# Sitecore + Azure Active Directory integration > Automate user provisioning, access control, and content personalization by integrating Sitecore with Azure AD on tray.ai. **Canonical page:** https://tray.ai/connectors/sitecore-azure-active-directory-integrations/ **Sitecore connector:** https://tray.ai/connectors/sitecore-integrations/ **Sitecore documentation:** https://tray.ai/documentation/connectors/service/sitecore **Azure Active Directory connector:** https://tray.ai/connectors/azure-active-directory-integrations/ **Azure Active Directory documentation:** https://tray.ai/documentation/connectors/service/azure-active-directory ## Overview Sitecore is a digital experience platform enterprises use to deliver personalized web content and manage complex customer journeys. Azure Active Directory is Microsoft's cloud-based identity and access management service that controls who can access your organization's applications and resources. Integrating the two on tray.ai lets enterprises synchronize user identities, enforce role-based access policies, and deliver personalized content based on live directory data — without manual intervention. When Sitecore and Azure Active Directory run in silos, IT and marketing teams are stuck in a constant fight against mismatched user roles, slow onboarding, and security compliance gaps. Every time an employee joins, changes roles, or leaves, someone has to manually update permissions in Sitecore — and that process is error-prone and slow. Connecting Azure AD with Sitecore through tray.ai means organizations can automatically provision and deprovision Sitecore users based on Azure AD group membership, enforce least-privilege access policies, and make sure editors, approvers, and administrators always have the right level of access. There's a personalization angle too: Sitecore can pull Azure AD profile attributes like department, region, or job title to dynamically tailor content for internal portals or authenticated customer-facing sites. ## Use cases ### Automated User Provisioning and Deprovisioning When a new employee is added to an Azure AD group mapped to a Sitecore role, tray.ai automatically creates their Sitecore account with the right permissions. When that user is deactivated or removed from Azure AD, their Sitecore access is revoked immediately — no orphaned accounts, no lingering security risk. - Eliminate manual Sitecore account creation for every new hire - Remove access instantly when employees leave, so they can't make unauthorized content edits - Maintain a consistent audit trail across both systems for compliance reporting ### Role-Based Access Control Synchronization Azure AD security groups can be mapped directly to Sitecore roles like Content Editor, Publisher, or Administrator, so user permissions in Sitecore always reflect your current directory. tray.ai watches Azure AD for group membership changes and updates Sitecore roles in real time — no IT tickets needed. - Cut IT helpdesk overhead by automating role assignment workflows - Enforce consistent least-privilege access policies across the content platform - Speed up role transitions during promotions or team restructuring ### Personalized Content Delivery Based on Azure AD Profiles By syncing Azure AD user attributes — department, location, job function — into Sitecore contact profiles or xDB, marketers can configure rules that surface relevant content to authenticated users on internal portals or partner sites. Users don't have to fill out extra profile forms; the data's already there. - Deliver relevant intranet or partner portal experiences automatically - Cut time-to-personalization by using existing directory data - Improve engagement through content that actually matches the user's context ### Single Sign-On Governance and Monitoring Azure AD handles SSO for Sitecore, and tray.ai adds an automation layer that monitors SSO-related events — failed authentications, policy violations — and triggers notifications, escalations, or remediation workflows. Security teams get visibility into access anomalies without digging through logs in two separate platforms. - Alert security teams proactively to unusual Sitecore login patterns - Automate incident response workflows triggered by Azure AD sign-in risk events - Stay continuously compliant with corporate identity governance policies ### Onboarding Workflow Orchestration for Content Teams When a new content creator is added to an Azure AD publishing group, tray.ai can kick off a multi-step onboarding workflow that creates their Sitecore account, assigns them to the correct site and language versions, sends a welcome email with login instructions, and notifies their manager — all without anyone touching it manually. - Cut content team onboarding time from days to minutes - Standardize the onboarding experience across all global content teams - Eliminate coordination emails and manual hand-offs between departments ### Periodic Access Certification and Cleanup tray.ai can schedule regular audits that compare active Sitecore user accounts against current Azure AD membership, flagging or automatically disabling accounts with no corresponding active directory record. This supports compliance requirements like SOC 2, ISO 27001, and GDPR user data minimization. - Automate recurring access reviews without manual spreadsheet reconciliation - Shrink your attack surface by continuously removing stale Sitecore accounts - Produce audit-ready reports that satisfy compliance and security teams ### Multi-Site User Access Management at Scale Enterprises running multiple