Microsoft Entra ID (Azure AD)

Baton Azure Infrastructure Connector - Sync users, groups, roles, and resources from Microsoft Azure

Prerequisites

• A Mesh administrator account with permission to manage connectors.
• tenant_id — Azure Tenant ID (Directory ID) - required
• client_id — Azure Client ID (Application ID) - required
• use_cli_credentials (optional) — Use Azure CLI credentials for authentication (alternative to client credentials)
• mailbox_settings (optional) — Fetch mailbox settings to determine user purpose
• skip_ad_groups (optional) — Skip syncing Windows Server Active Directory groups
• graph_domain (optional) — Microsoft Graph API domain
• skip_unused_roles (optional) — Skip syncing unused Azure roles
• skip_storage_container_sync (optional) — Skip syncing Azure Storage containers
• enable_sync_external_resources_via_baton_id (optional) — Use Baton ID to sync users and groups from external resources (advanced)
• skip_entra_id_p2_features (optional) — Skip features requiring Microsoft Entra ID P2 or Governance license
• Credentials for authentication: client_secret (stored write-only).

Authentication

Method: Bearer token

Mesh authenticates with a token (personal access token, API token, or bot token).

Field	Required	Secret	Description
client_secret	Yes	Yes (write-only)	Azure Client Secret (stored as secret) - required

Capabilities

Capability	Supported	Notes
Identity & entitlement sync	✓
Writeback / remediation	—	Read-only

Data model

This information is not yet available from the connector schema.

Setup

1. Gather the required value: tenant_id.
2. Gather the required value: client_id.
3. Gather the required value: use_cli_credentials.
4. Gather the required value: mailbox_settings.
5. Gather the required value: skip_ad_groups.
6. Gather the required value: graph_domain.
7. Gather the required value: skip_unused_roles.
8. Gather the required value: skip_storage_container_sync.
9. Gather the required value: enable_sync_external_resources_via_baton_id.
10. Gather the required value: skip_entra_id_p2_features.
11. Create the required credentials in the source system: client_secret.
12. In Admin → Connectors, add the connector and enter its configuration.
13. Save and run an initial collection.

Troubleshooting

This information is not yet available from the connector schema.