Sync Microsoft Entra ID (Azure AD) Groups to Slack User Groups
SyncMyGroup team · September 28, 2026
If your company runs on Microsoft 365, team membership already lives in Entra ID (formerly Azure AD) groups. Your Slack workspace probably has a matching set of user groups — @finance, @platform, @it-helpdesk — that someone maintains by hand. The two drift the way they always do.
Entra ID has a built-in Slack integration that can provision users and groups. It's the right answer for some teams and a poor fit for others. This post explains what it does as of 2026, where it stops, and the alternative when it doesn't fit.
How Entra ID provisioning to Slack works
Microsoft's tutorial for the Slack gallery app (Microsoft Learn, updated 2026) lists these capabilities:
- Create users in Slack
- Remove users in Slack when they no longer need access
- Keep user attributes in sync between Entra ID and Slack
- Provision groups and group memberships in Slack
- Single sign-on to Slack
Under the hood it uses Slack's SCIM API. You add the Slack app from the Entra gallery, authorize it with a Slack admin account, choose which users and groups are in scope (by assignment or by scoping filter), review attribute mappings, and start provisioning. Groups map with two attributes: displayName and members.
On Slack's side, SCIM on a Business+ plan creates workspace-level user groups; on Enterprise plans it creates org-level user groups (Slack help center, 2026).
The constraints to know before you start
Slack plan. Microsoft's tutorial says the Slack tenant must be on the Business+ plan, with Enterprise customers following Slack's own SCIM instructions instead. Slack's help center lists SCIM provisioning as available on Business+ and Enterprise. If you're on Slack Pro, this path isn't available without upgrading.
Provisioning cycle. Entra's provisioning service runs incremental cycles on a schedule, which Microsoft's documentation describes as typically every 40 minutes. A change in Entra reaches Slack on the next cycle, not immediately. On-demand provisioning exists for testing individual users.
Nested groups. Microsoft's provisioning documentation says the service can't read or provision users in nested groups; it handles only users who are immediate members of an explicitly assigned group. If Engineering contains Platform and Data as member groups, assigning Engineering to the Slack app won't provision anyone in those sub-groups. You have to assign the groups that directly contain users.
Group display names and handles. Slack's SCIM documentation notes that it isn't possible to set unique display names for user groups through SCIM. Expect to check each provisioned group's name and @handle in Slack.
Users, not just groups. Entra's Slack provisioning is a full user-lifecycle integration: it creates, updates and deactivates Slack accounts based on assignment. That's a feature if you want Entra to own Slack accounts. It's a risk if you only wanted group membership and some Slack users aren't in Entra — external collaborators, people from an acquisition, service accounts.
Channels. Group provisioning targets user groups. Connecting directory groups to channels is an Enterprise-plan feature in Slack (org owners and admins can connect IdP groups to channels), and Slack notes members can leave those channels at any time.
Dynamic groups. If you want Entra to fill team groups automatically from department or job title, dynamic membership groups require a Microsoft Entra ID P1 license for each unique user in them (Microsoft Learn, 2026).
When Entra provisioning is the right choice
Use it if:
- You're on Slack Business+ or Enterprise already.
- Entra is genuinely the source of truth for every Slack user, and you want Entra to create and deactivate Slack accounts.
- Your team groups are flat, or you're willing to assign the leaf groups directly.
- A delay of up to one provisioning cycle is acceptable.
That's a common, reasonable setup at larger Microsoft-centric companies.
When it isn't
It's a weaker fit if:
- You're on Slack Pro and don't want to move to Business+ just for group provisioning.
- Your groups are nested and you don't want to restructure them.
- You want Slack channel membership to follow Entra groups without an Enterprise plan.
- You want Entra groups to drive more than Slack — GitHub teams, Jira groups, PagerDuty teams — from the same configuration.
- You need some groups to flow the other way, from Slack back into the directory.
Option: a dedicated group sync
SyncMyGroup supports Microsoft Entra ID (Azure Directory) as a source and Slack user groups and channels as destinations. It's built around group membership, so it can sit alongside whatever creates your Slack accounts today — SSO just-in-time sign-up, invitations, or SCIM.
