# Add the Microsoft Entra ID connector in Axiad Mesh

This is the second half of the Entra ID integration. Complete
[Set up Microsoft Entra ID](./entra-portal-setup.mdx) first — you need the
credentials from it before you start here.

## Before you begin

Have these three values ready, all copied from the Entra admin center:

| Value | Where it came from |
| --- | --- |
| **Microsoft Entra tenant ID** | Your Entra environment — [how to find it](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) |
| **Application (client) ID** | The application's **Overview** page, copied in [Configure application properties](./entra-portal-setup.mdx#configure-application-properties) |
| **Client secret value** | The **Value** column, copied in [Generate a client secret](./entra-portal-setup.mdx#generate-a-client-secret) |

You also need a Mesh administrator account with permission to manage
connectors.

> **warning**
The six Graph permissions do nothing until an administrator grants consent for
the tenant. On the application's **API permissions** page, every row should
read **Granted** in the **Status** column. A connector configured before
consent is granted will fail its connection test with an authorization error.

## Add the connector

1. From the Mesh homepage, select the gear icon to open **Settings**.
2. On the **Connectors** page, select **Add connector** — in the middle of the
   page if this is your first connector, or at the top right otherwise.
3. Set **Name** to a friendly name. This is only a label: it identifies the
   connector on the **Connectors** page and in reports, and you can change it
   whenever you like.
4. Select **Microsoft Entra ID** from the **Provider** list.
5. Enter the three values from the table above:
   - **Microsoft Entra tenant ID**
   - **Application (client) ID**
   - **Client secret value**
6. Select **Test connection**.
7. After the test passes, select **Add & connect**.

The connector now appears on the **Connectors** page.

> **note**
Mesh encrypts the client secret at rest and does not display it after saving.
If you lose the original value, create a new secret in Entra ID and update the
connector — you cannot read the stored one back out.

## What the connection test does

**Test connection** asks Entra ID for a token using the tenant ID, application
ID and secret, and confirms the token is accepted.

A pass means Entra ID accepted the credentials. It does **not** confirm that
every Graph permission was consented, because acquiring a token does not
exercise them. A tenant that authenticates cleanly can still return no groups
or no sign-in events if consent was missed — which is why the first collection
is worth checking rather than assuming.

## Verify the collection

After the connector is created, Mesh runs its first collection on the
configured schedule.

1. Open the connector's **View collections** and confirm the first collection
   completed.
2. Compare the collected user and group counts against your Entra ID tenant.

A collection that finishes but returns noticeably fewer records than your
tenant holds is usually a missing permission rather than a connection problem
— each Graph permission gates a different slice of the data, so one that was
never consented removes its slice silently while everything else arrives
normally.

## Troubleshooting

| Symptom | Likely cause | What to do |
| --- | --- | --- |
| Test connection fails with an authentication error | The client secret is wrong, or it has expired | Confirm the secret has not passed its expiry date, and that you pasted the **Value** rather than the secret ID. Create a new secret if needed |
| Test connection fails with an authorization error | Admin consent was never granted | On the application's **API permissions** page, select **Grant admin consent**, confirm every row reads **Granted**, then test again |
| Test connection fails to reach the tenant | The tenant ID is wrong | Re-check the tenant ID against your Entra environment |
| Users arrive, but no groups | `Group.Read.All` or `Directory.Read.All` was not consented | Grant the missing permission and consent again |
| Users arrive, but no sign-in activity | `AuditLog.Read.All` was not consented | Grant the permission and consent again |
| Users arrive, but no credentials or passkeys | `UserAuthenticationMethod.Read.All` or `UserAuthMethod-Passkey.Read.All` was not consented | Grant the missing permission and consent again |
| Authentication fails from a connector that worked for months | The client secret reached its expiry date | Create a new client secret in Entra ID and update the connector |
| Applications are missing | `Application.Read.All` was not consented | Grant the permission and consent again |

If a problem persists, contact Axiad support with the connector name and the
time of the failed collection.