> ## Documentation Index > Fetch the complete documentation index at: https://docs.oloid-demo.com/llms.txt > Use this file to discover all available pages before exploring further. # How to Configure Advanced User Sync in Microsoft Entra ID Admin Console > This document provides step-by-step instructions to Configure Entra ID for Advanced User Sync in the Microsoft Entra ID Admin Console. ## Introduction This document explains how to register and configure an application in **Microsoft Entra ID** and enable **FIDO2 (Passkey)** authentication for integration with the Tenant Admin Portal. ## Prerequisite You must have Tenant Admin Access for Microsoft Entra ID. ## Steps to Configure Microsoft Entra ID for Advanced User Sync 1. [Register an Application](#register-an-application) 2. [Configure the Application](#configure-the-application) 3. [Create Client Secret](#create-client-secret) 4. [Enable FIDO2 Authentication](#enable-fido2-authentication-in-azure-portal) Microsoft Entra ID is configured Successfully. ### Register an Application 1. Log in to Azure Portal and select **Microsoft Entra ID** on the home page. ![How to Configure Advanced User Sync in... - screenshot 1](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/aff19387-f8d9-4670-a7cb-ce371450db4e-41197c65.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=f32305f77aa1852aebcd689fab3645b1) The Microsoft Entra ID page is displayed. 2. Go to **Overview > Manage** **> App registrations > New registration**. ![How to Configure Advanced User Sync in... - screenshot 2](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/e02687c4-25cf-49f0-81a7-e6a3386ee0b1-e8e7b925.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=69a6409c1808be98a5536e291be6ee06) The Register an application page is displayed. 3. Do the following. 1. Enter **Name**. 2. Select Supported account types. > [!NOTE] > > **Note:** Select Accounts in this organizational directory only. 3. Click **Register**. ![How to Configure Advanced User Sync in... - screenshot 3](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/1a274bb9-0d50-49db-8149-afb78624e212-a0f29545.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=6b0f3a84c5e92daf2c005ba2ffa761ab) The application is registered successfully. ### Configure the Application 1. Navigate to the **newly registered app > API Permissions >** **Add a permission > Microsoft Graph.** ![How to Configure Advanced User Sync in... - screenshot 4](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/image-68e341e3.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=ea311ca22c6d120d590b898d0b2412ae) The **Request API Permissions** pop-up box is displayed. 2. Select **Application permissions**. ![How to Configure Advanced User Sync in... - screenshot 5](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/55f4749d-f9c8-4a95-91be-e0a9cd108acd-289b3f95.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=751ad89dfd756a643665044261355ab7) The **List of API** permissions is displayed. 3. Do the following: 1. On **User** drop-down, select the following: 1. User.Read.All 2. User.Read Basic.All (Optional). ![How to Configure Advanced User Sync in... - screenshot 6](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/993b5cec-aaa7-43b6-8757-94bf29c67ff4-10901071.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=a177b3d40470ee60f1345f92fe48c097) 2. On **GroupMember** drop-down, select the **GroupMember.Read.All** ![How to Configure Advanced User Sync in... - screenshot 7](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/image-40850ee1.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=ddd69ae07f1a5c2d7198dba33cf9a5ea) 3. On **UserAuthenticationMethod** drop-down, select the **UsersAuthenticationMethod.ReadWrite.All** ![How to Configure Advanced User Sync in... - screenshot 8](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/5069da94-bcf2-4ee6-ada7-f494355b56e2-17870abb.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=7210b33d4cde45fc70ce4ffed51e98aa) 4. On **Policy** drop-down, select the following: 1. Policy.Read.AuthenticationMethod. 2. Policy.ReadWrite.AuthenticationFlows. ![How to Configure Advanced User Sync in... - screenshot 9](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/7e69b117-803b-4155-8094-2f53dcc86b60-4b510786.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=83fe9f546ec131f003f4d2c849aded0e) 5. Click **Add Permissions.** The Permissions are listed on the API. 6. Click **Grant admin consent for Oloid inc.