Syncing with Microsoft 365 or Google Workspace
Connect once and stop maintaining people by hand. What comes across, what does not, and how the daily sync behaves.
- Last updated
- 8 minute read
- People
- Directory
Directory sync reads your Microsoft 365 or Google Workspace directory and keeps Signed's people in step with it. Connect once, decide whether it runs daily, and then forget about keeping names and job titles up to date. On Google Workspace you can also have Signed write each person's signature into their Gmail settings.
Connecting
Connecting needs an owner of the organisation, because it grants Signed read access to your directory.
Microsoft 365
Keep your people in Signed up to date from Microsoft 365 or Google Workspace.
What comes across
- Display name
- Job title
- Department
- Phone and mobile
- Company name
- Office address
Last sync
142
people, 9 departments
3 job titles updated
1 leaver
Permissions
Read-only access to user profiles. Signed never writes to your directory.
Step 1 of 5
Connect
Signs in to Microsoft with your admin account and asks for read-only access to user profiles. Signed never writes to your directory.
Reduced motion is on, so the tour waits for you. Use the arrows or the list to move through the steps.
What syncs, and what does not
| Comes across | Does not come across |
|---|---|
| Display name, first name, last name | Photos |
| Email address | LinkedIn and X handles |
| Job title and department | Website |
| Mobile and business phone | Anything you have edited only in Signed |
| Company name and office address |
Note: Signed reads only accounts that are enabled, and skips guests and external accounts with an #EXT# address. Those people can still be added by hand or with a CSV import.
- Updated people are shown in the list so you can see what changed. A changed job title is worth a glance, because it is the field most likely to be out of date.
- Departments are created from the departments in your directory, and people are linked to them.
- New starters are added and count towards your bill from then on, so the charge follows your directory.
- Leavers are marked inactive. Their records stay, their signature stops, and the audit log records the run.
Google Workspace, and Gmail delivery
Google Workspace connects the same way, with two things worth knowing before you start.
- Your super admin has to authorise Signed first. In the Google Admin console, under Security, then API controls, then Domain-wide delegation, they add the client ID the portal shows and give it the two scopes. Until they do, the first sync fails with a message saying so.
- You sign in with Google to confirm the domain. That address is the one Signed reads your directory as. One Google Workspace domain can only be connected to one Signed account.
Departments come from each person's organisational unit, and suspended or deleted accounts are skipped, exactly as on Microsoft 365.
Gmail delivery: Gmail has an API for signatures, so Signed can write each person's finished signature straight into their own Gmail settings. Switch on Write signatures into Gmail on the Google Workspace card, or run Push signatures now after changing a template. It is off by default, because turning it on replaces whatever signature each person had set in Gmail. Tell them before you do.
| It does | It does not |
|---|---|
| Write the rendered signature into each person's Gmail settings | Read anyone's mail. The Gmail scope only covers the signature setting |
| Cover Gmail on the web | Touch a signature someone adds inside another mail app |
| Refresh every signature at each sync, and on demand | Take the signature away again if you disconnect. It simply stops updating |
Running a sync
Sync now runs it immediately, which is what you want after changing a batch of job titles. The daily option runs it for you at most once every 24 hours, so there is no point in a manual run immediately after an automatic one.
- Change things in your directory first, not in Signed.
- Give it a moment. Directory changes are not always instant on Microsoft's side.
- Choose Sync now and read the result summary.
- Spot-check one person whose details changed.
Where people came from
Every change to your people, newest first.
- Directory sync3 job titles updatedToday, 09:14
- CSV import142 people, 2 rows skipped22 Sep, 16:02
- Added by handUser F22 Sep, 15:48
- Directory syncNo changes1 Sep, 08:00
Tip: If someone's job title in Signed keeps reverting, you are editing it in the wrong place. The directory wins on every sync for the fields it covers.
Disconnecting
Disconnecting stops the sync and removes the stored access. The people Signed has already imported stay, along with their departments and any rules pointing at them.
Watch out: After disconnecting, nothing keeps people up to date. Job title changes in your directory will no longer reach signatures, and leavers will keep getting one until someone removes them.
Common questions
Which directory permissions does Signed ask for?
On Microsoft 365, read-only access to user profiles through Microsoft Graph. On Google Workspace, the read-only admin.directory.user.readonly scope, plus gmail.settings.basic only where you switch Gmail delivery on. Signed never creates, changes or deletes anything in your directory, and it never reads anyone's mail.
Can I connect both Microsoft 365 and Google Workspace?
Yes. Each connection syncs the people in its own directory, and you can leave either one running or switch it off on its own. Agencies running several organisations can connect each one to its own directory.
Why is someone missing after a sync?
They are most likely a guest, an external account, or disabled in your directory. Add them by hand or with a CSV import if they still need a signature.
Related articles
- Adding and editing peopleThe fields on a person's record, which ones matter for signatures, and what happens when you delete someone.
- Import people from a CSV fileWhat the importer expects, what it does with duplicates, and how it creates departments on the way through.
- Departments and targetsDepartments do two jobs: they group people, and they are what rules and campaign audiences match on.
Something here out of date, or a step that did not work? Tell us and we will fix the article. Every page is checked against the running product, so corrections are welcome.