Browse Policies & Filtering
- Dashboard overview
- Insights overview
- Sites Overview - Network Deployments
- Policies Overview - Create and Edit
- Custom Lists overview
- Clients Overview - Device Agents and Profiles
- Users Overview - Directory Users and Personas
- Organizations Overview - MSP Tenant Management
- Lookup Tool Overview
- Query Log Overview
- Settings Overview - Account Administration
- Help & Support Overview
- Signing In - Login, 2FA, and Password Reset
- Two-factor authentication (2FA)
- Add system users (role-based access)
- Check domain classification with the Lookup Tool
- Configurable objects and their associations
- Configure notifications
- Working with organizations (multi-tenant)
- Working with policies
- Content categories
- Security categories
- Application categories (Zero Trust app management)
- Working with allow and block lists
- Zero Trust TLD Filters
- Safe Search explained
- Safe Search supported search engines
- YouTube Restricted Mode explained
- Custom block pages
- Prevent DNS bypass
- Don't mix DNS providers
- Active Directory group policies
- Entra ID group policies
- Tracking individual users
Entra ID group policies
Apply ScoutDNS policy by Microsoft Entra ID (formerly Azure AD) group membership. Uses a read-only Enterprise App connection, no agent-side AD discovery needed.
ScoutDNS can enforce policy by Microsoft Entra ID group membership so the policy follows the user across devices. This article covers Entra ID; for on-prem Active Directory see Active Directory group policies.
How Entra ID sync works
ScoutDNS connects to your Entra ID tenant via an Enterprise Application with read-only Microsoft Graph permissions. Once authorized, the ScoutDNS policy engine matches users from roaming clients to Entra users and groups, and applies the policy you’ve configured in the Persona.
[!NOTE] ScoutDNS only requests the minimum read-only permissions needed to discover users and groups. It does not gain access to emails, messages, calendar data, or any other resource. You can revoke the consent at any time from the Entra admin console.
Users not in any mapped group fall back to the Device Profile default policy.
Step 1: Enable user policies on the device profile
Entra ID group policy layers on top of device profiles. The profile sets the fallback; Entra groups override it for matching users.
- Open Clients, switch to the Configure tab, and click the relevant profile.
- Click Edit profile, then toggle Enable User Policies on.
- Save.
If you haven’t deployed roaming clients yet, start there.
[!IMPORTANT] The profile’s default policy is the fallback for users who don’t match any Entra group in the Persona. Choose carefully, unmapped users get this.
Step 2: Connect your tenant and create a Persona
Creating the Persona and connecting the tenant happen in one drawer. You need Admin or Super Admin (an organization Manager can also do this with their organization selected).
- Open Users and switch to the Configure tab.
- Click New Persona. If your account uses Organizations, the persona is created in the organization currently selected in the header; with no organization selected you’ll be asked to pick one first (new personas are always scoped to a single organization, and choosing one also switches your console to that organization’s view).
- Name the Persona and leave Service set to Entra ID.
Add your tenant (first time only)
If the Tenant dropdown is empty, connect your tenant under Add a new Entra tenant:
- Optionally enter your Microsoft tenant domain (e.g.
acme.onmicrosoft.com) to go directly to that tenant, or leave the field blank to pick the tenant on Microsoft’s sign-in page. - Click Add Tenant. The console redirects to the Microsoft admin consent page for the read-only ScoutDNS Enterprise App.
- Approve the consent. You’re returned to this drawer, and the new tenant appears in the Tenant dropdown.
MSPs running multi-tenant deployments repeat this once per customer tenant; every consented tenant shows up in the dropdown afterward.
Create the Persona
Select the tenant in the Tenant dropdown and click Create Persona.
[!NOTE] A Persona has exactly one binding, either an Entra tenant or an AD domain, and a tenant can be bound to only one Persona at a time (the dropdown lists only unbound tenants). The binding is permanent: to point a Persona at a different tenant, delete it and create a new one.
Map groups to policies and set priority
Open the new Persona from the personas table and switch to its Entra ID tab. Synced groups appear under Observed Groups; the mappings you configure live under Configured Groups.
[!TIP] For large directories, the initial sync can take a few hours to complete. ScoutDNS performs regular background syncs to pick up new groups and users; Sync with Entra on this tab triggers one on demand, and Last sync shows when data was last refreshed.
- Click Edit Groups.
- Add groups from Observed Groups, or use New to type a group name that hasn’t synced yet.
- For each configured group, pick the Policy that applies. Every group needs a policy; the save is rejected otherwise.
- Order the rows with the up/down arrows. The Pri. column follows the order: row 1 is priority 1 (highest). Priority resolves conflicts when a user belongs to more than one mapped group, the highest-priority match wins.
- Save.
Any Entra security group can be selected for policy assignment. ScoutDNS applies the new mapping for matching users on the next DNS query.
Organizations (MSP accounts)
On accounts with the Organizations tab, the persona is linked to the organization you chose at creation, so the Users tab and per-tenant reporting line up automatically. You can review or change links later from Organizations → (your org) → Personas, the same pattern as linked Sites and Profiles.
Related
- Single sign-on (SSO) with Microsoft Entra ID, admin-console SSO (vs end-user policy enforcement)
- Active Directory group policies, the on-prem AD counterpart
- Roaming clients (device agents)
- Working with policies
- Organizations, multi-tenant configuration