In this article
This article covers frequently asked questions about setting up and managing Identity Connections with Microsoft Entra.
| Question | Answer |
| Does setup require action in the Entra portal after completing the DNSFilter connection? |
No. Setup is completed entirely in DNSFilter. After the connection is authorized, DNSFilter creates the provisioning application in Entra, starts provisioning automatically, and updates the provisioning scope automatically as Collections are saved. No users, groups, or provisioning settings need to be configured in the Entra portal. |
| Why did DNSFilter create two applications in Entra? |
DNSFilter creates two enterprise applications during the authorization flow. The first grants read access to the directory, used to browse users and groups when building Collections. The second handles the SCIM provisioning job that syncs users and groups into DNSFilter. Microsoft Entra requires these to be separate applications. |
| What happens if a connection is deleted? |
Deleting a connection permanently removes all provisioned users and groups from DNSFilter, strips them from any Collections they belong to, and disassociates them from active Roaming Client sessions. Affected users fall back to the next available policy assignment: LAN Subnet, Roaming Client, or Site. This action cannot be undone. Create a new connection to restore syncing. |
| How long does the initial sync take? |
Provisioning starts automatically once an Identity Connection and a Collection are in place. The first sync may take longer than later syncs, depending on directory size, and can take up to approximately 40 minutes to appear in DNSFilter. After the first sync, Entra sends incremental updates approximately every 40 minutes. |
| Does adding users to a Collection in DNSFilter also scope them for provisioning in Entra? |
Yes. Saving a Collection automatically updates the Entra provisioning scope to include its members. The scope reflects the full set of users and groups across every Collection that uses the same Identity Connection, so no manual scoping in the Entra portal is required. Because a Collection can use more than one Identity Connection as a source, saving one Collection can update the scope of more than one provisioning application. |
| Are nested groups supported? |
No. This is a constraint of the Microsoft Entra SCIM provisioning protocol and cannot be changed. When a parent group is selected, groups nested inside it are not automatically included. All groups appear individually in the Collection edit picker and must each be added individually. For organizations with complex directory structures, Entra dynamic groups are the Microsoft-recommended approach. Dynamic groups use membership rules to populate a flat group that syncs cleanly. |
| Does this work for hybrid environments? | Yes. DNSFilter supports both cloud-only Entra users and hybrid users created in on-premises Active Directory and synced to Entra. The legacy AD Sync Tool is not required for users who are in Entra. |
| Can multiple Entra tenants be connected? | Yes. Multiple Identity Connections can be created—one per Entra tenant—with no limit. Each connection is managed independently. |
| Can the connection be set up via API? | Not fully. The OAuth authorization redirect to Microsoft must be completed through the DNSFilter dashboard. After the connection is established, Collections and users can be managed through the standard API. |
| What happens if provisioning is paused in Entra? | Existing synced users and groups remain in DNSFilter and continue to receive their assigned policies. New directory changes stop flowing while provisioning is paused. |
Comments
0 comments
Please sign in to leave a comment.