Microsoft Entra ID

Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access management service for users, groups, devices and apps, with single sign-on and multi-factor authentication. The UnifyApps Microsoft Entra ID connector uses the Microsoft Graph API to create, update, disable and delete users and groups, manage group members, owners and licenses, read directory details and react to user and group changes from workflows and agents.

This guide covers every authentication type available on the connection form, and the actions and triggers supported, along with the Microsoft Graph permission each one needs.

Authentication

Before you begin, you should have the following information:

• Connection name: a descriptive name such as MyAppMicrosoftEntraIDIntegration, so the connection is easy to identify later.

• Authentication type: select the type of authentication for connecting to your Microsoft Entra ID tenant:

  1. OAuth

  2. OAuth with client configuration

  3. Client credentials

Every authentication type needs a Client ID and Client Secret from your own Azure app registration. For the two OAuth types, the Scopes field is optional: if you leave it empty, the connection requests offline_access, Group.ReadWrite.All, User.ReadWrite.All, People.Read.All and Directory.Read.All. If you select scopes yourself, include offline_access so the connection can refresh its token. All of these permissions except offline_access need admin consent.

1. OAuth

Use this when actions should run on behalf of a signed-in Microsoft user, through your organization's Azure app registration.

Step 1: App registration in Azure

1. Log in to the Azure portal, search for App registrations and click New registration.

1. Enter a name and choose the supported account type as Multitenant or Single tenant.

2. Under Redirect URI, choose platform Web and paste the UnifyApps Callback URL. The OAuth form does not show it; select OAuth with client configuration on the connection form to copy it. Both types use the same URL, which differs per environment.

3. Click Register.

1. On the Overview tab, copy the Application (client) ID and the Directory (tenant) ID.

1. Go to API permissions → Add a permission → Microsoft Graph → Delegated permissions and add the permissions the connection will use, for example User.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All, People.Read.All and offline_access. See the Scopes Required column below.

2. Click Grant admin consent. The directory permissions above require it.

3. Go to Certificates & secrets → New client secret, add a description and expiry, and click Add. Copy the secret Value immediately and store it securely. It is not shown again.

Step 2: Connection setup in UnifyApps

1. Open Connections → New Connection → Microsoft Entra ID and enter a Connection name.

2. Select OAuth as the Authentication type.

3. Enter the Client ID and Client Secret copied from Azure.

4. Leave Tenant ID as common, or enter your tenant ID to restrict sign-in to one organization.

5. Optionally select the Scopes you need, including offline_access.

6. Leave Delegated scopes on (the default).

7. Click Authorize, sign in with a Microsoft account in your tenant and accept the consent screen.

8. Confirm the success message after the redirect back to UnifyApps.

Note: with the OAuth types, actions run as the signed-in user. Write actions also need that user to hold a suitable Microsoft Entra role, for example User Administrator or Groups Administrator.

2. OAuth with client configuration

Use this when your organization wants the connection to use its own Azure app registration while actions still run on behalf of a signed-in user. It works like OAuth, and the form also shows the Callback URL to register in Azure.

Step 1: App registration in Azure

1. Register the app as described in Step 1 of OAuth above. Under Redirect URI, choose platform Web and paste the Callback URL shown at the top of this connection form.

2. Copy the Application (client) ID, Directory (tenant) ID and client secret Value.

Step 2: Connection setup in UnifyApps

1. Open Connections → New Connection → Microsoft Entra ID and enter a Connection name.

2. Select OAuth with client configuration as the Authentication type.

3. Enter the Client ID and Client Secret copied from Azure.

4. Leave Tenant ID as common, or enter your tenant ID.

5. Optionally select the Scopes you need, including offline_access.

6. Leave Delegated scopes on (the default).

7. Click Authorize, sign in with Microsoft and accept the consent screen.

8. Confirm the success message after the redirect back to UnifyApps.

3. Client credentials

Use this for app-only access that does not depend on a signed-in user. The app acts as itself with the application permissions granted in Azure.

Step 1: Register the app in Azure

1. Log in to the Azure portal, search for App registrations and click New registration.

2. Enter a name and supported account type, and click Register. No redirect URI is needed for this flow.

3. From Overview, copy the Application (client) ID and Directory (tenant) ID.

4. Go to API permissions → Add a permission → Microsoft Graph → Application permissions and add the permissions the connection will use, for example User.Read.All and Group.Read.All to read, or User.ReadWrite.All and Group.ReadWrite.All to make changes. See the Scopes Required column below.

5. Click Grant admin consent. Application permissions do not work until an administrator consents to them.

6. Go to Certificates & secrets → New client secret, click Add, and copy the secret Value.

Step 2: Create the connection in UnifyApps

1. Select Client credentials as the Authentication type.

2. Enter the Client ID, Client Secret and Tenant ID. Use your actual tenant ID here; common is meant for the sign-in based flows.

3. Leave Delegated scopes off (the default for this type).

4. Click Test Connection to validate the credentials, then click Create.

Actions

Permissions are Microsoft Graph permissions. Where Delegated and Application differ, Delegated applies to the OAuth types and Application to Client credentials. Any broader permission also works. Some least-privileged permissions, such as GroupMember.ReadWrite.All, LicenseAssignment.ReadWrite.All and User.RevokeSessions.All, are not in the form's Scopes list: with the OAuth types, use the broader permission shown in brackets; with Client credentials, grant whichever you prefer in Azure.

Triggers