Entra group targeting and Directory Sync

Applies to client 2.0.x and later. For tenant admins.

With Entra group targeting (Enterprise) an approved application, a rule or Run in sandbox can be limited to members of Microsoft Entra groups. Everyone else does not get that entry at all.

Directory Sync and the device’s membership lookup

Connect Directory Sync

Group targeting reads group members through a separate, read-only enterprise app, AdminExplorer Directory Sync, with two Microsoft Graph application permissions: GroupMember.Read.All and User.Read.All. The sign-in app stays sign-in only.

Sign in to this portal with Microsoft (not an email link), using your work account in your Entra tenant. You must be a Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator there, and your portal address must be your user principal name there. The sign-in proves the role, and must be less than one hour old.
Under Settings, Entra group targeting, choose Connect Directory Sync and grant the admin consent.
The first sync starts at once. The card shows the last successful sync, the number of groups and users, and any error.

A directory can be connected to one portal tenant.

Turn it on and assign groups

Turn on Entra group targeting in Settings and save.
In the Policy editor, open an application or rule and add groups under Assigned Entra groups (search by name or paste the group object id). At most 20 groups per entry and 200 distinct groups per policy.
For Run in sandbox, use Limit to Entra groups in the Sandbox section.

An entry without groups applies to everyone, as before.

{
  "name": "Network diagnostics",
  "dataPath": "C:\\Program Files\\Contoso\\NetDiag\\netdiag.exe",
  "arguments": "",
  "hashSha": "",
  "friendlyName": "Network diagnostics",
  "globalApplication": true,
  "allowChildElevation": false,
  "showInMenu": true,
  "menuCategory": "Tools",
  "assignedGroups": [
    { "id": "4f2a6c1e-8b3d-4e5f-9a7b-1c2d3e4f5a6b", "name": "IT Support" }
  ]
}

Rules on the device

Fail closed. A group-scoped entry applies to a user only when targeting is on and the device knows that the user is a member of one of its groups. Targeting off, a Standard license, no answer from the portal or an invalid id: the entry applies to nobody.
On demand only. Pre-approved (automatic) elevation is per machine, not per user, so entries with groups never start silently: they work through Run with AdminExplorer and the tray menu, which lists them only for members.
Membership is resolved by the portal, never shipped to devices. A device asks only for the signed-in user’s own groups among those the policy uses, identified by the user’s SID (Entra-joined users and hybrid users) and user principal name.
With Manual approval, a request matched through a group is checked again when the approver approves; if the user has left the group meanwhile it is denied with GroupChanged.

Offline behaviour

A membership answer is fresh for 15 minutes. On a miss the request waits at most 5 seconds for the portal.
When the portal does not answer, the device uses the last good answer if it is younger than 24 hours; otherwise the user has no groups and group-scoped entries do not apply.
Sync now on the device forces a new lookup.
The portal syncs every 15 minutes, when a policy that uses groups is saved, and with Sync now on the Directory Sync card. A copy older than 24 hours is not used.

Stop and privacy

Disconnect in Settings deletes the membership copy at once; group-assigned entries stop applying. To revoke the consent, also delete the enterprise app “AdminExplorer Directory Sync” in Microsoft Entra. Revoking it in Entra alone also works: the next sync gets “access denied” and deletes the copy.
The portal stores per member only the Entra object id, the user principal name, the on-premises SID (hybrid users) and the ids of the groups your policy uses, in the same region as the rest of your tenant data. No names, mail addresses (other than the UPN), passwords or other attributes.
The copy is deleted when targeting is turned off, when Directory Sync is disconnected, when the consent is revoked and when the tenant is deleted.

AdminExplorer documentation, published by Circle of Bytes ApS. Customers sign in at portal.adminexplorer.circleofbytes.com.