# Microsoft Entra ID

The **Microsoft Entra ID** connector reads users, groups, group memberships,
registered authentication methods and sign-in activity from your Entra ID
tenant, so Mesh can correlate those identities with accounts from every other
connected system.

Entra ID was previously called Azure AD. Mesh lists it under its current name.

It is **read-only**. Every permission it asks for is a `Read` permission; it
never creates, changes or deletes anything in your tenant.

## What it reads

| From Entra ID | Becomes in Mesh |
| --- | --- |
| Users and their directory profiles | User accounts |
| Registered authentication methods, including passkeys | Credentials |
| Groups and their members | Groups and membership |
| Registered applications | Application records |
| Sign-in and audit events | Sign-in activity |

Mesh reads all of this through the **Microsoft Graph API**, using six
application permissions granted once with admin consent:

| Graph permission | What it covers |
| --- | --- |
| `Directory.Read.All` | Users, groups and the directory objects that join them |
| `Group.Read.All` | Group objects and membership |
| `Application.Read.All` | Registered applications |
| `AuditLog.Read.All` | Sign-in and audit events |
| `UserAuthenticationMethod.Read.All` | Registered authentication methods |
| `UserAuthMethod-Passkey.Read.All` | Registered passkeys |

For the full field-level detail — capabilities and how records map onto the
Mesh data model — see the
[Microsoft Entra ID connector reference](./entra-id.mdx).

## Setup

Setting Entra ID up has two halves. Do them in order.

| Step | What you do | Where |
| --- | --- | --- |
| **[1. Set up Entra ID](./entra-portal-setup.mdx)** | Register the application, grant the six Graph permissions, and create a client secret | Microsoft Entra admin center |
| **[2. Set up in Mesh](./mesh-setup.mdx)** | Add the connector and verify the first collection | Axiad Mesh |

You need the tenant ID, application ID and client secret from the first half
before you can finish the second, so start in Entra ID.

> **tip**
Entra ID can serve Mesh two different ways — as the **identity provider** your
administrators sign in with, and as a **connector** Mesh reads from. The portal
steps look similar, but each one needs **its own enterprise application** so
the permissions stay scoped to what that integration actually does.

This guide covers the connector. For sign-in, see
[Microsoft Entra ID identity provider integration](../../../admin-guide/identity-providers/microsoft-entra-id.md).

## A trap worth knowing about before you start

The client secret is shown **once**, on the screen that creates it.

Entra ID displays the secret's **Value** immediately after you select **Add**,
and never again — reopening the page shows only the secret's ID. If you leave
that page without copying the value, the secret is unrecoverable and you have
to create a new one.

Client secrets also **expire**. Entra ID asks for an expiry when you create
one, and a connector that has been collecting happily for months will start
failing authentication the day it lapses. Note the date somewhere you will see
it before it arrives.