Help center › Set up
People from Google Workspace or Microsoft Entra
Districts that keep their staff in Google Workspace or Microsoft Entra need no users file. On Admin › Import, the cards People from Google Workspace and People from Microsoft Entra read your directory and make every person a person in Beacon, with their name, title, phone, the site you map them to and the role you grant, refreshed each night. Devices then have holders to be checked out to, requests have requesters, and nobody types a roster twice. Beacon only ever reads; nothing is written back to Google or Entra.
What you need
Google Workspace
- The Google Admin connection. The same connect reads people: on Google's consent screen it asks to read users and group members as well as Chrome devices. A connection made before people were offered carries the Chrome devices permission alone; the card says so and offers Connect Google Admin again. The Chromebook sync is unchanged either way.
- A Google Workspace administrator account that can read users and groups: a Super Admin, or a custom role with Admin API privileges › Users › Read and Groups › Read.
Microsoft Entra
- A Global Administrator of your Entra tenant. Connect Microsoft Entra sends them to Microsoft's admin consent page, which lists the permissions on Beacon's Microsoft app: “Read directory data” (people, groups and the organization record) and “Read Microsoft Intune devices” (for Devices from Intune), plus the sign-in permissions Beacon's Microsoft sign-in uses (sign users in, view their basic profile and email address, sign in and read user profile, maintain access). Beacon only reads; nothing is ever written. The administrator accepts once for the whole tenant; nobody signs in to Beacon through this.
- Nothing secret is stored. Beacon keeps the tenant's id, its name and its verified domains, who connected and when. Taking the consent back is done in Entra, under Enterprise applications; Disconnect on the card only makes Beacon forget the tenant.
The connection finishes only in the signed-in session of the administrator who clicked Connect, and Beacon checks that this administrator's own address, the one on their Beacon account, holds a Global Administrator account in the tenant that consented. The role has to be active on that account itself: assigned directly rather than through a group, and activated first if it is only eligible in Privileged Identity Management. A connect link forwarded to someone else does nothing, and a tenant cannot be attached to a district it does not belong to.
Preview first, then sync
Nobody is added until you have looked. Preview reads the whole directory, counts what a sync would do (how many people are in the directory, how many would be added or changed, how many are disabled there, how many students would be left out) and changes nobody. It also lists what it found, so the mapping below can be built from your own org units, departments, offices and groups rather than typed from memory. Connecting Microsoft Entra runs a preview on its own. Once a preview has finished, Sync people now runs the real pass, and Sync nightly keeps it current every night after 02:00 in your organization's time zone; switched on when no real pass has run since the last 02:00, it runs one within the hour, with the saved mapping. A preview belongs to the connection it ran on: connect Google Admin anew (perhaps to another Workspace) and the card asks for one more before a real pass.
The mapping
| Setting | Google Workspace | Microsoft Entra |
|---|---|---|
| Students | Tick the org units that hold students (everything under them counts), or add a group's address. | Add the groups or departments that hold students. |
| Site | An org unit and everything under it goes to a site; the deepest unit wins. A unit segment spelled exactly like a site's name or code (“/Staff/LHS/Science” when a site has the code LHS) needs no entry. | A department or an office (choose which) goes to a site. A value spelled exactly like a site's name or code needs no entry. |
| Role | Members of a group (its address), or everyone under an org unit, become agents or admins. | Members of a group (its display name or object id) become agents or admins. |
Everyone else is a requester. Admin wins over agent when a person is in both groups. Owner is never granted, and an owner is never changed by a sync, neither their role nor their status. On Starter, which includes three agents, a person a group would make an agent or admin past that comes in as a requester; the audit log says so, and a later pass grants the seat once there is room. Include students is off to start, and it works through the student entries above: the people in the org units, groups or departments you mark are left out until you turn it on. With nothing marked, everyone in the directory is added, so mark the student units before the first real pass; the card points out an org unit or department with “student” in its name that is not marked, and asks before a sync with nothing marked. A pass reads the saved mapping, so Preview and Sync people now wait while the mapping has unsaved changes: press Save mapping, preview again, then sync. A help desk needs staff first, and a district of 5,000 students gains nothing from 5,000 requester accounts until the portal is ready for them. Turn the switch on when it is, and the next pass adds them as requesters.
What is read, per person
| In the directory | In Beacon |
|---|---|
| Primary address | The match key. A person already in Beacon with that address is updated, never duplicated, and an address renamed in the directory follows the person: Beacon keeps the directory's own id from the previous pass, so the account takes the new address rather than a second one appearing. In Entra the address is the one sign-in uses: the mail address when its domain is one the tenant has verified, otherwise the user principal name. Guest accounts are skipped. |
| Name, job title, phone | Name, title, phone. Google reads the primary organization's title and the primary phone; Entra reads job title and the first business phone, else the mobile number. |
| Org unit (Google), department and office (Entra) | The site, through the mapping above. |
| Group memberships | The role, through the mapping above; nested groups count. |
| Suspended or archived (Google), account disabled (Entra) | Disabled in Beacon: signed out everywhere, no sign-in until the directory enables them again. A new person who is already suspended arrives disabled. |
A new person arrives as invited with no password and no email: they sign in through your single sign-on (the sync records the directory's id, so their first sign-in lands on this account), or an admin sends an invite from Admin › Users when they should set a password. With Email people added by an import off under Admin › Settings › Email, the people a sync adds get no Beacon email at all, as people from an uploaded file do; they still see notifications in the app. Nothing is ever deleted: a person who leaves the directory stays in Beacon as they were, with their tickets and devices, until an admin removes or disables them.
Your edits survive
After a person's first pass, Beacon follows the directory only where the directory's own answer changed since the previous pass. A title or phone an admin typed, a move to another site, a role granted by hand, a disable by hand all stay while the directory repeats itself; a new title in the directory, a new org unit or department, a group joined or left, a suspension lifted are applied. On the first pass for someone already in Beacon (from a spreadsheet, or from signing in) the name follows the directory, empty title, phone and site fill in, and a role only ever rises. Leaving the agents group takes that role away, and the person leaves their teams with it, as an admin's demotion would. A site is never cleared by a sync, and a disable by hand is never undone by one.
When it runs, and what the card shows
Preview and Sync people now run when you press them; the nightly pass runs after 02:00 in your time zone once the switch is on. Each pass is listed on the card with its counts (in the directory, added, updated, disabled there, students left out, skipped). Mapping entries that matched nobody in the last pass are named, so a mistyped org unit or group is caught before the night. If the directory refuses Beacon (a Google administrator revoked access or their account is gone; an Entra administrator removed the consent) the card says so and asks you to connect again; nightly passes pause until then. If the Google Admin account can reach Google but not the directory (a delegated administrator without the Users and Groups read privileges), that pass fails with a message naming the privileges and the Chromebook sync on the same connection carries on; grant them in Google Admin and run the pass again. A pass that succeeds clears the notice by itself. A temporary rate-limit answer only fails that pass, and the next one tries again.
What this is not
It is a directory sync of people, not a roster: classes, schedules, guardians and grades are not read here, and Clever and ClassLink remain sign-in providers. A district on PowerSchool adds grade levels, homerooms and classes with People from PowerSchool. Devices still come from Google Admin, from Intune on this same Entra connection, from Mosyle Manager on your district's own API token, or from an import; once people are in, the device syncs and the assets file can give each device its holder by email.