Set up Microsoft Online Connector for SyncPortal

The cloud-based user identity and authentication service Azure Active Directory (Azure AD / Office 365) can be synchronized to MRI OnLocation using an Azure Automation runbook.

First, you will need to create a new automation account in the Azure Portal. Then you can use the Powershell script provided in the Sync Profile Connectors of your SyncPortal to create a SyncPortal Runbook.

This will give you the ability to automatically sync employee information with OnLocation from your Azure AD.

Creating a new automation account in the Azure portal

You will need to sign in to the Azure portal with an account that's a member of the subscription Administrators role and a co-administrator of the subscription.

  1. Select Create a Resource.

  2. Search for and select Automation.

  3. Click Create at the bottom of the page.

You may be prompted to create a free account, if so, click Start free and go through the set up steps to create your account.


Once created, return to the Azure dashboard and follow the above steps again to create the resource.

You will see an Add Automation Account pane to add your details.

  1. Enter a Name.
  2. If you have more than one subscription, specify the Subscription you want to use.
  3. Enter a new or select an existing Resource Group.
  4. Select an Azure data center Location.
  5. For the Create Azure Run As account option, ensure that Yes is selected.
  6. Click Create.


Your Automation account will be created and deployed. Wait for an in-app notification to let you know deployment is complete before continuing.

Setting up the OnLocation SyncPortal runbook

To set up the runbook, you need to install the MSOnline Module and create two credentials. This is done from the Automation Account resource. Access this by selecting All Resources from the left-hand menu and select your Automation Account resource from the list.

Install MSOnline Module

Our Runbook requires the MSOnline module to be installed. This is not set up as a default option and will likely need to be added.

  1. Select the Modules section from the resource menu under Shared Resources.


    If the module is not present it can be installed from the Gallery.
  2. Click Browse gallery.

  3. Search for MSOnline.
  4. Select the module.

  5. Click Import.

  6. Click OK on the next window to confirm.

This will install the module to your Automation Account resource. You can close the MSOnline Module and Browse Gallery windows.

Create credentials

Our Runbook requires two credentials to be configured, WolSyncExportCredential and WolSyncUploadKey.

To add each credential:

  1. Select Credentials from the resource menu under Shared Resources.
  2. Click Add a credential.


Wol sync export credential

This is used by the script to authenticate to your AzureAD using the Connect-MsolService cmdlet.

Add this using the name WolSyncExportCredential, then enter in a valid AzureAD account's User name and Password which has export permissions over your directory.

This user must:

  • Have at least the Directory Readers role. Check the Microsoft Docs website for more information. 
  • Not have multi-factor authentication enabled. 


Wol sync upload key

This is your OnLocation SyncPortal profile key, it authenticates the upload and routes the uploaded data to your SyncPortal profile for import.

The Key is found in your Sync Profile and each Key is unique to that profile. Have a look at the Helpdesk article Sync Profile Connectors in the Azure AD section for where to find the Key.

To add this credential, use the following configuration:

  • Name - WolSyncUploadKey.
  • Description - This is optional and not required for your sync.
  • User name - This is ignored by our system so use a placeholder such as 'key'.
  • Password - Enter the Sync Profile Key here and repeat in Confirm Password.


Export group (optional)

The Runbook can optionally export the user list from a distributor/security group instead of the entire user directory.

To configure the export group select Variables from the resource menu under Shared Resources and click Add a variable.


Add this using the name WolExportGroup and enter in a valid AzureAD group name in to the value, this must match exactly. To disable export by group membership simply delete this variable and the Runbook will go back to exporting all users.


Import runbook

With your credentials set up, you can now import the runbook from OnLocation to your Automation Account resource. This will run the sync when the resource is activated.

First, you will need to download the runbook from your Sync Profile in OnLocation. This is in the same section as the Sync Profile Key under the Sync Profile Connectors tab. Once you have downloaded this runbook:

  1. Select Runbooks from the resource menu under Process Automation.
  2. Click Add a runbook.

  3. Select Import an existing runbook.
  4. Click the file icon next to Runbook file.
  5. Select the runbook downloaded to your computer.

    The rest of the details will fill automatically.
  6. Click Create.


The runbook will be imported and configured but needs to be published before you can schedule a sync. From the Runbooks section:

  1. Select the runbook you just created.

  2. Click Edit.


    This will show you the Powershell script which can be used as-is or modified to suit your needs. Make any modifications you require before publishing.
  3. Click Publish.

  4. Click Yes on the confirmation.

Your runbook will be installed, published, and ready to run your sync.

Run your sync

You can run your sync manually or automatically from the WolSync runbook overview.

  1. Select Runbooks from the resource menu under Process Automation.
  2. Select the WolSync runbook.

Running manually

You can run your sync manually at any time by clicking Start and selecting Yes on the confirmation pop-up.


Running automatically

To set your sync to run automatically, you need to create a schedule to tell the runbook when to run.

  1. Click Schedule.

  2. Select Link a schedule to your runbook.
  3. Click Create a new schedule.
  4. Add a Name.
  5. Enter when the sync should start.
  6. Select if it is to run Once or be Recurring.
  7. If recurring, set the frequency under Recur every.
  8. Choose if you want to set an expiration. This will stop the recurring sync on the date chosen.
  9. If expiring, set the expiry date.
  10. Click Create.


Tips for running your sync

We recommend using 'Do not import anything (Dry Run)' for the SyncPortal profile mode when first deploying this runbook.

This allows the file to be uploaded and processed without actually changing anything in OnLocation, the profile logs can then be used to ensure the data will be imported as expected.

Once satisfied all is set up correctly, it is recommended to change the profile mode to 'Update existing items and import new (ALL)' and set the runbook on a regular automated schedule.