[Enhancement]: Separate control for Entra ID group sync from people-search

[Perhpsn]

What features would you like to see added?

Currently, syncing a user's Entra ID group memberships to the local database is gated by the same flag used for the people-picker/Entra search feature (USE_ENTRA_ID_FOR_PEOPLE_SEARCH). This forces an all-or-nothing choice: enabling Entra group sync (so users can be shared resources via their Azure AD groups) also enables Entra ID people search for every user, including service/non-interactive accounts we don't want surfaced or searchable in the people picker.

Please add a dedicated environment variable, e.g. SYNC_ENTRA_ID_GROUPS, to control group membership synchronization independently of people search:

# Enable Entra ID people search integration in permissions/sharing system (people picker)

USE_ENTRA_ID_FOR_PEOPLE_SEARCH=false

# Enable syncing the logged-in user's Entra ID group memberships to the local database on login

SYNC_ENTRA_ID_GROUPS=true

With this change:

• SYNC_ENTRA_ID_GROUPS=true + USE_ENTRA_ID_FOR_PEOPLE_SEARCH=false → group membership sync runs on login (so Azure group-based sharing keeps working), but the people picker does not search/expose individual Entra users.

• USE_ENTRA_ID_FOR_PEOPLE_SEARCH=true should continue to imply/require sync is meaningful (or at minimum not be blocked by the new flag), preserving current behavior for orgs that want both.

More details

• Our organization has many service/non-interactive accounts authenticating via OpenID/Entra ID. We don't want these accounts (or any user) discoverable via the people picker, but we do want to keep sharing agents/resources with Azure AD groups, which requires group membership sync to keep local Group documents up to date.

• Today this isn't possible because both behaviors are controlled by entraIdPrincipalFeatureEnabled() (USE_ENTRA_ID_FOR_PEOPLE_SEARCH + OPENID_REUSE_TOKENS), used both in GraphApiService.js for people search and as the gate in PermissionService.syncUserEntraGroupMemberships.

• Suggested implementation: introduce SYNC_ENTRA_ID_GROUPS as its own flag checked in syncUserEntraGroupMemberships/performEntraGroupMembershipSync, independent of entraIdPrincipalFeatureEnabled. Still require OPENID_REUSE_TOKENS=true and a valid access token/idOnTheSource, since those are needed for the Graph on-behalf-of token exchange regardless of which feature triggered it.

• Documentation (.env.example) should be updated to clarify the two flags are independent.

Which components are impacted by your request?

General, Other

Pictures

No response

Code of Conduct

• I agree to follow this project's Code of Conduct