People Directory

The Directory (📇 in the sidebar) gives every signed-in user a searchable company directory: name, title, department, email, phone numbers, office, assistant, custom fields, and a profile photo. Search covers all of it, with a department filter — and email/phone entries are clickable (mailto: / tel:).

Finding someone fast

You don’t have to open the Directory to look someone up. Press @ anywhere in the app and the command palette opens in people mode: type a few letters of a name, email address, job title, or department and matching colleagues appear with their photos, ready to open. It floats over whatever page you were on, so you can check who runs Payroll without leaving the document you’re writing.

Views & columns

Switch between three views (your choice is remembered per browser):

• Cards — photo cards with contact links, assistant, and any custom fields marked “show on cards”.
• List — a sortable table (click a column header to sort). Use the Columns menu to choose exactly which columns you see — standard ones plus any custom fields; your selection is remembered per browser.
• Departments — everyone grouped by department.

Every name links to a profile page: photo, title, contact details, custom fields, and — the useful part — Documents by that person, listing everything they’ve authored in the spaces you can see. And the directory feeds the Ask feature: questions like “who is the head of IT?” answer with the person’s name, title, and contact info, linked to their profile. Article bylines link too — click By {author} on any document to jump to the author’s profile.

Quick print directory

Press the Print / PDF button (top right of the Directory, in any view) and what comes out of the print dialog isn’t the on-screen directory — it’s a compact phone list with exactly the columns an admin configured under Settings → Directory → Quick print directory (built-in fields and custom fields both work, in the order set there). Hidden directory entries are never printed. Save as PDF from the same dialog for a shareable copy.

Managing entries (admins)

Under Settings → Directory, admins can:

• Add people by hand — name plus any of title, department, email, phone, mobile, and office. Available in every edition.
• Edit or remove manual entries.
• Hide any entry (including synced ones) from the directory without deleting it — hidden entries survive future syncs.
• Link an assistant — pick any directory person as someone’s assistant; it shows on their card and as an optional list column.

Custom fields

Under Settings → Directory → Custom fields, define extra attributes (cost center, pronouns, desk extension, skills, …). Each one:

• displays as a plain field (label + text) or as tags — comma-separated values rendered as badge chips, ideal for skills, certifications, or technologies (“Azure, Intune, PowerShell” becomes three badges on cards, lists, and profile pages),
• appears in the list view’s column picker,
• optionally shows on cards,
• is editable per person in the admin form, and
• (Enterprise) can be mapped to a directory attribute — one mapping per connected provider, because the two use different property languages. Microsoft takes a Graph property such as onPremisesExtensionAttributes.extensionAttribute1 through 15; Google takes a Workspace path such as customSchemas.HR.employee_id. A field can carry both, so a workspace connected to either populates the same column. Mapped values fill automatically on every sync; values you enter by hand in unmapped fields survive syncs untouched.

Microsoft 365 sync (Enterprise)

With the Enterprise edition and the directory_sync entitlement, the directory fills itself from your Microsoft Entra tenant — users, titles, departments, phone numbers, offices, and profile photos.

The fast way — one click

On Settings → Directory → Microsoft 365 sync, click Set up automatically with Microsoft, then sign in at microsoft.com/devicelogin with the code shown, as a tenant admin. CompassDocs creates the app registration with the User.Read.All and GroupMember.Read.All application permissions, grants admin consent, mints a 24-month client secret, and fills in the configuration. Then choose your filters and click Sync now.

The one-time sign-in token is discarded afterward, and the panel shows the secret’s expiry date — set a reminder to rotate it. Prefer manual setup (or your tenant blocks the device-code flow)? Steps below.

1. Register an app in Microsoft Entra (manual)

1. In the Entra admin center, go to App registrations → New registration. Name it e.g. CompassDocs Directory; no redirect URI is needed.
2. Under API permissions → Add a permission → Microsoft Graph → Application permissions, add User.Read.All (and GroupMember.Read.All if you’ll limit the sync to a group), then click Grant admin consent.
3. Under Certificates & secrets, create a client secret and copy its value immediately (it’s shown once).
4. From the app’s Overview page, note the Directory (tenant) ID and Application (client) ID.

2. Connect it in CompassDocs

In Settings → Directory → Microsoft 365 sync, enter the tenant ID, client ID, and client secret (stored write-only — never shown again), choose your filters, and click Sync now.

