we sync?

You can specify if you would like to sync Recognize Teams to your directory’s groups to more closely mirror your internal structure. Some of the other information that we currently allow includes: 

• email
• first name & last name
• phone number (optional, mobile phone for SMS notifications)
• display name (optional)
• manager (optional)
• birthday(optional, day/month only)
• hire date (optional, not available with Yammer)
• job title (optional)
• location (optional)
• department (optional)
• country (optional)

Custom Fields & Attribute Mapping

If birthdays, hire dates, locations, departments, or other data are stored in custom Microsoft attributes, Attribute Mapping can connect them to the appropriate Recognize fields. This feature is available for Enterprise customers or as an add-on.

Go to Company Admin > Settings > User Management > Attribute Mapping > Manage. Select the provider type, enter the Microsoft key/schema ID, configure the Recognize attribute and mapped user attribute, then save. Use the same provider type for all mapped attributes.

Contact support@recognizeapp.com before mapping to a custom Recognize field so Support can create it first. See Microsoft Sync Attribute Mapping for the full steps.

Are notifications or invites sent out?

When users are synced, they are provisioned with an account and added to the Recognize directory, but no emails or notifications are sent out. We have a "bulk invite" feature on our User tab page in the Company Admin portal where you can customize the invitation email and send it out at a time of your choosing. We also offer an 'auto-invite' feature (mentioned in the settings below) which works well for inviting users who join the company after your initial launch. See our article on how to invite users to Recognize for more information.

Set Up a Service Account

A dedicated service account keeps the sync connection independent of an individual employee. Ask your Microsoft administrator to create the Microsoft account and provide the permissions needed for the connection.

1. In Recognize, go to Company Admin > Users > Bulk Edit, select Add User, enter the service account details, then select Save and Done.
2. Find the service account on the Users page. Remove the Active filter if the account is not visible.
3. Grant the service account Company Admin access using the Admin column. See Adding or Removing a User's Company Admin Access.
4. If a Recognize password is needed, use the current Resetting a User’s Recognize Password instructions.
5. Sign in to Recognize as the service account in a separate private/incognito browser session, then connect to Microsoft using the corresponding Microsoft account. This prevents your existing personal session from becoming the sync owner.

What are the steps to set up user sync?

You can establish a user sync from within the Recognize Company Admin portal. A best practice for setting up the user sync is to first create a Service Account in your Microsoft tenant (which can typically be done by a Global Microsoft administrator) and then create a corresponding Service Account within Recognize with a Company Admin designation. Make sure the Service Account created in Microsoft has a role that can grant the below permissions. Once you have established these, log in to Recognize with the Recognize Service Account credentials, and establish the sync owner (steps shown below) as the Service Account.

Permissions needed for Service Account in Microsoft:

• offline_access
• User.Read
• User.ReadBasic.All
• GroupMember.Read.All
• Directory.Read.All

Steps to set up the sync:

1. Select 'Menu' from the top right corner of the screen

2. Select 'Company Admin' from the drop-down to open the Company Admin portal

   NOTE: If you do not see this option, it means you haven't been made a Company Admin for the Recognize platform, and you'll need to reach out to the business owner within your organization to grant this access.
   
    

3. Select 'Settings' from the left side menu to take your to your organization's platform settings and configuration
4. Select 'User Management' from the right-hand navigation pane
5. Under the section for 'User sync,' you'll see a drop-down to choose your sync provider, where you'll select 'Microsoft/Office 365'
6. You'll also see a toggle to 'Enable sync,' which will set your user sync to run at the next scheduled nightly run
7. Additionally, there will be a set of options for what you'd like to include in your sync, where each can be toggled on or off independently - make sure that each of the fields you choose to turn on has corresponding data to be brought in, and for any fields that don't, keep the toggle 'OFF'
8. Only a Microsoft administrator for your company will be able to facilitate the initial linking of your Microsoft data with the Recognize platform by clicking the 'Microsoft' button under 'Connect with Microsoft/Office 365 to pull in user data'
9. Anyone with Company Admin access will be able to test the connection of the sync by selecting the 'Test Connection' button
10. Company Admins are also able to select 'Run User Sync' if they'd like to run the sync to refresh data on demand
11. The Sync owner can be clearly identified in this section as well to show who to contact regarding the sync set-up
12. Note that only a Global/Microsoft administrator will be able to make any changes to the sync configuration or re-authenticate the token, which is why we highly suggest naming a Sync Owner
13. Lastly, you will find the 'Auto send invites' setting in this section as well - we recommend turning this on only after you've launched and sent initial invites
    
     
14. Global Administrators that are setting up the user sync will also see additional options, one of which will be the ability to sync specific groups from Microsoft/Office 365 - if no groups are specified, the entire company will be synced
15. Global Administrators can also determine whether disabled users can be synced (or not synced) under the 'Sync Options' section
16. Global Administrators can also sync teams directly from Microsoft/Office 365 if desired
    
     

Resolving Microsoft / Office 365 Re-authentication Issues in Recognize

Occasionally, it may be necessary to re-authenticate with Microsoft / Office 365. We recommend a dedicated service account so the connection does not rely on an individual employee. If you need to create one in Recognize, follow Set Up a Service Account before re-authenticating.

Then, follow these steps to successfully re-authenticate the connection:

1. Navigate to the 'Company Admin Portal' in Recognize

2. Within Company Admin, select 'Settings' from the left side menu

3. Scroll down to locate the 'User Management' section within the Settings menu

4. Click on the Authenticate with Microsoft / Office 365 button to initiate the re-authentication process
   

   
   
5. After you have successfully re-authenticated with Microsoft/Office 365, toggle the Enable Sync setting to ON to resume the connection. *Please do not re-enable this setting until the authentication connection is successfully reestablished. 
   

If you have any questions, please contact us at: support@recognizeapp.com.

 

Back to top