Skip to main content

​
Why Connect Entra?

Connecting Microsoft Entra lets Velatir follow how your organisation is actually set up:
  • Organisation membership: people who sign in with Microsoft join the right Velatir organisation automatically, with the role that matches their security groups.
  • Workspaces: Velatir can generate workspaces from directory properties and keep people in the right place as they move teams.
The same directory structure also organises activity by team, which powers the department and group breakdowns in Insights.
Connecting Entra is optional. You can invite members by email and create workspaces by hand instead. See Organisations & workspaces.

​
Assign Organisation Roles From Security Groups

Map Entra security groups to Velatir organisation roles. Anyone who signs in with Microsoft and belongs to a mapped group is added to the organisation with that role. If they belong to more than one mapped group, they receive the higher privilege (Administrator over Reader).

Open Members settings

In your organisation, go to Settings → Members. You need the Administrator role to configure this.

Enter your tenant and groups

Turn on Entra member sync and paste your Microsoft Entra tenant ID. Map at least one security group to Administrator. You can optionally map a group to Reader. Use each group’s Object ID from Entra, not its display name.

Decide what happens to everyone else

Choose whether people from your tenant who are in no mapped group may sign in. Leave the option off and they are not members at all. Turn on Let everyone in the tenant sign in and they join as Unassigned members for you to assign. See People outside the mapped groups.

People sign in with Microsoft

Members must use Sign in with Microsoft for the mapping to apply. The next time they sign in that way, Velatir checks their groups and adds or updates their organisation role.
Email invitations are turned off while member sync is on. Access comes from the directory instead of one-off invites.

​
Members managed by Entra

People added this way appear in the member list with an Entra badge. While sync is on you cannot remove them or change their role in Velatir. The security groups own that. You can still set a Reader’s access level (the whole organisation or selected workspaces); the groups know nothing about workspaces, so that stays yours. They lose access automatically when they leave the mapped groups, or when they next sign in after you change the mapping. The person who created the organisation is the founder and is never removed by sync.

​
People outside the mapped groups

Someone may sign in with Microsoft from your tenant without being in any mapped group. What happens depends on the Let everyone in the tenant sign in option in the member sync settings.
  • Off (default): they are not a member. The organisation does not appear in their list, and they do not appear in yours.
  • On: they join as an Unassigned member. They see the organisation in their list and a page telling them that an Administrator needs to grant them access, and nothing else. You get a notification in the bell, and the member appears in the Members list with the Unassigned role.
Assign them a role and access level from the Members page. From then on their role is yours to manage, not the groups’: signing in again does not undo it, and you can change or remove them like an invited member. Two things still come from the directory. If they are later added to a mapped group, the group’s role applies. If they sign in from a different tenant, or without Microsoft, they lose access like any synced member. A synced member who is removed from every mapped group becomes Unassigned when this option is on, rather than losing their membership.
The option is per organisation. If several organisations use the same tenant and each turns it on, a person outside the mapped groups becomes an Unassigned member of each of them.

​
Turning member sync off

Turning sync off does not delete anyone with a role. Existing members stay, now as ordinary members you can invite, remove, and re-role as usual. Unassigned members are removed, since nothing would ever assign them. Email invitations become available again.
Membership is based on the Microsoft account that signs in, not on an email address someone types into Velatir. Signing up with an email that happens to match a directory user does not grant organisation access.

​
Generate Workspaces From Your Directory

When you set up your organisation, choose Generate workspaces with Microsoft Entra and pick which directory properties define your structure.

Choose the top-level property

Pick the Entra user property that defines your top-level workspaces, for example Department. Velatir creates one workspace per value.

Optionally nest a second level

Add a second property, such as Office or City, to nest workspaces beneath the first. You can nest up to two levels.

People are placed automatically

Everyone is assigned to the right workspace based on their directory details, and moved automatically when those details change.

​
Properties You Can Use

​
Activity by Team in Insights

Once Entra is connected, activity is organised by your directory structure: department, office, and group. You can filter and break usage down by these across the platform, so you see where AI is being adopted without singling out individuals.

Organised by your structure

Activity is grouped by department, office, and group, so the picture always matches how your organisation is set up.

Team insights

Insights break usage down by department, office, and group, and show where adoption concentrates.

​
Mapping Device Activity to Teams

So activity captured on a device lands in the right workspace, Velatir matches it to your directory structure using the organisational context the desktop client attaches to each trace.

Organisations & workspaces

How your account is structured.

Roles & permissions

What Administrator, Reader, and Unassigned can do, and how access levels work.