<style>p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><p><strong>In this guide we will cover:</strong></p><p><strong>- What is an Azure Delta?</strong></p><p><strong>- What are the benefits of using Azure Deltas?</strong></p><p><strong>- How does enabling Azure Deltas impact the functionality of Microsoft Entra ID/CSP?</strong></p><p><strong>- How to enable Azure Deltas?</strong></p><p><strong>- What to consider when enabling Azure Deltas?</strong></p><p><strong>- Using Azure Deltas with the Intune integration</strong></p><p><br></p><p><br></p><p>A guide that covers the configuration and use of Azure deltas in the Microsoft Entra and Microsoft CSP integrations.</p><p><br></p><p><strong><span style="font-size: 14pt;">What is an Azure Delta?</span></strong></p><p>An Azure delta is a reference to a point in time for a certain Azure entity (e.g. Users/Groups). Deltas can be used when requesting data from the Microsoft Graph API so that records are only returned if they have been modified after the point in time that the delta corresponds to.</p><p><br></p><p><strong><span style="font-size: 14pt;">What are the benefits of using Azure Deltas?</span></strong></p><p>The primary benefit of using Azure Deltas is that it allows a much more frequent import of users via the Halo Integrator, meaning user data is more up-to-date. </p><p><br></p><p>It's best described with an example. Consider an Azure tenant with 10000 users, where a site mapping has been configured to import all 10000 users. Previously, all 10000 users would be processed on every Halo Integrator scan, which would take a long time. With deltas enabled, only users that have been updated since the previous scan will be processed, meaning you'd likely process very few users per scan if any at all.</p><p><br></p><p><strong><span style="font-size: 14pt;">How does enabling Azure Deltas impact functionality?</span></strong></p><p>When deltas are disabled, the integrations use the site mapping configuration and the filters that are configured within them to retrieve users from the Graph API. Each user that is returned will be processed regardless of whether they have been updated in Microsoft Entra. Only users that match the criteria within the site mappings are processed.</p><p><br></p><p>When using deltas, the filters within the site mappings are no longer used when retrieving the users. Instead, any user that has been updated since the previous scan will be retrieved and processed by the integration, regardless of whether they match a site mapping. The calculation of whether the user matches a site mapping is now done during the processing of the user. If a site mapping is not matched, then the user will be ignored.</p><p><br></p><p>Other notable differences are as follows:</p><p><br></p><ul><li>Changes to a user's groups are managed via a separate delta on the group entity. If you are using any functionality that uses groups (i.e. filtering a site mapping by a group, group-to-role mappings etc), the Halo Integrator will perform an additional part of the scan where it uses a delta to retrieve any groups that have been updated.</li><li>If you have enabled the functionality to delete users from Halo when they are no longer found in Microsoft Entra, then this works differently with deltas. If a DELETE change event is returned, then the user will be deleted. If the user does not match any of the site mappings, then they will also be deleted. </li></ul><p><strong><em>Note: The functionality to deactivate users when they do not match a site mapping has been temporarily disabled. It will be re-introduced at a later date via a different setting.</em></strong></p><p><br></p><p><strong><span style="font-size: 14pt;">How to enable Azure Deltas?</span></strong></p><p>You do not need to make any modifications to the Azure application configured for either integration. In Halo, for the Microsoft Entra integration, Azure Deltas can be enabled on the Imports tab of an integration record. For the Microsoft CSP integration, the same setting can be found on the Halo Integrator tab.