In this article

Network administrators use this article to connect Microsoft Entra to DNSFilter using Identity Sync. Identity Sync allows user and group memberships from Entra to drive filtering policy assignment in DNSFilter through Collections, providing more granular control over filtering based on who is logged in to a managed device.

Overview

Identity Sync connects Microsoft Entra to DNSFilter so filtering policies follow users and groups. All setup happens in the DNSFilter dashboard. DNSFilter creates and runs the Entra provisioning application automatically, so no manual setup is needed on the Entra side.

Filtering is managed through Collections. A user receives a filtering policy when added to a Collection that has a policy assigned. Saving a Collection automatically updates what Entra provisions, so the Entra side stays in sync with no manual steps.

DNSFilter shows every user and group in the Entra tenant, so members are chosen from the full directory. Organizing users into groups in Entra before setup keeps that selection simpler.

Prerequisites

• Microsoft Entra admin access with permission to grant admin consent
• Microsoft Entra ID P1 license or higher to assign groups to a Collection; assigning individual users does not require a premium Entra license
• DNSFilter account with admin permissions or higher
• Roaming Client agents deployed on managed devices

Key concepts

Identity Connection

A DNSFilter entity representing a Microsoft Entra tenant that has granted admin consent. Required for DNSFilter to display live Entra users and groups and to create and maintain a provisioning application in Entra.

Collection

A DNSFilter grouping that applies filtering policies and block pages to a defined set of users. Collections pull membership from Entra users and groups through the Identity Connection.

Provisioning

The process by which Entra pushes user and group data to DNSFilter at regular intervals. DNSFilter configures and starts provisioning automatically. Once active, membership changes are reflected in DNSFilter automatically approximately every 40 minutes.

✍️ Nested group memberships are not supported. If a parent group is added to a Collection and a user moves between sub-groups, that change is not reflected in DNSFilter.

Step 1: Create an Identity Connection

1. From the DNSFilter dashboard, navigate to Identities and select Identity Connections
2. Select Create and enter a name for the connection
3. Select Authorize

DNSFilter redirects to Microsoft to request admin consent. Grant consent to complete the redirect back to the DNSFilter dashboard.

The Identity Connection is created, and DNSFilter configures the provisioning application in Entra in the background. Wait for the status indicator in the Identity Connection list to switch to No Data before proceeding.

Step 2: Configure a Collection in DNSFilter

1. From the DNSFilter dashboard, navigate to Identities and select Collections
2. Select Create or open an existing Collection
3. From the Source dropdown, select the Identity Connection created in Step 1
4. Add the applicable Entra users and groups as Collection members
5. Assign a filtering policy and block page if applicable
6. Select Save

A Collection supports up to 1,000 individually selected users across all sources. To include more users than this limit, add groups instead—group membership syncs in full from Entra with no per-user limit.

After the Collection is saved, DNSFilter automatically updates the Entra provisioning scope to match the Collection members and begins sending data. No further setup is required in Entra.

What to expect after setup

Provisioning starts automatically once an Identity Connection and a Collection are in place. No manual start is required in the Entra portal.

Entra provisions on a regular cycle of approximately 40 minutes, so the first sync can take up to 40 minutes to appear in DNSFilter. After the first sync, changes to Collection membership are picked up automatically on each cycle, and filtering policies are applied as membership changes.

⚠️ During the initial provisioning sync for a large Entra directory (thousands of users or groups), the Edit Identity Connection page may briefly display a Syncing with Errors status. This is a display-only issue during the in-flight sync, not an actual error. 

To confirm, review the connection in the Microsoft Entra portal under the Enterprise Application's Provisioning page. If the sync shows in progress with no errors there, no action is required; the DNSFilter status updates to Active automatically once the cycle completes.

Monitor Identity Connection status

The Identity Connection dashboard displays the timestamp of the last successful sync and connection statuses. A populated timestamp confirms at least one successful provisioning request has been received from Entra.

If provisioning encounters an error, the Identity Connection enters an error state. The status clears automatically after the next successful sync. Select an individual Identity Connection to view the Entra-side provisioning application status.