- Confirm the operator has configured the read-only directory integration.
- Open Entra groups, find an existing group and use Select & sync. Membership is maintained in Microsoft Entra, not created or edited by this integration.
- Review member count, last sync and errors. Add the selected group to a role assignment with the correct scope.
- After a membership change, use the configured sync process and review effective access again. The applicable freshness policy can withhold stale group grants.
- Enable/change scoped enforcement only after reviewing assignments, group freshness and recovery access and completing the screen's acknowledgement.
Complete when: Intended group members have the correct effective access and unintended members do not. Training staff groups and directory department labels are separate from these Entra groups.