Microsoft 365 / Entra ID

Exovo integrates with Microsoft 365 two ways: user sync (members of chosen Entra ID groups become extensions automatically) and "Sign in with Microsoft" on the web client. They are deliberately independent — enabling one never enables the other, so you can sync users while keeping local passwords, or offer Microsoft sign-in without the directory managing your extensions.

Both are identity only. SIP passwords are generated by Exovo, and Microsoft credentials never reach the PBX in either mode.

The app registration

Both features are powered by an app registration in your Entra tenant (Entra admin center → App registrations → New registration):

1. Note the Directory (tenant) ID and Application (client) ID from the Overview page.
2. Create a client secret under Certificates & secrets.
3. For user sync, add Application permissions User.Read.All and GroupMember.Read.All under API permissions → Microsoft Graph — plus Contacts.Read if you'll use contact sync.
4. For SSO, add a Web redirect URI — the callback URL shown on Exovo's SSO page — and the delegated openid, email and profile scopes.

One registration can power both, or use two if you prefer separate credentials.

User sync

Admin → Integrations → Microsoft 365. Enter the tenant ID, client ID and secret, open the displayed admin consent URL once as a Global Administrator, and Test connection to confirm (it reports your organization name).

Then scope the sync: search for and add the Entra groups whose members should become extensions. Sync is group-scoped by design — there is intentionally no "sync everyone" option, so an SSO rollout can never mass-create extensions as a side effect. Nested group membership counts.

• Starting extension — new users get the lowest free number from there up, skipping anything taken or reserved.
• New extensions carry the user's name and email, and a locally generated SIP password.
• Renames and email changes in Entra flow to the extension on the next sync; the extension number never changes.
• Users removed from the synced groups (or disabled in Entra) have their extension disabled — never deleted: voicemail, recordings and call history stay, and re-adding the user re-enables the same extension.
• Extensions you created by hand are never touched, even when the email matches a directory user.

The sync runs nightly at the hour you choose, plus on demand via Sync Now. The page shows the last run's outcome ("12 in scope: 2 created, 1 updated, 1 disabled").

Contact sync

With contact sync enabled (its own switch, plus the Contacts.Read application permission), Microsoft 365 contacts mirror into the phonebook and show a Microsoft 365 source in the contacts app:

• Shared mailboxes you list (e.g. reception@contoso.com) become company-wide phonebook entries — the classic shared company address book.
• Synced users' personal contacts become entries private to that user — visible only to them, but still flagged as Microsoft 365. Individual users can be excluded with the Microsoft 365 contacts switch on their user page.

Mirrored contacts are read-only copies: edits belong in Microsoft 365 and flow in on the next sync, contacts deleted there disappear here, and turning contact sync off removes all mirrored entries (manually created contacts are never touched). Phone numbers are normalized to +E.164 where possible, so caller-ID matching lights up names on inbound calls.

Sign in with Microsoft

The connection you configured above also powers "Sign in with Microsoft" — no second entry anywhere. Flip it on under Integrations → SSO, where the Microsoft 365 method shows this connection's status and the two things the app registration still needs for sign-in (the Web redirect URI and the delegated scopes). The button itself is fixed Microsoft branding, and it can run alongside a custom OIDC provider. Users are matched to extensions by email address, which pairs naturally with user sync keeping those emails current.