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjcyZmQwMDYzLWQzZDgtNGQ1OC05MTM4LWM1Zjc1MTE1ZmJiZSJ9.viQQ3WFbzl4RuPy7O5n3XMDkaf19cZnK_qk7ds_1m0Q" class="fr-fic fr-fil fr-dib" width="963" style="width: 965px; height: 160.833px;" height="161"></p><p><strong><span style="font-size: 10pt;">Fig 1. Checkbox to enable Azure Deltas</span></strong></p><p><br></p><p id="isPasted"><strong><span style="font-size: 14pt;">Things to consider when enabling Azure Deltas</span></strong></p><p>Because site mapping criteria are not used in the requests to retrieve users when deltas are enabled, the first Halo Integrator scan that runs when deltas are enabled will retrieve the entire directory of users/groups from the Azure tenant. If you are using deltas in the Microsoft CSP integration, every tenant that has a site mapping will have all of its users/groups processed.</p><p><br></p><p>Because of the volume of data that may need to be processed in this scenario, the initial sync can take a very long time to complete. To avoid this, it is recommended that you use the <strong>Reset Delta</strong> option that is available in both integrations as soon as the functionality is enabled.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjBlMWJlZjVkLTQ5YzktNDI1Ny05MTczLTA0MzM4NjJjYmRlZSJ9.F7qFApcz5Awz0wx0NOLeVoZArHKllaQAOYNh5ThDjGQ" class="fr-fic fr-fil fr-dib" width="515" style="width: 517px; height: 176.113px;" height="176"></p><p id="isPasted"><strong><span style="font-size: 10pt;">Fig 2. Reset Deltas Option </span></strong></p><p><br></p><p>By fetching the latest delta queries, a delta will be created for the current point in time. That means that the first initial Halo Integrator sync won't need to process every user/group in the directory for every tenant that you are importing data from.</p><p><br></p><p>In the Microsoft CSP integration, this function can also be performed on a per-tenant basis on the Tenants tab:</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjQ0MDIzYTkwLWM1MTYtNDFmOC1iZTU2LTRiYmFmZGNlODI4ZSJ9.OQbX4qMoRvduPqD_Ro1JX2jZ8BhFdTpHuV6JKXMHAYY" class="fr-fic fr-fil fr-dib" style="width: 994px;" width="1126" height="120"></p><p><strong><span style="font-size: 10pt;">Fig 3. Reset Deltas Option per Tenant</span></strong></p><p><br></p><p>For anyone setting up the integration for the first time, a manual import is the recommended way of initially populating the user database in Halo. The manual import behaves the same way as the Halo Integrator would when deltas are disabled i.e. it retrieves and processes any user that matches the criteria of a site mapping.</p><p><br></p><p>It is recommended that you do not increase the frequency of Halo Integrator scans until you have confirmed that the current scan time has decreased to a sensible level after the delta functionality has been enabled. The recommended frequency afterwards is 30 minutes. </p><p><br></p><p id="isPasted"><span style="font-size: 11pt;">An option for a sync method will by default be set to "Listen to all changes". The other option will sync a delta query to only listen to system fields used within Halo and mapped user fields. This includes fields and filters used on site mappings that impact users.</span></p><p><br></p><p><span style="font-size: 11pt;"><img data-fr-image-pasted="true" src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjllODk0MTgxLWZmMGItNGNmYy05M2E0LTU0MWJhZGE4ODdjNSJ9.N9X2ybY9bFQAZBR3rlKFXOBgecAreeYppdeOG-k4ICo" width="525" height="181" style="box-sizing: inherit; border-style: none; cursor: pointer; padding: 0px 1px; user-select: none; text-align: left; color: rgb(0, 0, 0); font-family: sans-serif; font-size: 14.6667px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; max-width: none !important;" class="fr-fic fr-dii"></span></p><p><span style="font-size: 10pt;"><strong>Fig 4. Delta sync method.</strong></span></p><p><br></p><p><span style="font-size: 11pt;">This also impacts groups, only changes to the displayName and members property of groups will be listened to.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Some fields are not compatible with this Delta sync method and therefore will not be listened to. However, incompatible fields will be retrieved when a change for a compatible field occurs.