Setup:
- Connect Microsoft Entra ID and Slack at app.syncmygroup.com. Both connect through OAuth; SyncMyGroup stores only email addresses and integration data.
- Create a sync from an Entra group to a Slack user group. The destination group can be created if it doesn't exist, and removed when its source goes away.
- Add channel syncs where a channel should follow the same group, with automatic add and kick.
- Filter and exclude. Leave out groups that shouldn't become Slack groups (licensing groups, device groups, all-staff) and exclude individual users such as service accounts.
- Permanent users. Keep specific people in a group regardless of the Entra roster.
- Preview. Review every add and remove before anything is written.
- Notifications in Teams or Slack.
@SyncMyGroups subscribe <team>posts real-time add and remove notifications to a channel. For Microsoft-centric IT teams, that channel can be in Microsoft Teams.
On nested groups: SyncMyGroup lists nested group support for Google Groups. If your Entra groups are nested, check docs.syncmygroup.com or ask support how your structure will be handled, and use the preview to confirm membership before activating.
User groups do need a paid Slack plan — Slack's API returns plan_upgrade_required on plans without them — but they don't need Business+ or Enterprise.
Comparison
| Entra ID provisioning (Slack gallery app) | SyncMyGroup | |
|---|---|---|
| Slack plan required | Business+ (Enterprise via Slack's SCIM instructions) | Any paid plan with user groups |
| Creates/deactivates Slack accounts | Yes | Manages group membership |
| Slack user groups | Yes | Yes |
| Slack channel membership | Enterprise plans, via IdP-group channels | Yes, add and remove |
| Nested Entra groups | Not supported by the provisioning service | Check docs (nested support listed for Google) |
| Timing | Scheduled cycles, typically ~40 min | See docs |
| Change notifications | Email on provisioning failures | Every add and remove, posted to Slack or Teams |
| Preview before writing | Test single users with on-demand provisioning | Full preview per sync |
| Other destinations | Each app configured separately | GitHub, Jira, PagerDuty, Opsgenie, GitLab, Linear, Zoom, Google Groups |
| Reverse direction (Slack → directory) | No | Yes |
Many companies use both: Entra provisioning (or SSO) for accounts, and a group sync for the last mile into Slack groups, channels and the tools outside Entra's reach. The same split is discussed for Okta in Okta Group Push vs a dedicated group sync.
Rollout tips
- Match on email. Make sure each Slack account's email matches the user's Entra email (UPN or mail attribute, whichever your Slack accounts use). Mismatches are the most common cause of "user not found".
- Pick one writer per group. Don't let Entra SCIM and another tool both manage the same Slack user group. Decide which groups each one owns.
- Start with the groups people mention most.
@it-helpdesk,@oncall-style handles and team handles give the fastest visible win. - Decide direction per group. Most groups flow Entra → Slack. A few project groups that live in Slack may be better flowing back. See One-way vs two-way group sync.
- Use the same groups for onboarding. Once Entra groups drive Slack, they can drive day-one access everywhere; see Employee onboarding: get new hires into the right groups.
Pricing
Free up to 5 users across every integration. Starter is $2 per user per month for unlimited users, with API access, reporting and custom workflows (pricing).
FAQ
Does Entra ID sync groups to Slack user groups?
Yes, through the Slack gallery app's provisioning, which uses Slack's SCIM API. Microsoft's tutorial (2026) requires Slack Business+; Enterprise customers follow Slack's SCIM instructions.
Why are members of nested Entra groups missing in Slack?
Microsoft's provisioning service only provisions immediate members of assigned groups. Users in nested groups aren't provisioned unless you assign the groups that contain them directly.
How long does an Entra change take to reach Slack?
With Entra provisioning, a change is applied on the next incremental cycle, which Microsoft describes as typically every 40 minutes.
Can I sync Entra groups to Slack channels?
On Slack Enterprise plans, org admins can connect IdP groups to channels, though members can leave them. On other plans you need a script or a sync tool that adds and removes channel members.
See what your Entra groups would change in Slack: connect both at app.syncmygroup.com and open the preview, or book a walkthrough.