A role is normally handed out by an administrator, one person at a time, in Team. A linked role is handed out by Microsoft Entra instead: you name one or more Entra groups on the role, and anybody in those groups gets the role when they sign in.
It suits roles with many holders, such as a service desk. Joiners and leavers are then handled where you already handle them, in Entra, and nobody has to remember to update Eido.
Linking is set on a custom role, on the General tab of the role editor under Admin, then Roles. Only an instance-level administrator can open it. Roles covers the rest of the editor.
The rules in short#
- Group membership is checked when a person signs in, and at no other time.
- A person in a linked group gets that role, whatever role they held before.
- A person whose role is linked, and who is no longer in any of its groups, is refused at sign-in.
- A group never changes an administrator. Somebody with the Admin role keeps it.
- An account is created automatically only if the role says so. That switch is off unless you turn it on.
- A person an administrator removed is never brought back by a group.
- Only groups from an Intune tenant connected to Eido can be linked.
The rest of this article is those rules in detail.
Link a role to groups#
-
Open the role
Go to Admin, then Roles. Press New Role, or press an existing custom role.
-
Switch the assignment
On the General tab, under Assignment, set Assigned by to Entra groups.
-
Pick the groups
Open Entra Groups and type part of a group’s name. Tick each group you want. You can also paste a group’s object ID into the search box.
-
Decide about new people
Leave Create users who are not in Eido yet off if everybody who needs the role is already in Team. Switch it on to let group members sign in with no user set up for them.
-
Save
If account creation is on, Eido asks you to confirm before it saves.
A linked role needs at least one group, and can have up to 50. Save stays disabled until a group is picked.
The role’s customer scope and its rules on the Permissions tab work exactly as they do for any other role.
Which groups can be linked#
Only groups that Eido already knows from the Intune tenants you have connected. See Intune tenants. The search looks through those groups and nothing else, so a group from a directory you have not connected to Eido is never offered. Linking is intended for Entra security groups.
Each group in the list shows the tenant it belongs to and how many members Eido can see. That is worth a glance before you save, as it tells you how many people the link reaches.
Pasting an object ID is a shortcut for finding a group, not a way around the search. An ID is only offered as a choice if it belongs to one of your connected tenants. A mistyped ID, or one from another directory, is not offered at all.
A group you have only just created in Entra appears once Eido has next synchronised that tenant.
No extra permission is needed#
Linking uses the group list that Microsoft includes with each person’s sign-in. You do not grant Eido any further permission in your tenant to use it, and there is no consent screen.
What happens at sign-in#
Every time somebody signs in, Eido compares their Entra groups with the groups on your linked roles.
| The person | What happens |
|---|---|
| Is in a linked group, and already holds that role | They sign in. Nothing changes. |
| Is in a linked group, and holds a different role | Their role is changed to the linked role, and they sign in with it. This applies whether their old role was linked or assigned by hand. |
| Holds a linked role, and is in none of the groups linked to any role | Sign-in is refused. They are told their access has been removed because they are no longer a member of the group. |
| Holds a role assigned by hand, and is in no linked group | They sign in as normal. Linking does not touch them. |
| Holds the Admin role | They sign in as an administrator, whatever groups they are in. |
| Has no user in Eido, and is in a group on a role that creates users | An account is created with that role, and they sign in. |
| Has no user in Eido, otherwise | Sign-in is refused, as it is for anybody without a user. |
| Was removed from Team | Sign-in is refused. No group brings them back. |
When somebody leaves a group#
Nothing happens until they next sign in. At that sign-in they are refused.
Their user is not deleted and their role is not changed on their record. Team still lists them with the role, and the role’s count of assignments still includes them. That is deliberate: put the person back in the group, or switch the role back to An admin, and they are let in again at their next sign-in with nothing to set up again.
Administrators are never moved#
Somebody who holds Admin is left alone by linking. An administrator who happens to be in a group linked to a lesser role is not demoted at their next sign-in, and one who is in no linked group is not locked out.
The built-in roles cannot be linked either, so Admin is always given by hand in Team. There is always a way back in that does not depend on your directory.
When somebody is in groups for two roles#
They get the role nearer the top of the Roles page. Roles are listed oldest first, so the role you created first wins. There is no setting to change the order.
If that matters to you, keep the groups on your linked roles from overlapping.
