# Microsoft Entra ID (Azure AD)

Baton Azure Infrastructure Connector - Sync users, groups, roles, and resources from Microsoft Azure

## Prerequisites

- A Mesh administrator account with permission to manage connectors.
- `tenant_id` — Azure Tenant ID (Directory ID) - required
- `client_id` — Azure Client ID (Application ID) - required
- `use_cli_credentials` (optional) — Use Azure CLI credentials for authentication (alternative to client credentials)
- `mailbox_settings` (optional) — Fetch mailbox settings to determine user purpose
- `skip_ad_groups` (optional) — Skip syncing Windows Server Active Directory groups
- `graph_domain` (optional) — Microsoft Graph API domain
- `skip_unused_roles` (optional) — Skip syncing unused Azure roles
- `skip_storage_container_sync` (optional) — Skip syncing Azure Storage containers
- `enable_sync_external_resources_via_baton_id` (optional) — Use Baton ID to sync users and groups from external resources (advanced)
- `skip_entra_id_p2_features` (optional) — Skip features requiring Microsoft Entra ID P2 or Governance license
- Credentials for authentication: client_secret (stored write-only).

## Authentication

**Method:** Bearer token

Mesh authenticates with a token (personal access token, API token, or bot token).

| Field | Required | Secret | Description |
| --- | --- | --- | --- |
| `client_secret` | Yes | Yes (write-only) | Azure Client Secret (stored as secret) - required |

## Capabilities

<CapabilityMatrix
  capabilities={[
    { name: "Identity & entitlement sync", supported: true },
    { name: "Writeback / remediation", supported: false, notes: "Read-only" },
  ]}
/>

## Data model

_This information is not yet available from the connector schema._

## Setup

1. Gather the required value: `tenant_id`.
2. Gather the required value: `client_id`.
3. Gather the required value: `use_cli_credentials`.
4. Gather the required value: `mailbox_settings`.
5. Gather the required value: `skip_ad_groups`.
6. Gather the required value: `graph_domain`.
7. Gather the required value: `skip_unused_roles`.
8. Gather the required value: `skip_storage_container_sync`.
9. Gather the required value: `enable_sync_external_resources_via_baton_id`.
10. Gather the required value: `skip_entra_id_p2_features`.
11. Create the required credentials in the source system: client_secret.
12. In Admin → Connectors, add the connector and enter its configuration.
13. Save and run an initial collection.

## Troubleshooting

_This information is not yet available from the connector schema._