> ## Documentation Index
> Fetch the complete documentation index at: https://absentify.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Manager synchronization
> Sync Microsoft Entra ID manager relationships with approvers in absentify so absence requests follow the same hierarchy as your Microsoft 365 directory.
With **Manager synchronization**, absentify can automatically assign directory managers as approvers for absence requests. Through **User synchronization**, profile information such as names, emails, and profile pictures can stay up to date.
There are two ways to receive manager relationships:
| Method | What it syncs | Permission required |
| ------------------- | -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| **Microsoft Graph** | Managers, names, emails, and profile pictures | **User.Read.All** on the **absentify - Users Permission** app (App ID: **b163cce9-74dc-48b3-a04f-7a35ea72c451**) |
| **SCIM** | Profile manager relationships via the enterprise `manager` attribute | None of the above. Map `manager` in your IdP. See the [SCIM provisioning guide](/docs/en/roles/hr_admins/settings/integrations/scim). |
Profile pictures and group-owner synchronization for department managers still require Microsoft Graph. SCIM only covers the profile manager used for the **Sync approver with Microsoft Manager** option.
The rest of this page covers the Microsoft Graph path.
### Benefits of granting user synchronization permissions
Granting the **User.Read.All** permission to the **absentify - Users Permission** app provides multiple key benefits for your organization:
* **Automated manager-approver assignments**: Managers defined in Microsoft are automatically synchronized as absence approvers in absentify, streamlining your approval workflows.
* **Up-to-date profile information**: Changes to user profiles in Microsoft, such as first name, last name, email, and profile picture, are automatically synchronized in absentify, ensuring consistent and current information across systems.
* **Improved efficiency and performance**: absentify stores profile information directly in its database. This ensures high application performance, avoids Microsoft Graph API throttling limits, and provides a smooth user experience.
***
### Default functionality without permissions
If the **User.Read.All** permission is not granted, Microsoft Graph manager and profile synchronization are unavailable. As a result, the following limitations apply — unless profile managers are provisioned through [SCIM](/docs/en/roles/hr_admins/settings/integrations/scim):
* **Manual manager updates**: HR teams must manually assign and update approvers within absentify, increasing workload and the risk of outdated information.
* **Sign-in-based profile synchronization**: User profiles are only updated in absentify when users sign out and sign back in. To avoid Microsoft Graph API throttling, profile updates are limited to one synchronization per user per hour.
***
### How absentify uses the User.Read.All permission
To ensure transparency and build trust, here’s how absentify uses the **User.Read.All** permission in the **absentify - Users Permission** app:
* **Manager synchronization**: This permission is used to pull manager information from Microsoft and assign managers as absence approvers in absentify.
* **Profile synchronization**: Changes in users' first name, last name, email, and profile picture are automatically synchronized and stored in absentify’s database. This storage ensures that absentify functions with optimal performance while reducing reliance on frequent API requests.
* **Secure storage**: All profile data is stored GDPR-compliantly in our secure database hosted in **Azure North Europe**. No developers or members of other departments have access to the production database or stored data, which is limited exclusively to authorized personnel at absentify GmbH. Database access is restricted to the Azure environment with no external copies or unauthorized access.
***
### Security and data protection
We prioritize security and data privacy, following rigorous standards to protect your organization’s information:
* **ISO 27001 certification**: absentify is ISO 27001 certified, demonstrating compliance with international standards for information security management.
* **Microsoft 365 App Certification**: The **absentify - Users Permission** app has achieved Microsoft 365 App Certification, confirming compliance with Microsoft’s security, privacy, and compliance standards. This certification assures that absentify adheres to best practices for data handling and security.
* **Secure key management**: Access secrets required for synchronization are securely stored in an Azure Key Vault, restricted to authorized personnel at absentify GmbH. No unauthorized access is permitted, and access to all sensitive data is strictly limited to necessary personnel only.
### Enabling manager and profile synchronization
**Microsoft Graph:** To activate automatic synchronization of managers as approvers and profile information updates, follow these steps:
1. **Grant permissions**: Start by granting the required permissions through the Microsoft 365 admin portal. Use the following link to initiate the consent process:
[Grant Permissions](https://login.microsoftonline.com/common/adminconsent?client_id=b163cce9-74dc-48b3-a04f-7a35ea72c451\&redirect_uri=https://app.absentify.com/settings/organisation/microsoft)
2. **Activate synchronization in absentify**: Go to **Settings** > **Users** in absentify and enable the manager and profile synchronization options to ensure alignment with Microsoft’s manager assignments and user profile information.
**SCIM:** Map the enterprise `manager` attribute as described in the [SCIM provisioning guide](/docs/en/roles/hr_admins/settings/integrations/scim). You do not need to grant **User.Read.All** for manager-based approvers.
***
### Changing a user’s manager in Microsoft
To update a user’s manager directly in Microsoft:
1. Sign in to the [Microsoft Admin Portal](https://admin.microsoft.com/Adminportal#/homepage).
2. Go to **Users** > **Active users**.
3. Select the user, then select **Edit manager** or **Add manager**.
Once saved, these changes will automatically reflect in absentify, assigning the new manager as the approver.
***
### Revoking permissions
If you need to revoke the **User.Read.All** permission for the **absentify - Users Permission** app, follow these steps:
1. **Access Azure Active Directory**: Sign in to the [Azure portal](https://portal.azure.com) with your Microsoft 365 administrator account.
2. **Navigate to Enterprise applications**: In the left-hand menu, go to **Azure Active Directory** > **Enterprise applications**.
3. **Find and select absentify - Users Permission**: Locate the **absentify - Users Permission** app (App ID: **b163cce9-74dc-48b3-a04f-7a35ea72c451**) in your list of applications.
4. **Manage permissions**: Go to the **Permissions** section and select **User.Read.All** to revoke absentify’s Microsoft Graph access to manager and profile information.
Revoking this permission disables Microsoft Graph manager and profile synchronization. Profile updates then rely on user sign-in events. Manager-based approvers still work if profile manager relationships are provisioned through [SCIM](/docs/en/roles/hr_admins/settings/integrations/scim); otherwise they must be maintained manually.
By granting and, if necessary, revoking the **User.Read.All** permission for the **absentify - Users Permission** app, you retain control over Microsoft Graph manager and profile synchronization.
***