Microsoft Entra ID
The Microsoft Entra ID connector reads users, groups, group memberships, registered authentication methods and sign-in activity from your Entra ID tenant, so Mesh can correlate those identities with accounts from every other connected system.
Entra ID was previously called Azure AD. Mesh lists it under its current name.
It is read-only. Every permission it asks for is a Read permission; it
never creates, changes or deletes anything in your tenant.
What it reads
| From Entra ID | Becomes in Mesh |
|---|---|
| Users and their directory profiles | User accounts |
| Registered authentication methods, including passkeys | Credentials |
| Groups and their members | Groups and membership |
| Registered applications | Application records |
| Sign-in and audit events | Sign-in activity |
Mesh reads all of this through the Microsoft Graph API, using six application permissions granted once with admin consent:
| Graph permission | What it covers |
|---|---|
Directory.Read.All | Users, groups and the directory objects that join them |
Group.Read.All | Group objects and membership |
Application.Read.All | Registered applications |
AuditLog.Read.All | Sign-in and audit events |
UserAuthenticationMethod.Read.All | Registered authentication methods |
UserAuthMethod-Passkey.Read.All | Registered passkeys |
For the full field-level detail — capabilities and how records map onto the Mesh data model — see the Microsoft Entra ID connector reference.
Setup
Setting Entra ID up has two halves. Do them in order.
| Step | What you do | Where |
|---|---|---|
| 1. Set up Entra ID | Register the application, grant the six Graph permissions, and create a client secret | Microsoft Entra admin center |
| 2. Set up in Mesh | Add the connector and verify the first collection | Axiad Mesh |
You need the tenant ID, application ID and client secret from the first half before you can finish the second, so start in Entra ID.
Entra ID can serve Mesh two different ways — as the identity provider your administrators sign in with, and as a connector Mesh reads from. The portal steps look similar, but each one needs its own enterprise application so the permissions stay scoped to what that integration actually does.
This guide covers the connector. For sign-in, see Microsoft Entra ID identity provider integration.
A trap worth knowing about before you start
The client secret is shown once, on the screen that creates it.
Entra ID displays the secret's Value immediately after you select Add, and never again — reopening the page shows only the secret's ID. If you leave that page without copying the value, the secret is unrecoverable and you have to create a new one.
Client secrets also expire. Entra ID asks for an expiry when you create one, and a connector that has been collecting happily for months will start failing authentication the day it lapses. Note the date somewhere you will see it before it arrives.