Keep your helpdesk user list in sync with your company directory. The automation reads a chosen Microsoft Entra group and mirrors those people in Zammad. It creates, updates, or deactivates user records so your agents always see the right contacts.

A manual trigger starts a pull from Microsoft Graph to list groups, then filters by the group name you enter. It loads the members of that group, keeps only active users of type user, and maps profile fields like email, first name, last name, phone, mobile, and an Entra key. At the same time it fetches all Zammad users, matches by email, and compares datasets to find who is new, who changed, and who left the group. New people are created, existing users are updated, and removed members are set to inactive instead of deleted.

You need Microsoft Graph read permissions and a Zammad token that can manage users. Enter the exact Entra group name in the filter step, run a test, and review the results before going live. IT teams and support managers can cut manual account work and reduce mistakes during onboarding and offboarding. Expect faster updates, fewer errors, and a clear source of truth between Entra and Zammad.

• Pulls Microsoft Entra groups through Microsoft Graph and filters by the group name you provide.
• Gets group members and keeps only active users of object type user.
• Builds a standard user object for Zammad with email, names, phone, mobile, and an Entra key.
• Fetches all Zammad users and matches records by email to align identities.
• Compares datasets to find new users to create and existing users to update.
• Finds removed members by Entra key and sets those Zammad users to inactive.
• Uses a merge step to combine Entra and Zammad data for clean updates.
• Runs on a manual trigger for safe testing before you schedule it later.

• Reduce manual user updates from 2 hours to 5 minutes
• Automate 100 percent of create update and deactivate tasks
• Improve data accuracy by up to 90 percent by removing copy and paste
• Connect Microsoft Entra ID and Zammad in one flow
• Scale to thousands of users with no extra work
• Lower onboarding and offboarding errors by 80 percent

1. Import the template into n8n: Create a new workflow in n8n > Click the three dots menu > Select 'Import from File' > Choose the downloaded JSON file.
2. You'll need accounts with Microsoft Entra ID and Zammad. See the Tools Required section above for links to create accounts with these services.
3. In the n8n credentials manager, open the HTTP Request node named Get Groups from Entra, click Credential to connect with, choose Create new credential, then follow the on screen steps to sign in with Microsoft. Grant read access to groups and members.
4. Repeat the same credential selection for the HTTP Request node named Get Members of the default group to ensure both nodes use your Microsoft connection.
5. In Zammad, create a personal access token with permission to read and write users. In n8n, open any Zammad node, click Credential to connect with, choose Create new credential, enter your Zammad base URL and token, and save.
6. Open the If node named Select Entra Zammad default Group and type the exact Microsoft Entra group name that you want to sync.
7. Check the filter in the If node named Select only active Users and entra_obect_type="user" to make sure only active user objects pass through.
8. Review the Set node named Zammad Univeral User Object to confirm email, firstname, lastname, phone, mobile, and custom fields like entra_key match your data needs.
9. Run a test: click Execute on the manual trigger. Confirm groups load, the correct group is selected, and members appear in the next steps.
10. Validate matching: open the Merge node and confirm email is the match field. If your Zammad users use a different field, change it here and in the compare steps.
11. Dry run safely: temporarily disable the Create, Update, and Deactivate Zammad nodes, run the workflow, and inspect outputs from the compare steps to verify who would be changed.
12. Troubleshoot common issues: if no members return, verify Microsoft consent and the group name. If Zammad updates fail, check the base URL and token scope. Once results look correct, enable the action nodes and run again.