Keeping the junk out

Real tenants are full of service accounts and shared mailboxes. The sync excludes disabled accounts always and guests by default, and offers:

Control	Effect
Require a job title	Skips accounts with no title — cuts most service accounts.
Require a phone number	Only people with a business or mobile number.
Limit to an Entra group	Sync only the (transitive) members of one security group — the cleanest option for large tenants.
Sync profile photos	Small (48 px) photos, stored locally.

Synced entries are labeled Microsoft 365 in the admin list. You can hide individual synced people; hides persist across syncs. People who leave the tenant (or stop matching your filters) are removed on the next sync — manual entries are never touched.

One exception: a sync that would remove more than half the people it previously synced holds those removals back and says so, on the assumption that a credential or filter broke rather than that most of your staff left. The panel then offers Sync and remove the N to allow them once. Syncing again without it won’t clear the hold.

On demand, not scheduled

Syncing runs when an admin clicks Sync now. Run it after personnel changes, or whenever you like — a sync typically takes a few seconds per few hundred users.

Not licensed?

The directory itself works in every edition — manual entries included. The Microsoft 365 sync needs an Enterprise license that includes the directory_sync entitlement. See pricing.

Related — Entra groups for space access

The same app registration also powers Entra group sync for private spaces: import security groups under Settings → Groups and grant them on spaces.

Google Workspace sync (Enterprise)

Google Workspace connects alongside Microsoft rather than instead of it — each provider owns the people and groups it synced, so neither removes the other’s.

Under Settings → Directory → Google Workspace, you need two things:

1. A service-account key. Create a service account in the Google Cloud console, download its JSON key, and paste the whole file. CompassDocs checks it as you paste — the wrong file or a truncated copy is refused there and then, rather than failing later with an error that points somewhere else. The key is encrypted at rest and never shown again; only its client ID is displayed, because that’s what the next step needs.
2. An administrator to impersonate. Google’s Directory API has no application-level access — a service account reads the directory by acting as a real admin through domain-wide delegation. Without this, every call fails with a permissions error that looks like the key is wrong.

Then, in the Google Admin console under Security → API controls → Domain-wide delegation, add the client ID CompassDocs shows you and authorise the three read-only scopes it lists. They’re displayed for copying because the delegation screen wants them comma-separated, and one wrong character produces an unauthorized_client error that doesn’t say which scope.

Checking it before you rely on it

Test connection does a single cheap read and reports what it found — the domain it reached and how many users are visible. It’s worth clicking before the first sync, because the two things that go wrong here (delegation not saved, wrong impersonation target) produce API errors that read like a bad key. CompassDocs translates both: unauthorized_client becomes check the client ID and scopes in domain-wide delegation, and invalid_grant becomes check this is a real administrator.

What the sync pulls

Sync people now imports everyone in the account (or just one group, if you set the group filter), mapping:

Google	CompassDocs
name.fullName	Name
primaryEmail	Email
Primary organization’s title / department	Title, Department
phones (work, then mobile)	Phone, Mobile
Primary location’s building/area/desk	Office
relations of type assistant	Assistant
thumbnailPhotoUrl	Photo (optional)

Suspended accounts are excluded unless you turn them on; archived accounts always are. Custom fields with a Google path — including custom schemas like customSchemas.HR.employee_id — fill on every sync. Google is only asked for custom-schema data when a mapping actually needs it, since that’s a heavier read.

Import groups brings Workspace groups in as CompassDocs groups you can grant on private spaces. Membership resolves by email address: a group member with no CompassDocs account is skipped, and the panel tells you how many were. Nested groups are followed, so a member of a group inside a group still lands in the right place.

The removal brake

A sync that would delete more than half the people it previously synced stops and applies only the updates. That protects against the sync that “worked” but reached an empty result — a group filter pointed at a renamed group, a delegation revoked mid-flight — and would otherwise have emptied your directory in one click.

The panel then tells you how many were held back and offers Sync and remove the N, which allows those removals once. Reach for it when the removals are genuinely correct: you narrowed the group on purpose, or that many people really did leave. Syncing again without it changes nothing — the brake compares each sync against what’s stored, so the same run keeps tripping it.

Google-synced entries are labeled Google Workspace in the admin list and are owned by that provider: a Microsoft sync never removes them, and hiding one survives future syncs, exactly as with Microsoft 365.

Linking accounts to directory entries

CompassDocs accounts can be linked to their directory entry, which powers byline links, profile “documents by” lists, and keeps them working even when a name changes on either side. Links are made automatically — by SSO identity first, then email — via the Auto-link directory button in Settings → Users & roles, and after every enterprise directory sync.