Skip to content
English
  • There are no suggestions because the search field is empty.

Rostering SSO ID Reference (School or District IT Admin)

School or District IT Admin: SSO Identifiers 🔑

This article covers which identifier belongs in the roster template for each SSO provider, the format to expect, and where an IT admin can find it in their own system. Each provider section includes a block you can paste directly into a reply to a district.

📑 Table of Contents


At a Glance

Provider

Value We Need

Format

Required?

Clever

Clever user ID

24-char hex

Optional

ClassLink

LaunchPad User ID

Numeric, or prefixed alphanumeric

Optional

Microsoft

Entra ID Object ID, or personal-account ID

GUID, or 16 hex characters

Required

Google

Account email, or account ID

Email, or 21-digit number

Optional

One upload uses one provider. The column header should say SSO ID, but we also accept Student SSO ID, Teacher SSO ID, Clever ID, ClassLink ID, Microsoft ID, Entra ID, Google Email, External ID, and a few other spellings, so a school doesn't have to rename their export column.

Clever

Clever's own user identifier, not the SIS ID the district entered into Clever.

Field: The Clever user ID.

Format: 5f9a1b2c3d4e5f6a7b8c9d01, 24 hexadecimal characters.

Where to find it:

  • One user: open their record in the Clever Dashboard; the ID is the last segment of the page URL.
  • Everyone: use the Clever API (GET /v3.1/users, the data.id field), or a Data Browser export, where the column is usually labeled Clever ID.

Not this: sis_id, student number, a state ID, or an email address. Those are district identifiers; Emails belong in the email column.

Paste into a reply:

For Clever rostering, we need the Clever user ID, Clever's own identifier for each student and teacher, not the SIS ID.

It is a 24-character hexadecimal string, for example 5f9a1b2c3d4e5f6a7b8c9d01.

For one user: open their record in the Clever Dashboard; the ID is the last part of the URL. For everyone: use the Clever API (GET /v3.1/users, the data.id field), or a Data Browser export, where the column is usually called Clever ID.

Please don't send the SIS ID, student number, state ID, or email address in that column; Clever doesn't send those to us at sign-in.

This column is optional. If a school leaves it blank, Clever sign-in still works as long as the email address on the roster matches the one in Clever.

ClassLink

The LaunchPad tenant user ID, not the OneRoster sourcedId. Numeric for most tenants, but some issue a prefixed alphanumeric ID instead; both are valid.

Field: The ClassLink UserId.

Format:

  • 2391045, numeric, the common case.
  • USR_0000000243, some tenants issue a prefixed, zero-padded alphanumeric ID instead. This is equally correct; use whatever UserId ClassLink returns and don't try to strip it down to digits.

Where to find it:

  • ClassLink Management Console → Users → export the user list; the column is the ClassLink (LaunchPad) UserID.
  • To confirm a column is the right one, call https://nodeapi.classlink.com/v2/my/info for one test account; the UserId it returns is exactly the value we store.

Not this: The OneRoster sourcedId from Roster Server (that one is a GUID), or the SIS/student number.

Paste into a reply:

For ClassLink rostering, we need the ClassLink UserId, the LaunchPad user ID for each student and teacher.

On most ClassLink tenants, it is numeric, for example 2391045. Some tenants issue a prefixed alphanumeric ID instead, such as USR_0000000243; that format is equally correct, and you should send it exactly as ClassLink shows it.

In the ClassLink Management Console, go to Users and export the user list; the column is the ClassLink (LaunchPad) UserID. If you're not sure which column is right, call https://nodeapi.classlink.com/v2/my/info while signed in as one test account; the UserId it returns is the value we need.

Please don't send the OneRoster sourcedId from Roster Server (that's a GUID) or the SIS/student number.

This column is optional. Without it, ClassLink sign-in still matches on the user's email address.

Microsoft

⚠️ Required for every row. Entra ID (Azure AD) Object ID for a work or school account, or the 16-character ID of a personal Microsoft account. Microsoft sign-in has no email fallback, so a blank cell means that person cannot log in.

