Entra ID Integration Setup Guide

Overview

EG Retail Cloud can provision users automatically from your corporate Microsoft Entra ID into the EG back-office platform. A scheduled job reads members of the Entra ID security groups you nominate and creates matching users in the EG platform.

You do not create or maintain user accounts in the EG platform. Users sign in with their existing corporate Entra ID credentials. No separate EG password is issued.

This guide covers what NG Convenience needs to do.

How it works

1. The job connects to your Entra ID using the Microsoft Graph API and reads the members of the security groups you nominate.
2. Membership is read transitively. Members of nested groups are included.
3. Each user found is invited into the EG-managed Entra ID as a guest. No invitation email is sent. The user accepts the invitation on first login to the EG back-office.
4. Where a group is configured with a role, the user is assigned that role in ChainWeb.
5. The job runs daily. The default schedule is 03:00.

The job supports two source Entra ID tenants.

Prerequisites

Complete the following for each Entra ID tenant you want to sync from.

1. Create an App Registration

1. In portal.azure.com, go to Entra ID > App registrations > New registration.
2. Name it clearly, for example EG Retail User Sync.
3. Set Supported account types to Single tenant.
4. No redirect URI is needed. This is a background service.
5. Click Register.

Note down the Application (client) ID and the Directory (tenant) ID from the overview page.

2. Grant Microsoft Graph API permissions

Grant the following as Application permissions, not delegated:

An Entra ID Global Administrator must then click Grant admin consent. The permissions do not take effect until consent is granted.

3. Upload the EG certificate

The job authenticates with an X.509 certificate. Client secrets are not supported.

EG provides the certificate. You upload it:

1. In your App Registration, go to Certificates & secrets > Certificates.
2. Click Upload certificate and upload the .cer file EG provides.
3. Confirm the upload and note the thumbprint.

EG owns the certificate and its rotation. When EG rotates it, you upload the replacement to the same App Registration. EG contacts you ahead of each rotation. One App Registration can hold several certificates, so a new certificate can be uploaded before the old one is removed.

If both test and production are in scope, EG provides a certificate per environment. Confirm with your EG contact which environments are being set up.

4. Nominate the security groups

The job syncs by group membership, not by individual users.

For each source Entra ID, decide which security groups should be synced, for example EG-BackOffice-Users. EG needs the exact display name of each group. A name that does not match is skipped silently, so the users in it are simply never created.

Each group maps to a single ChainWeb role. To grant a user a combination of roles, use a separate group per role. Confirm the final group and role mapping with your EG contact before go-live, as role assignment through this job has practical limits.

5. Populate user attributes in Entra ID

The job reads user attributes from your Entra ID. Two of them are required for provisioning to work.

• Email. Each user must have a valid mail, userPrincipalName or alternate email address. Users with none are skipped.
• Office location. For roles scoped to a store, the user's Office location field must contain the store number. If it is empty or does not contain a recognisable store number, the user is created but receives no store-scoped role. EG configures how the store number is extracted from this field, so tell your EG contact the format you use.

The following are also read and kept in sync, but are not required: display name, given name, surname, alternate emails, preferred language, country, and account enabled status.

What EG needs from you

For each of your two Entra ID tenants:

After activation

• Users in the configured groups are created in the EG platform on the next job run.
• No invitation email is sent. The user goes to the EG back-office, signs in with their corporate Entra ID credentials, and accepts the invitation as part of that first login.
• Changes to name, email, language, country and office location in your Entra ID are picked up on the next run.
• Disabling a user in your Entra ID deactivates them in the EG platform on the next run.
• Removing a user from all synced groups deactivates them in the EG platform on the next run.
• Store access is derived from the Office location field on every run. Store access changed manually in ChainWeb is overwritten at the next sync.
• Moving a user between groups grants the new group's role. It does not remove a role granted earlier. Where a user changes function, tell EG so the previous role can be removed in ChainWeb.
• Where an assigned role includes point of sale permissions, a cashier number is generated for the user automatically.

Scope and limitations

• This integration provisions staff and administrator users. It does not affect loyalty member accounts.
• A user must be a member of at least one configured group to be created.
• Users who hold administrator roles in Entra ID cannot be updated by the job. These are rare and handled manually.
• Role assignment through this job is limited. Roles beyond the group mapping are assigned manually in ChainWeb after the user's first login.

Contacts