Sitecore sites — for different brands, regions, or business units — can use Azure AD group hierarchies to control which users can access which sites. tray.ai maps these group structures to Sitecore's multi-site configuration and updates access permissions as org structures change. - Manage complex multi-site Sitecore permissions from a single Azure AD source of truth - Prevent cross-site content access violations in regulated industries - Scale content operations globally without proportionally growing IT overhead ## Templates ### Azure AD Group Member to Sitecore User Provisioning Automatically creates a new Sitecore user account with the correct role whenever a member is added to a designated Azure AD security group, and deactivates that account when they're removed. Connectors used: Azure Active Directory, Sitecore ### Sync Azure AD User Profile Attributes to Sitecore xDB Contact Periodically pulls updated profile attributes from Azure AD — job title, department, office location — and upserts them into the corresponding Sitecore xDB contact record to keep personalization rules current. Connectors used: Azure Active Directory, Sitecore ### Sitecore Orphaned Account Audit and Cleanup Compares all active Sitecore user accounts against current Azure AD membership on a schedule, automatically disabling any Sitecore accounts with no corresponding active Azure AD record. Connectors used: Sitecore, Azure Active Directory ### Azure AD Sign-In Risk Alert to Sitecore Access Suspension Monitors Azure AD Identity Protection for high-risk sign-in events and automatically suspends the associated Sitecore user account pending review, then notifies the security team to investigate. Connectors used: Azure Active Directory, Sitecore ### New Sitecore Site Launch — Bulk User Permission Assignment When a new Sitecore site is configured, this template reads a target Azure AD group, retrieves all members, and bulk-assigns the appropriate Sitecore site-level permissions to each member — cutting down site launch preparation time significantly. Connectors used: Azure Active Directory, Sitecore ### Content Team Offboarding — Revoke Sitecore Access on Azure AD Deactivation Immediately revokes Sitecore access when an Azure AD account is deactivated, so departing employees can't make changes to live web content. Connectors used: Azure Active Directory, Sitecore ## Challenges Tray.ai solves ### Keeping User Permissions in Sync Across Two Separate Systems Azure AD and Sitecore have separate user stores and permission models. As teams grow and restructure, keeping role assignments accurate manually across both platforms leads to permission drift — users holding access they shouldn't, or missing access they need to do their jobs. **How Tray.ai helps:** tray.ai listens for Azure AD group membership events in real time and immediately reflects those changes in Sitecore, keeping both systems in sync without manual intervention or batch reconciliation delays. ### Complex Mapping Between Azure AD Groups and Sitecore Roles Sitecore's role hierarchy — spanning global roles, site-specific roles, and workflow roles — doesn't map neatly to Azure AD group naming conventions. Translating between these two permission models requires custom logic that's hard to maintain and document. **How Tray.ai helps:** tray.ai's workflow builder lets teams define and version custom mapping logic between Azure AD groups and Sitecore roles using configurable lookup tables and conditional branching. The mapping stays transparent, auditable, and easy to update as either system changes. ### Handling Multi-Site and Multi-Tenant Sitecore Environments Large enterprises often run multiple Sitecore instances or sites across different brands, regions, or business units, each with its own access requirements. Managing Azure AD integration at that scale without automation means serious IT overhead and inconsistent security policies. **How Tray.ai helps:** tray.ai supports parameterized, reusable workflow templates that can be deployed across multiple Sitecore instances with different configuration inputs, so a single integration design can govern access across your entire Sitecore environment. ### Latency Between User Offboarding in Azure AD and Access Removal in Sitecore When an employee leaves, there's often a dangerous window between when IT deactivates their Azure AD account and when someone remembers to revoke their Sitecore credentials. During that window, they could still access and modify live content. **How Tray.ai helps:** tray.ai triggers Sitecore account deactivation the moment an Azure AD account is disabled or deleted, closing the access gap to near zero and producing a timestamped audit log that satisfies security and compliance requirements. ### Surfacing Azure AD Profile Data Within Sitecore Personalization Rules Sitecore's personalization and xDB capabilities are powerful, but feeding them with current employee or partner profile data from Azure AD requires a reliable data pipeline. Without automation, marketers either work with stale profile data or wait on IT to run manual exports. **How Tray.ai helps:** tray.ai automates scheduled extraction of profile attributes from Azure AD and maps them to Sitecore xDB contact facets, giving marketers a continuously refreshed data foundation for personalization rules — no dependency on manual IT processes. ## Learn more - Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/ - Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/ - Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/ - Book a demo: https://tray.ai/contact/