** ![How to Configure Advanced User Sync in... - screenshot 10](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/image-0df62394.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=145c5cb350c14f7a607d5edff01c5f66) The **API Permissions** are successfully created. ![How to Configure Advanced User Sync in... - screenshot 11](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/image-a87e08e3.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=deb898fe5f4d7520de320c74753c5ed8) ### Create Client Secret 1. Go to **Certificates & secrets** > **Client Secrets > + New client secret**. ![How to Configure Advanced User Sync in... - screenshot 12](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/f6ad3e20-d7ef-467e-aef6-ff25b63f6f99-ce5c2871.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=ca755382bc1d080aa27777643399519c) The **Add a client secret** screen is displayed. 2. Do the following: 1. Enter **Description**. 2. Select the **Expires** duration from the drop-down list. > [!NOTE] > > **Note:** Select 365 days (12 months). 3. Click **Add**. ![How to Configure Advanced User Sync in... - screenshot 13](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/a685fa2c-98c4-4dc7-b0a1-2d2fa871b2ab-4b0ec585.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=5c53c284e9b0d26b1626a3312b119f75) The **Client Secret** is added successfully and listed on **Client Secret** tab. > [!NOTE] > > **Note:** Click on the **Copy to Clipboard** icon next to the value field to copy the secret. This option is available only at the time of creation. ![How to Configure Advanced User Sync in... - screenshot 14](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/8cb1df9b-80b0-4fbb-8188-f48cb035c4da-99cf9d13.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=35929ed0d3b1961348693e402ab0de7c) 3. Go to **Overview** and copy the values of **Client ID** and **Directory** (**Tenant) ID**. ![How to Configure Advanced User Sync in... - screenshot 15](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/image-b703961d.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=2eee0a7407f72560ca6dd145aa945b94) The application is configured successfully. ### Enable FIDO2 Authentication in Azure Portal 1. Go to **Tenant Overview > Manage > Security** in the vertical navigation menu. ![How to Configure Advanced User Sync in... - screenshot 16](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/e342cb49-37f1-4542-a209-9fbbddc54292-c2af1e0d.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=29a472ba2d8d53e0c9fa0694e9d1bae2) 2. Go to **Security > Manage > Authentication Methods**. ![How to Configure Advanced User Sync in... - screenshot 17](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/577f9f41-2abe-46df-ae8c-a381532062dc-3a95a6e4.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=2714de6bc93586dc608cd7415e8575dd) The Authentication page is displayed. 3. Go to **Manage > Policies**, select **Passkey (FIDO2)** in **Authentication method policies** table. ![How to Configure Advanced User Sync in... - screenshot 18](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/274538f6-b12f-4c9e-b6c2-c96f294d0453-1d2d1d15.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=867b39d1729b1bbb046a3e7e97394906) The Passkey (FIDO2) setting page is displayed. 4. Click **Enable and Target** tab and do the following: 1. Enable the toggle. 2. Select **All User** as Target. > [!NOTE] > > **Note:** If you want all users to use FIDO2 authentication. 3. Click **Save**. ![How to Configure Advanced User Sync in... - screenshot 19](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/image-422b8a70.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=fad13b765510e669663b5f1d594cb948) The **Enable and Target** tab is configured successfully. 5. Click **Configure** tab and do the following: 1. Select Allow Self-Service set up **Yes**. 2. Select Enforce Attestation **No**. 3. Select Enforce key restrictions **No**. 4. Select Restrict specific key **Allow**. 5. Click **Save**. ![How to Configure Advanced User Sync in... - screenshot 20](https://mintcdn.com/oloid-999c42b2/IlzLeflHLQ-bTbO_/images/intercom/13607433/image-1bc9893e.png?fit=max\&auto=format\&n=IlzLeflHLQ-bTbO_\&q=85\&s=c646c4a7edab7bb52adef81fc4eebb13) The Configure tab is configured successfully. FIDO2 is successfully configured. ##### Related Documents [How to Configure Advanced User Sync for Entra ID - Inbound in the Tenant Admin Portal](https://oloid.help/en/articles/13598396-how-to-configure-advanced-user-sync-for-entra-id-inbound-in-the-tenant-admin-portal)