What is provisioning?
Provisioning is the process by which an Authorization Group pushes its membership to external systems. When a user is added to or removed from a provisioned group in OpenStudio, the change is propagated to the linked external system during the next synchronization cycle. OpenStudio currently supports two external provisioning targets in addition to its own internal directory:
- Microsoft Office 365 / Azure Active Directory — syncs group membership to a Microsoft Azure AD group, enabling access to Office 365 services (Exchange, Teams, SharePoint, and so on).
- Cloud Files — syncs group membership to a Cloud Files server group, controlling access to shared file storage.
Every Authorization Group is always provisioned to OpenStudio internally — this cannot be disabled and requires no configuration.
Configuring external provisioning
External provisioning is configured in the group Edit settings page:
| Target | Field to configure | Notes |
|---|---|---|
| Office 365 / Azure AD | Azure AD Group ID | The GUID of the target Azure AD group. Format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. The group must already exist in Azure AD before linking. |
| Cloud Files | Cloud Files group name | The name of the target group on the Cloud Files server. Configured by system administrators. |
Synchronization status badges
The Members tab shows the sync status of each member for each provisioned target:
| Badge | Target | Meaning |
|---|---|---|
| Synced | Office 365 | The user account exists in Azure AD and is confirmed as a member of the linked group. |
| Pending | Office 365 | The user account exists in Azure Active Directory but synchronization is still in progress. |
| Not found | Office 365 | No Azure Active Directory account was found for this user. The user cannot be synced until an Azure AD account is linked. |
| Cloud Files synced | Cloud Files | The user is confirmed as a member of the linked Cloud Files group. |
| Cloud Files pending | Cloud Files | The synchronization to the Cloud Files server is pending. |
| Orphan (Office 365) | Office 365 | The user is present in the Azure AD group but not in OpenStudio — they are queued for removal on the next sync. |
Forcing an immediate synchronization
By default, provisioning synchronization runs automatically on a scheduled basis. If you need to push changes to an external system immediately — for example, after adding a large batch of members — you can trigger a manual sync from the group Details tab:
- Click Force migration in Microsoft to push the current membership to the linked Azure AD group immediately.
- Click Force migration in Cloud Files to push the current membership to the linked Cloud Files group immediately.
These buttons are only visible if the group has the corresponding external system configured, and only to users with authorization to manage the group.
Microsoft license detection
The Applications and Permissions tab (see Understanding the Applications and Permissions tab) automatically detects any Microsoft 365 licenses assigned to the Azure AD group and lists them alongside the group permissions. This provides a consolidated view of both OpenStudio permissions and cloud license entitlements in one place.
