How to Set Up OnePlan Entra ID (AD) Sync and Avoid User Login Issues
Picture this. You set up AD sync on Friday. Monday morning, your inbox fills up: "I can't log in." A project manager can log in but can't find a single task. Nothing is broken. Two small settings were missed
There are two things which you need to check before you start
An integration account that can sign in on its own. The sync runs with no one present. In the setup shown here, MFA on that account stops the sync from running. Follow your company’s security policies when you set it up.
Extra fields already created in OnePlan, like business units or cities. The sync can’t fill a field that doesn’t exist.
How OnePlan AD sync works
The sync reads your chosen Entra ID groups and brings their members into OnePlan with their name, email, and any extra fields you map. Data only flows one way. If something's wrong in OnePlan, fix it in Entra ID and it updates on the next sync.
How to set up OnePlan AD sync
Step 1: Create an authentication key. You'll need Owner rights. Go to Settings → Integration → +Add Key. Copy the key right away, because you can't see it again after you refresh.
Step 2: Get tenant admin approval. At my.oneconnect.ai, add the Microsoft Entra ID Users to OnePlan integration. In the Microsoft Entra ID section, enter your tenant domain. Your tenant admin then clicks Authorize to approve OnePlan's access.
Step 3: Choose your groups and connect OnePlan. Open Additional Options and enter your group under Microsoft Entra ID Groups. To sync more than one group, separate them with commas.
In the OnePlan section, enter your OnePlan Group Name and paste your authentication key. Click Test, then Save once you see "Connected Successfully."
Step 4: Set the default group, fields, and schedule.
Default group: Set it to None so new users start with no access.
Fields: Map each field one way, from Entra ID into OnePlan.
Schedule: Pick based on how often your users change. Monthly may be enough, or choose None and run it when you need to. After the first run, it only pulls in changes.
Step 5: Turn on welcome emails. This step is what stops those Monday-morning "I can't log in" messages. First, check your Authentication Type on the Authentication tab. If it's set to Multi-Authentication, users must accept a welcome email before they can log in.
If those emails are off when you sync, no invites go out. So before you sync, go to Notifications and find Welcome to OnePlan and Invitation to join OnePlan. Check the Disabled column next to each one. It should say No, which means the email is on.
Step 6: Run the sync and check it. Run it once by hand. Make sure your users show up, then give each person their permissions.
Why we recommend this setup
It's easier to grant access than to take it back, so we start everyone at None. One-way mapping keeps Entra ID as the only place anyone edits user data. And we always add people by search, never by hand. That habit is what prevents the "where are my tasks?" problem.
Tips and best practices
Add people by search, not by typing. OnePlan has two kinds of users. Office 365 users are added by searching in the Resource Center. Forms users are created by typing in a name and email. The same person can end up with both. They log in with their Office 365 account while their tasks sit on the Forms account. That's the project manager from Monday morning. Always click Add Resource and search.
Decide who's a requester. Requesters don't need a OnePlan license. On the Users tab, they show up in the Requestor group
Requesters only get access to Intake, where they can submit ideas and vote on them, based on the permissions you set. Anyone who needs more of OnePlan needs a full license. Before moving a requester into the resource pool, check with OnePlan support so you don't create a duplicate.
See how we set up OnePlan for enterprise and government teams.
Frequently asked questions
Why can't my users log in after AD sync? Most often, the welcome emails were off during the sync, so users never got their invites.
Why can a user log in but not see their tasks? They probably have two accounts, a Forms user and an Office 365 user. Their tasks are on the one they don't log in with.
Do requesters need a OnePlan license? No. Requesters are unlicensed and only get access to Intake.
Need OnePlan set up your way? We've delivered 250+ project portfolio management deployments over 19+ years. Talk to our OnePlan team
Comments