Connect Microsoft Entra ID

#Steps

1. In WorkplaceSignatures open Directory and click Connect Microsoft Entra ID.
2. Sign in as a Global Administrator and approve the permissions (read users and group memberships).
3. You're returned to the app and the first sync runs. After that we sync every 15 minutes.

#Signatures in Outlook

Microsoft does not offer an API to write Outlook signatures, so we use an Outlook add-in that inserts the signature on every new message:

1. Set Directory → Mail platform to Outlook / Microsoft 365.
2. A Microsoft 365 admin opens Microsoft 365 admin center → Settings → Integrated apps → Upload custom apps and deploys the manifest URL shown on the Directory page (/outlook/manifest.xml) to everyone (or a group).
3. The add-in activates on new messages in Outlook on the web, in the new Outlook for Windows and Mac, and in classic Outlook for Windows on a current Microsoft 365 build, and fetches each person's current signature. Classic Outlook for Mac and the Outlook apps for iPhone and Android don't run it; people there copy their signature from their own signature page.

#Profile photos

With Use directory photos on (the default, under Directory → Microsoft Entra ID), each sync copies people's Microsoft 365 profile photos into WorkplaceSignatures. Each one is cropped to a 256px square and hosted at a public link that mail clients can load. That copy fills {{photo_url}}. It needs no extra permission: User.Read.All already covers photos.

• An admin headshot (Employees → person → Headshot) or the employee's own photo (self-service, when Photo URL is unlocked) always wins over the directory photo.
• Photos are rechecked about once a day, a few hundred per sync. We only download a photo when Microsoft reports a new version (its media etag), and we slow down when Microsoft Graph asks us to. A new photo can take up to a day to show.
• People without a photo, or without an Exchange Online mailbox to hold one, simply get none. Removing a photo removes it from the signature at the next check.
• The sync history table on the Directory page has a Photos column (on wider screens) showing how many photos each sync updated or cleared, plus any failures or throttling. It shows a dash when photos are off.
• Turn the setting off to stop copying photos. Stored copies are forgotten and signatures re-render right away.

#What we access

Read-only user profile (including the profile photo) and group membership data. Group names (including nested groups) are copied onto each person on every sync, so "Group" assignment rules and campaign targets work. If group access is not granted, people still sync without groups. We never read mail.