Field:

  • Work or school account: the user's Object ID in the school's Entra ID tenant, the ID Microsoft Graph returns, also seen as the oid claim in a token.
  • Personal Microsoft account: that account's own ID. We accept both.

Format:

  • 3f2504e0-4f89-11d3-9a0c-0305e82c3301, a GUID, for a work or school account.
  • 0179008a5381874e, 16 hexadecimal characters, for a personal Microsoft account.

Where to find it:

  • One user: Entra admin center → Users → select a user; Object ID is on the overview.
  • Everyone: Users → Download users (the CSV carries the object ID), or Graph GET https://graph.microsoft.com/v1.0/users?$select=id,userPrincipalName,displayName, or PowerShell Get-MgUser -All -Property Id,UserPrincipalName,DisplayName.

Not this: The UPN or email address, immutableId/ms-ds-consistencyguid, or the on-prem AD objectGUID.

Paste into a reply:

For Microsoft rostering, we need the Object ID of each user in your Entra ID (Azure AD) tenant, the value Microsoft Graph returns as id, and the token's oid.

For a work or school account, the ID is a GUID, for example, 3f2504e0-4f89-11d3-9a0c-0305e82c3301. If your users sign in with personal Microsoft accounts instead, send that account's ID, 16 hexadecimal characters, such as 0179008a5381874e. Both are fine; we accept either.

For one user: Entra admin center → Users → select the user; Object ID is on the overview page. For everyone: Users → Download users (the CSV includes the object ID), or Graph GET https://graph.microsoft.com/v1.0/users?$select=id,userPrincipalName,displayName, or PowerShell Get-MgUser -All -Property Id,UserPrincipalName,DisplayName.

Please don't send the UPN/email, immutableId, or ms-ds-consistencyguid, or the on-premises AD objectGUID.

This column is required for every row when rostering with Microsoft. Microsoft sign-in does not fall back to matching on email address, so anyone without an Object ID will not be able to log in.

Google

For Google Workspace for Education, either the account email address or the numeric account ID is accepted.

Field: Either the user's Google account email address, what most districts send, or the Google account ID (the OIDC sub).

Format:

  • e.wilson@lincoln.k12.us
  • 104839257461028374915, 21 digits.

Where to find it:

  • Email: Google Admin console → Directory → Users → Download users; use the Email Address [Required] column.
  • Account ID: Admin SDK Directory API GET https://admin.googleapis.com/admin/directory/v1/users?customer=my_customer, each user's id, which is the same value Google sends us as sub. GAM equivalent: gam print users id primaryemail.

Not this: A personal @gmail.com address when students sign in with a district Workspace account, or an alias address. Sign-in reports the primary address.

Paste into a reply:

For Google rostering, either of these works in the SSO column:

The user's Google account email address, the simplest option and what most districts send, e.g. e.wilson@lincoln.k12.us. Google Admin console → Directory → Users → Download users, and use the "Email Address [Required]" column.

The Google account ID, if you'd rather send an opaque identifier. It's a 21-digit number, e.g. 104839257461028374915. You'll find it in the Admin SDK Directory API (GET https://admin.googleapis.com/admin/directory/v1/users?customer=my_customer, the id field), or with GAM: gam print users id primaryemail.

Please use the primary district Workspace address rather than a personal @gmail.com address or an alias; sign-in always reports the primary one.

This column is optional. Google sign-in matches on the account email address when no ID is present, so an accurate email in the roster's email column is usually enough on its own.

Rules Worth Knowing

One provider per upload. Use one SSO provider per roster file. We check ID formats before importing and will contact you if anything doesn't match.

Microsoft is the only mandatory one. Clever, ClassLink, and Google all fall back to matching on email address at sign-in. Microsoft does not.

Accuracy matters more than completeness. A wrong ID can sign a student into someone else's account. Please export IDs; don't type them.

The format is checked on upload. 24-character hex for Clever. Microsoft takes a GUID or a 16-character personal-account ID. ClassLink takes numeric and prefixed alphanumeric IDs alike. A mismatch is flagged in the preview before anything is written.

Related Articles & Resources

Single Sign On Options

Adding Students and Creating Student Accounts


Have questions? We're here to help. Reach out anytime at support@readtheory.org.