Sync setup — provider details and fallbacks

The Sync users step covers the three-click happy path that fits 95% of clients. This article is the depth for the other 5% — provider-specific options, what to do when you don’t have admin access on the client’s side, and manual entry.

If your client is on Microsoft 365 and you have admin access, you don’t need this article. Skip to Post-sync cleanup if you’ve already synced and want to tidy up.

Microsoft 365

Microsoft sync offers two modes after admin consent:

• Sync All Users — mirrors every active user in the client’s organization. The recommended default; protects the whole workforce.
• Choose Groups — pick specific security groups to mirror. Use when only certain departments or teams are scoped into the security awareness program.

Walkthrough

1. From the People page, click Connect Microsoft.

2. A popup opens to Microsoft’s admin consent screen. Sign in with admin credentials (yours or the client’s, if you have them) and approve the requested permissions. The same popup then asks you to sign in to that organization if you aren’t already; an account from a different organization is refused.

3. The popup closes and we show you the mode picker:

   • Sync All Users — click and you’re done.
   • Choose Groups — pick the security groups to mirror, then click Sync N Groups (the button counts the groups you picked).

After the sync, review and clean up the user list — most directories include service accounts and test accounts that shouldn’t get training.

Google Workspace

Google sync requires a one-time Domain Wide Delegation (DWD) setup in Google Admin Console before we can read the client’s directory. After DWD, the sync has three modes: All Users / OUs / Groups.

Set up Domain Wide Delegation

This is a configuration step in Google Admin Console — outside our app — and only needs to be done once per client.

In our app, click Connect Google, then sign in with the client’s Google admin credentials. After consent, we show you the DWD setup screen with the Client ID and OAuth scopes you need to register on the Google side. Keep that screen open. The values are also reproduced below for reference — but the copy buttons on the dashboard are the source of truth in case anything is ever rotated.

Client ID

Paste this into the Google Admin Console’s Client ID field on the Add API client form:

105239018523099741746

OAuth scopes

Paste this comma-separated list into the Google Admin Console’s OAuth scopes field:

https://mail.google.com/,https://www.googleapis.com/auth/gmail.insert,https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly

Walkthrough — Google Admin Console

1. In a new tab, go to admin.google.com and sign in to the client’s Google Workspace.

2. Navigate to Security → Access and data control → API Controls.

3. Under Domain wide delegation, click Manage Domain Wide Delegation.

4. Next to API clients, click Add new.

5. Paste the Client ID (above) into the form.

6. Paste the OAuth scopes (above) into the scopes field.

7. Click Authorize.

Back on our DWD setup screen, click Test & Continue. We read the directory to confirm the delegation works. If it doesn’t, the screen tells you what’s wrong — for example, which scopes Google hasn’t authorized yet — so you can fix that one thing in Google Admin and test again.

Pick what to sync

1. Once the test passes, pick a mode:
   • Sync All Users — mirrors the entire domain. Most common.
   • Choose Groups — pick specific Org Units or Groups. Best when only part of the client’s directory should be in our system.

After the sync, review and clean up the user list.

Set up DWD for a client that’s already connected

Some older Google connections run on the sign-in of the one admin who first connected them, and they stop syncing if that account is deleted. If the People page shows Set Up DWD next to the connection, click it: the same Client ID and scopes appear there, with a Test DWD Connection button. Once the test passes, the sync runs through any active Google admin.

Sync-link invite

Use this when you don’t have admin access on the client’s Microsoft 365 or Google Workspace — the most common reason the happy path doesn’t fit.

Note

Screenshot pending capture: sync-link-invite-page — the People page with the Send sync invite action and the one-time URL it produces.

1. From the People page, click Send sync invite, pick Google Workspace or Microsoft 365, and click Generate link.

2. We give you a one-time URL. Copy it and email it to whoever on the client’s side has admin rights. The dialog shows when it expires, and you can revoke it from the People page until it’s used.

3. They open the link, sign in to their own Microsoft 365 or Google Workspace, and grant consent. For Google, the same page walks them through domain-wide delegation. The sync then runs in your environment.

You never see or store the client’s credentials. From your side it works exactly like a normal sync — same review-and-clean-up step at the end.

This is the answer to “Microsoft is asking me for permissions I don’t have.”

Add users manually

For trial setups, one-person clients, or directories without a supported sync provider.

1. From the People page, click Add User (Add One by One on a client with no users yet) for individual entry, or Upload CSV for a batch.

