An Exact Mirror of Each Group
Members added or removed in Entra appear or disappear in AutoPhish on the next sync. Synced lists are protected from manual edits, so nothing is silently reverted.
All integrations
Microsoft 365 integration
Microsoft 365 Phishing Simulation with Automatic Entra ID Group Sync
Connect your Microsoft Entra tenant, map the groups you already maintain, and let AutoPhish keep every target list current. Joiners are tested from their first week, leavers drop out overnight, and nobody exports a user list again.
Your Directory Changes Every Week. Your Target Lists Should Too.
Most phishing simulation programs start with a CSV export and quietly decay from there. New colleagues are never tested, people who left still receive simulations, and click rates stop describing your real organization. Auditors notice the gap between your headcount and your training evidence. With the Microsoft 365 integration, Entra ID stays the single source of truth and AutoPhish follows it.
Connected in Three Steps
Register an App in Entra
Create an app registration with three read-only application permissions: Group.Read.All, GroupMember.Read.All and User.Read.All.
Connect Your Tenant
Enter the tenant ID, client ID and client secret in AutoPhish and run the connection test. The secret is encrypted before it is stored.
Map Groups to Target Lists
Pick the Entra groups for departments, locations or roles. AutoPhish syncs them every night, or right away when you click Sync now.
Directory Sync That Does the Housekeeping
Nested Groups Included
Membership is resolved transitively. Someone in a subgroup of a mapped group is covered without any extra mapping.
Only People You Should Test
Disabled accounts are skipped, and so are guests and addresses outside your verified domains. External partners never receive a simulation by accident.
A Run History You Can Show an Auditor
Every sync records how many people were read, added, updated, removed and skipped, along with any error returned by Microsoft Graph.
Read-Only, Encrypted and Scoped to Your Tenant
The integration reads group membership and nothing else.
- Application permissions are read-only. AutoPhish cannot change users, groups or anything else in your tenant.
- No access to mailboxes, files or Teams. Only names, email addresses and account status are read.
- The client secret is encrypted with AES-256-GCM before it is stored.
- Only addresses on domains you have verified in AutoPhish are imported.
- AutoPhish is hosted in Germany, processes data in the EU and offers a data processing agreement.
Microsoft 365 Integration FAQ
Which Microsoft Graph permissions does AutoPhish need?
Three read-only application permissions with admin consent: Group.Read.All, GroupMember.Read.All and User.Read.All. They let AutoPhish list groups, read group membership and read the name, email address and account status of each member.
How often are Entra ID groups synced?
Every night. A company admin can also start a sync at any time from the integration settings, for example right after onboarding a new team.
What happens when someone leaves the company?
Once the account is disabled or removed from the group in Entra, the person is removed from the target list on the next sync and receives no further simulations. Their past results stay available in your reports.
Can I still edit a synced target list by hand?
No. A synced list is an exact mirror of its Entra group, so membership changes are made in Entra. If you remove the mapping, the list keeps its current members and becomes a normal list that you can edit again.
Are guest users and shared mailboxes synced?
Only enabled accounts with an address on one of your verified domains are imported. Guests from other organizations and external addresses are skipped, and each run reports how many accounts were skipped and why.
Is Microsoft 365 directory sync included in my plan?
Yes. Microsoft 365 directory sync is included in every AutoPhish plan at no extra cost.
More AutoPhish Integrations
Google Workspace
Record reports made with Gmail's built-in "Report phishing" option on your simulations. No add-on to roll out.
Learn moreActive Directory
Mirror on-premises AD groups with a signed PowerShell tool. AutoPhish never connects to your domain controller.
Learn moreNextcloud
Install the official app from the Nextcloud App Store and map Nextcloud groups to AutoPhish target lists.
Learn moreRun your first phishing test in 10 minutes.
Sign up free — no credit card. Try Pro free for 7 days when you're ready.