Creating accounts automatically#
Create users who are not in Eido yet is a switch on each linked role. It is off by default.
With it on, a member of the role’s groups who has no user in Eido can still sign in. Eido creates their account at that moment.
| About the new account | Detail |
|---|---|
| Name | Their display name from Microsoft, or their sign-in address if there is none. |
| Role | The linked role. |
| Customer access | Never restricted to a single customer. They see whatever the role’s customer scope allows. |
| Welcome email | None is sent. The person has already signed in. |
| Approval | None. The account is created as soon as they sign in. |
Because there is no approval step, saving a role with this switch on asks you to confirm. The message names the role, says how many groups are linked and how many people Eido can see in them, and says which customers the role can read. Press Yes, create users to go ahead.
The role editor shows how many people the role has created so far, and the Roles page shows the same figure as N created by this role.
Three limits apply:
- Removed people are not recreated. Somebody an administrator removed in Team stays removed, even if they are still in the group.
- The winning role must be the one that creates users. If a person with no account is in groups for two linked roles, Eido works out which role they would get, using the order above. An account is created only if that role has the switch on. Otherwise sign-in is refused, as it would be for anybody without a user.
- Administrators are not created this way. A linked role is never an administrator role.
Linking a role people already hold#
When you switch an existing role to Entra groups, the editor warns you how many people hold it today.
They keep the role until they next sign in. From then on membership decides: anybody who is not in the groups is refused at sign-in.
Before you save, make sure everybody who should keep the role is in one of the groups, or move the others to a different role in Team.
Linked roles in Team#
Nobody assigns a linked role by hand.
- A linked role is not offered in the Role list when you add or edit a user.
- When a person already holds one, the Role box on their user is greyed out, with a note that the role comes from Entra group membership.
To add somebody to a linked role, add them to the group. To invite somebody by hand who is also in a linked group, give them any role in Team: the group gives them the linked role at their first sign-in.
Reading the status of a link#
The Roles page and the role editor tell you whether a link is working.
| What you see | Where | Meaning |
|---|---|---|
| From Entra | Roles page | The role is handed out by group membership. |
| Creates users | Roles page | The role may create accounts. |
| N groups | Roles page | How many groups are linked. |
| N assignments | Roles page | How many people hold the role today, including anybody who would now be refused. |
| N created by this role | Roles page | How many accounts the role has created. |
| N groups not matched | Roles page | Linked groups that no sign-in has matched yet. |
| not matched yet | Under a group, in the editor | Nobody who has signed in since the link was made was in this group. |
not matched yet is normal on a new link. It clears the first time any member of the group signs in to Eido, whether or not their role changes.
Switching a role back#
Set Assigned by to An admin and save. The groups are removed from the role and it stops creating users.
Everybody who holds the role keeps it. Only the way it is handed out changes: from then on you assign it in Team.
Troubleshooting#
A group still says not matched yet#
Somebody in the group has to sign in to Eido after the link is made. Ask a member to sign out and in again.
If it still does not clear, check that it is the group you meant, and that the person who signed in really is a member of it. If no group on any of your linked roles has ever been matched, contact support.
Somebody is told their access has been removed#
Their role is linked and they are in none of the linked groups. Add them back to the group and ask them to sign in again. Nothing needs changing in Eido.
Somebody is told their group membership could not be read#
Microsoft did not send Eido that person’s list of groups, and their role depends on it. Ask them to try again.
Microsoft leaves the list out for people who are members of a very large number of groups, around 200 or more. For somebody in that position, give them a role assigned by hand instead of a linked one.
People whose role is assigned by hand are not affected: they sign in as normal even when the list is missing.
Somebody got a role I did not expect#
They are in a group linked to that role. A person in a linked group gets the linked role even if you gave them a different one by hand, unless they are an administrator. If they are in groups for two roles, the older role wins.
A group member with no account was not created#
Check, in this order:
- Create users who are not in Eido yet is on for the role.
- The person is not also in a group for an older linked role that has the switch off.
- The person was not removed from Team in the past. To let them back in, add them again in Team with the same email address.
I cannot find a group in the search#
It has to belong to an Intune tenant connected to Eido. A new group appears after the tenant has next synchronised.
A linked group was deleted in Entra#
It stays on the role until you remove it, and does no harm. It does not stop you saving other changes to the role.