Best Of

Hi @SJG,

Here’s what happens when you enable User Access Provisioning (UAP) with Entra groups for Smartsheet:

✅ What the Experience Looks Like

• If your users are already manually provisioned in Smartsheet, enabling UAP with Entra groups will not disrupt their current access.
• The process is essentially invisible to end users:
  • They keep their existing permissions.
  • They won’t see any difference in how they log in or use Smartsheet.

✅ What Happens Later

• Once UAP is active, group membership in Entra becomes the source of truth.
• If a user is removed from the Entra group, they will eventually be deactivated in Smartsheet during the next sync.
• If they’re added back to the group, they’ll regain access automatically.

✅ Direct Quotes from Official Sources

1. Smartsheet Help Center:
   “Enable UAP to automatically add users to your account when they sign up or on their next sign-in… Before you begin, prevent accidental duplicates by adding secondary email addresses to any account with an outdated email address.”
   Source: https://help.smartsheet.com/articles/2482322-user-auto-provisioning-uap
2. Microsoft Entra Provisioning:
   “The Entra ID provisioning service only updates users you assign to the Smartsheet app. Assign users by including them in specified role-mapped Entra ID groups.”
   Source: https://learn.microsoft.com/en-us/entra/identity/saas-apps/smartsheet-provisioning-tutorial
3. Deactivation Behavior:
   “If users are assigned to a Smartsheet role group in Entra ID, provisioned into Smartsheet as a result, and later removed from that group, they’ll be deactivated during the next provisioning cycle.”
   Source: https://help.smartsheet.com/articles/2482322-user-auto-provisioning-uap

✅ Step-by-Step Enablement Checklist (with Precautions)

Step 1: Audit Current Users

• Export Smartsheet user list.
• Verify email addresses are correct and match Entra ID accounts.
• Add secondary emails for outdated addresses to prevent duplicates.

Step 2: Prepare Entra Groups

• Create groups for Smartsheet roles (e.g., Licensed Users, Admins).
• Add all active existing users to correct groups.
• Double-check memberships before enabling UAP, removing someone later will deactivate them in Smartsheet.

Step 3: Assign Groups to Smartsheet App

• In Microsoft Entra → Enterprise Applications → Smartsheet, assign groups you created.
• Map roles if needed (e.g., Admin group → Smartsheet Admin role).

Step 4: Configure Provisioning

• Enable Automatic Provisioning in Entra for Smartsheet.
• Set the provisioning scope to Assigned Groups Only.
• Run a dry sync (Preview) to confirm no unexpected changes.

Step 5: Communicate before Go-Live

• Inform stakeholders that access will now be controlled by Entra groups.
• Explain that removal from a group = loss of Smartsheet access.

Step 6: Enable UAP

• Turn on provisioning and monitor the first sync.
• Check Smartsheet Admin Center for unexpected deactivations.

Step 7: Ongoing Maintenance

• Manage access by adding/removing users in Entra groups.
• Review memberships regularly to ensure accuracy.

⚠️ Precautions

• Do not enable UAP until all active users are in correct Entra groups.
• Verify group membership before removing anyone from Entra.
• Use secondary emails in Smartsheet to prevent duplicate accounts.
• Always run a test sync first to confirm expected results.

✅ This approach ensures a smooth transition and avoids accidental deactivation.

✅ Bottom Line

• Your current users will not be disrupted when you enable UAP.
• Going forward, Entra groups become the source of truth.
• If someone is removed from an Entra group, they lose access automatically.