CybSafe can pull each person's line manager across from Microsoft Entra ID as part of your SCIM provisioning sync. Once mapped, manager relationships show on people's profiles in CybSafe and support features like manager reporting and escalation.
This article assumes you already have user provisioning with Microsoft Entra set up and running. If you haven't configured that yet, start there first.
What you'll need
Administrator access to Microsoft Entra ID, with permission to edit the CybSafe enterprise application
Administrator access to CybSafe
Microsoft Entra ID Premium P1 or P2 (required for SCIM provisioning)
The CybSafe provisioning sync already configured and running
Step 1. Add the manager attribute to the schema
On some tenants, manager doesn't appear in the CybSafe app's attribute list by default. If you don't see it when you get to Step 2, add it to the schema first:
Open this link and sign in with your Microsoft administrator account. This forces on the schema editor for your tenant.
Go to Enterprise applications and select CybSafe.
Select Provisioning, then Edit provisioning.
Select Microsoft Entra ID Users, then open Advanced options.
Select Edit attribute list for CybSafe.
Add a new target attribute using this exact string, and save it as type String:
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager
Step 2. Map externalId to the object ID
CybSafe resolves the manager reference by matching it against the externalId. If externalId isn't mapped, the CybSafe platform won't be able to resolve the user manager.
In the CybSafe enterprise app on Entra, go to Provisioning > Mappings.
Click Provision Microsoft Entra ID Users.
Click Add New Mapping (or edit the existing
externalIdrow if one is already there).Set:
Mapping type: DirectSource
attribute:objectId
Target attribute:externalIdSave the mapping.
Step 3. Map the manager attribute
Still on the Attribute Mapping page, select Add New Mapping.
Set the target attribute to
manager(the one you added in Step 1, or the existing one if it was already there).Set the source attribute to Manager.
Save the mapping.
Step 4. Sync and confirm
Save your provisioning configuration if you haven't already.
Let the next provisioning cycle run (or trigger it from Entra), and check the provisioning logs to confirm the sync completed without errors.
In CybSafe, open People overview and check a synced person's profile to confirm their line manager now shows.
Troubleshooting
The manager field is blank after syncing Double-check the target attribute string was entered exactly as shown in Step 1, and that the person's manager already exists as an active profile in CybSafe. If the manager was added to Entra after the initial sync, they'll need their own successful sync cycle first.
The mapping saves but the relationship never links This is almost always a missing or incorrect externalId mapping. Check that externalId is mapped to objectId for every person (Step 2) — Entra uses it to identify the manager's profile.
Still stuck? Email [email protected] and we'll take a look.