</span></p><p><br></p><p><span style="font-size: 11pt;"><img data-fr-image-pasted="true" src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijg4Njc0YWVlLWUzYzItNDgwOC04MDg1LTY4ZTg1OGMwZDlhOSJ9.s0wceVCC8A4uFVXgQTXsDjQMtUzFT3iE1V-JVQrJXh4" width="504" style="box-sizing: inherit; border-style: none; cursor: pointer; padding: 0px 1px; user-select: none; max-width: calc(100% - 10px); min-width: 10px; color: rgb(0, 0, 0); font-family: sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; width: 506px; height: 182.467px;" height="182" class="fr-fic fr-dii"></span><br></p><p><span style="font-size: 10pt;"><strong>Fig 5. Incompatible Delta fields.</strong></span></p><p><br></p><p><span style="font-size: 11pt;">Incompatible fields will be highlighted, alongside where the field is used, when changing to the new method.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">When modifying the sync method, user, or site field/filter mappings for the Microsoft Entra integration, the system will retrieve the latest delta queries and display a warning message to confirm this action. For Microsoft CSP, you will be notified that resetting the delta queries for each tenant is required for the changes to take effect.</span></p><p><br></p><p><strong><span style="font-size: 12pt;">User Deactivation when using Azure Deltas</span></strong></p><p>When Azure Deltas are not enabled, the deactivation of users is determined by this setting.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImYxZTU2NWQ0LTY2NzUtNDAzMy1iODUwLTQzMGI0NDM1ZTRjMyJ9.Se3xqG1zDH7MrFIv1K-Qg6muSKJp8RWGrWjrjBSRdCc" class="fr-fic fr-fil fr-dib" width="554" height="37"></p><p><strong><span style="font-size: 10pt;">Fig 6. Setting to have users deactivated in Halo when not found in Azure </span></strong></p><p><br></p><p>However when Azure Deltas are enabled, you will have additional options to give your more control over when users are deactivated. </p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjQ3ZGNhNTk3LWQ5NjgtNGI2NC04NzcyLTBiZDY1NTAzNDhiYyJ9.2SxSCV9k2TLytSG9gjjBxUoKGGEfeijN8XXY8M5UH5k" class="fr-fic fr-fil fr-dib" width="741" style="width: 743px; height: 309.353px;" height="309"><strong><span style="font-size: 10pt;">Fig 7. Setting to determine when users are deactivated when Azure Deltas are in use</span></strong></p><p><br></p><p><strong>Deactivate Users in Halo when an UPDATE even is received and the User does not match a Site mapping</strong> - When selected users will be deactivated in Halo when they do not match a Site mapping but only when an update even for that user has occurred, that is changes have been made to the user in Azure/CSP to trigger that user to be included in the next sync. </p><p><strong>Deactivate Users in Halo when an DELETE event is received</strong> - When selected users will be deactivated in Halo when they have been deleted in Azure/CSP. </p><p><strong>Do not deactivate Users</strong> - When selected users will not be deactivated in Halo. Even if they have been deleted in Azure/CSP. </p><p><br></p><p><strong><span style="font-size: 14pt;">Using Azure Deltas with the Intune integration</span></strong></p><p>If you are using the Intune integration (or the Intune segment of the Microsoft CSP integration), you may be using the Microsoft Entra integration to assign users to devices. Unfortunately, the user deltas do not pick up changes to user-device relationships, so enabling deltas may cause some of these relationships to not be updated correctly.</p><p><br></p><p>This has been addressed as of version 2.166, where new functionality has been added so that the user-device relationship can now be established using the Intune integration.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVhZTc0ZmQyLTEzMDYtNDU0Zi1iYTdmLTA4N2ViOWM0ODc3YiJ9.eAo0LQMui1Y-s2vhKQyNOotp17DT4eupz-5CuIpkewE" class="fr-fic fr-fil fr-dib" width="915" style="width: 917px; height: 159.34px;" height="159"></p><p><strong><span style="font-size: 10pt;">Fig 8. Setting to establish user-device relationship using Intune </span></strong></p><p><br></p>
