> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/getting-started/setting-up-your-tenant/application-integrations/data-sync-preferences.md).
# Data Sync Preferences
Data Sync Preferences let you control exactly which data BalkanID extracts from an application. Instead of syncing everything an integration is capable of returning, you choose only the entities you need for governance — reducing sync time and limiting the data BalkanID stores.
Data Sync Preferences are configured per integration, so different applications can sync different data.
{% hint style="info" %}
Data Sync Preferences are available for applications that support configurable extraction. If an application doesn't support it, the section won't appear when you configure the integration.
{% endhint %}
### What you can control
Preferences are organised into groups. The entities shown depend on the application.
#### Entities
The core identity and access objects the application exposes — for example Users, Groups, Roles, Policies, and Generic Resources. These are what BalkanID uses for entitlement discovery, access reviews, and access requests.
**Users are always synced** and cannot be deselected. Every access relationship BalkanID maps is anchored to a user, so this entity is required for the integration to function.
#### Insights and Credentials
* **Insights** — security findings BalkanID derives from the application's data, such as missing or weak MFA and over-privileged accounts. Selecting Insights enables all insight types available for that application.
* **Credentials** — non-human identity credentials such as API keys, access keys, MFA devices, service account keys, and certificates.
{% hint style="info" %}
Credential extraction requires the Non-Human Identity (NHI) capability to be enabled for your tenant. If it isn't enabled, selecting credential entities here will have no effect. Contact your customer success manager or to enable it.
{% endhint %}
#### Other Data
Shown only for applications that can act as a source of truth for employee information:
* **Employee / HR Data** — HRIS-linked employee records.
### Configuring Data Sync Preferences
1. Go to *Integrations* and either **Add Integration** to set up a new application, or open an existing integration to edit it.
2. Locate the **Data Sync Preferences** section on the configuration screen. The **Read our guide** link at the top of the section opens the setup guide for that specific application.
3. Select or deselect entities. Each group also has a checkbox to toggle the whole group at once — it reads **Select all** when some or none are selected, and **All selected** when everything in that group is on. Groups can be collapsed using the arrow on the right.
4. Review the **Required API Scopes** panel and make sure the credentials you provide grant those scopes.
5. Save the integration. Changes take effect on the next sync.
By default, everything supported is selected — so an integration set up without changing anything syncs all available data, exactly as before.
### Required API Scopes
As you change your selection, the **Required API Scopes** panel updates to show only the API scopes needed for the entities you've chosen. You can use this list when creating the credentials or service account for the integration, and grant only the permissions the selected entities require.
For example, in an AWS integration the **Insights** entity is the only one that requires `cloudtrail:LookupEvents`. If you deselect Insights, that scope disappears from the list and no longer needs to be granted.
{% hint style="warning" %}
Deselecting an entity doesn't revoke permissions you've already granted in the source application. To reduce the integration's access, update its permissions in the application itself as well.
{% endhint %}
### How changes are applied
Data Sync Preferences take effect on the **next sync** — saving them doesn't trigger an immediate re-extraction. To apply them right away, trigger a sync manually from the integration.
When a sync runs, BalkanID replaces the integration's previously extracted data with what the current sync returns. This means **data for an entity you deselect is removed on the next sync** — it isn't retained in a stale state. If you later re-select that entity, the data is repopulated on the following sync.
You can change preferences at any time after the integration is connected by editing it.
### Things to know
* **Relationships follow your selection.** Relationships between selected entities (for example User → Group) are synced automatically. If you deselect either side of a relationship, that relationship is not synced — deselecting Groups, for example, also stops User → Group access from being mapped.
* **Users cannot be deselected.** They are required as the anchor for all access data.
* **Insights are all-or-nothing per application.** Selecting Insights enables every insight type available for that application; individual insight types can't be selected separately today.
* **Availability varies by application.** Two integrations rarely expose the same entities, so review preferences per integration rather than assuming a common set.
{% hint style="warning" %}
Because deselected data is removed on the next sync, check whether an entity is in use elsewhere in BalkanID before turning it off — for example in active access review campaigns, entitlement rules, or compliance controls.
{% endhint %}
**Need Assistance?** Please reach out to if you have any questions or need assistance configuring Data Sync Preferences. We are always available to help!
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.balkan.id/getting-started/setting-up-your-tenant/application-integrations/data-sync-preferences.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.