Add the Microsoft Entra ID connector in Axiad Mesh

This is the second half of the Entra ID integration. Complete Set up Microsoft Entra ID first — you need the credentials from it before you start here.

Before you begin

Have these three values ready, all copied from the Entra admin center:

Value	Where it came from
Microsoft Entra tenant ID	Your Entra environment — how to find it
Application (client) ID	The application's Overview page, copied in Configure application properties
Client secret value	The Value column, copied in Generate a client secret

You also need a Mesh administrator account with permission to manage connectors.

Confirm admin consent before you start

The six Graph permissions do nothing until an administrator grants consent for the tenant. On the application's API permissions page, every row should read Granted in the Status column. A connector configured before consent is granted will fail its connection test with an authorization error.

Add the connector

1. From the Mesh homepage, select the gear icon to open Settings.
2. On the Connectors page, select Add connector — in the middle of the page if this is your first connector, or at the top right otherwise.
3. Set Name to a friendly name. This is only a label: it identifies the connector on the Connectors page and in reports, and you can change it whenever you like.
4. Select Microsoft Entra ID from the Provider list.
5. Enter the three values from the table above:
   • Microsoft Entra tenant ID
   • Application (client) ID
   • Client secret value
6. Select Test connection.
7. After the test passes, select Add & connect.

The connector now appears on the Connectors page.

Credentials are never shown again

Mesh encrypts the client secret at rest and does not display it after saving. If you lose the original value, create a new secret in Entra ID and update the connector — you cannot read the stored one back out.

What the connection test does

Test connection asks Entra ID for a token using the tenant ID, application ID and secret, and confirms the token is accepted.

A pass means Entra ID accepted the credentials. It does not confirm that every Graph permission was consented, because acquiring a token does not exercise them. A tenant that authenticates cleanly can still return no groups or no sign-in events if consent was missed — which is why the first collection is worth checking rather than assuming.

Verify the collection

After the connector is created, Mesh runs its first collection on the configured schedule.

1. Open the connector's View collections and confirm the first collection completed.
2. Compare the collected user and group counts against your Entra ID tenant.

A collection that finishes but returns noticeably fewer records than your tenant holds is usually a missing permission rather than a connection problem — each Graph permission gates a different slice of the data, so one that was never consented removes its slice silently while everything else arrives normally.

Troubleshooting

Symptom	Likely cause	What to do
Test connection fails with an authentication error	The client secret is wrong, or it has expired	Confirm the secret has not passed its expiry date, and that you pasted the Value rather than the secret ID. Create a new secret if needed
Test connection fails with an authorization error	Admin consent was never granted	On the application's API permissions page, select Grant admin consent, confirm every row reads Granted, then test again
Test connection fails to reach the tenant	The tenant ID is wrong	Re-check the tenant ID against your Entra environment
Users arrive, but no groups	Group.Read.All or Directory.Read.All was not consented	Grant the missing permission and consent again
Users arrive, but no sign-in activity	AuditLog.Read.All was not consented	Grant the permission and consent again
Users arrive, but no credentials or passkeys	UserAuthenticationMethod.Read.All or UserAuthMethod-Passkey.Read.All was not consented	Grant the missing permission and consent again
Authentication fails from a connector that worked for months	The client secret reached its expiry date	Create a new client secret in Entra ID and update the connector
Applications are missing	Application.Read.All was not consented	Grant the permission and consent again

If a problem persists, contact Axiad support with the connector name and the time of the failed collection.