2. For CSV: make a file with columns for email, first name and last name, then choose it to upload.

3. Whitelist our mail infrastructure on the client’s mail server (see below) so training and phishing emails don’t get filtered.

Whitelist our mail infrastructure

Manual setups go through standard mail flow and can be filtered by the client’s mail security. Add our senders so training and phishing emails land:

• IP addresses: 54.240.43.212 and 34.232.212.184
• Safe sender: bounce@infimasec.com

Gateway whitelisting is a manual-setup concern; for a sync’d client we deliver straight into users’ mailboxes, past the gateway. Two exceptions: users whose mailbox the sync can’t reach (an on-premises Exchange mailbox, say) get mail through normal mail flow, and a security tool that scans mailboxes after delivery, such as Ironscales, can remove phishing tests even for a sync’d client. Allowlist phishing tests in a client’s email security covers both.

Switching providers later

If the client changes their mind about which directory provider they use, you can switch without losing the user list.

1. On the People page, click Switch Provider, then Disconnect & Switch.

2. Connect the new provider through the normal sync walkthrough above.

3. The user list stays put — users get rebound on the new provider’s first sync.

Who owns a synced user’s details

For a synced client, the directory is the source of truth. A synced user’s name, email, department, manager and office come from Microsoft 365 or Google Workspace, so the People page has no Edit for them; their row says Managed in Entra ID or Managed in Google.

To change a synced user’s name, change it in Microsoft 365 admin or Google Admin. We pick it up on the next sync: syncs run automatically every 6 hours, or click Sync Now on the People page to pull changes right away. Users you added by hand or by CSV are yours to edit.

When sync is off

If the People page says Directory sync is off, nothing from the client’s directory reaches us: new hires aren’t added, leavers aren’t removed, and name changes don’t arrive. Sync Now is unavailable while it’s off.

Click Turn on. We check the connection first. If it works, sync turns on and runs straight away. If it doesn’t — say, the Google admin who authorized it has since been deleted — we leave it off and tell you what to fix. See Directory sync is off or failing.

Post-sync cleanup

Every directory has accounts that shouldn’t be in security awareness training — service accounts, test accounts, ex-employees whose accounts weren’t disabled. These come in with the sync but you don’t want them counting toward billing or skewing your phishing results.

Microsoft 365 shared mailboxes don’t come in as users, so they never get training. You can still pick them as report and alert recipients — see Choose who gets reports and alerts.

1. On the People page, scan the user list for accounts that aren’t real people.

2. Select them and click Deactivate.

Deactivated users stay in the system but are inactive — no training, no phishing tests, no billing. Their historical data is preserved. You can reactivate them later if needed.

Frequently asked

I added users manually. Can I switch to sync later without losing them? Yes. Set up sync when you’re ready and we’ll match existing users by email on the first sync. You don’t have to delete the manual entries first.

A user got removed from the client’s directory. What happens here? On the next sync, that user is removed from our system — they’re gone, not marked inactive. If they come back into the directory later, the next sync brings them back with their training and phishing history. If you want a user to stay in the system but stop receiving training (for example, an employee on long leave), use the manual Deactivate action on the People page instead of relying on directory removal.

Do I need to set up DWD for every Google client? Yes. DWD is per-client — each client on Google Workspace needs our Client ID authorized in their Google Admin Console before the sync runs.

The DWD test failed after I added the Client ID and scopes. Read the message under the button: it says whether Google doesn’t know our Client ID at all or is missing specific scopes. Compare the values in Google Admin against the copy buttons on the dashboard. If they match exactly, give Google a few minutes to apply the new delegation, then test again — a new delegation often fails for the first minute or two.

A synced user’s name is out of date. Change it in the client’s directory, not here — synced users’ details come from Microsoft 365 or Google Workspace. Then click Sync Now, or wait for the next automatic sync. If the People page says the sync is off or failing, fix that first: no changes arrive until it runs.

Why does the Google scope list include gmail. if we’re just syncing directory?* The gmail scopes are what let us deliver training and phishing email into your client’s mailboxes via the Gmail API — that’s how sync’d Google clients receive our mail without whitelisting anything on a mail gateway. Without those scopes, mail won’t land.

Related

• Sync users (3-click path) — the simple happy-path version of this article.
• Client admins — the other tab on the same People page; manages admin access, not end users.
• Directory sync is off or failing — what each sync message on the People page means and how to fix it.
• Google sync fails with admin_policy_enforced — the troubleshooting article for the specific Google error code you’ll see when the client’s Workspace requires explicit third-party app trust.