# Microsoft Entra ID

The Microsoft Entra ID (formerly Azure AD) connector brings directory identities,
group memberships, and sign-in signals into Axiad Mesh. As an identity-provider
connector, it is typically the first connector you configure.

## Prerequisites

- A Mesh administrator account with permission to manage connectors.
- An Entra ID tenant with the ability to register an application.
- Directory read and audit-log read permissions.

## Authentication

Mesh authenticates as a registered application using the client-credentials
flow:

1. Register an application in Entra ID.
2. Grant the required Microsoft Graph read permissions.
3. Create a client secret and record the client ID and tenant (directory) ID.

Provide the client ID, tenant ID, and client secret in the connector
configuration. Secret fields are write-only.

## Capabilities

<CapabilityMatrix
  capabilities={[
    { name: "User accounts", supported: true },
    { name: "Groups & membership", supported: true },
    { name: "Sign-in / audit logs", supported: true, notes: "Requires audit-log read scope" },
    { name: "Writeback / remediation", supported: false, notes: "Read-only in v1" },
  ]}
/>

## Data model

The connector maps Entra ID users to Mesh identities, and groups/roles to
entitlements, which the risk engines then evaluate.

## Setup

1. Complete **Authentication** above.
2. In **Admin → Connectors**, add the **Microsoft Entra ID** connector.
3. Enter the credentials and configure the collection schedule.
4. Save and run an initial collection.

## Troubleshooting

- **Authentication failed** — verify the client secret has not expired and the
  app has the required Graph permissions with admin consent granted.
- **No sign-in data** — confirm the audit-log read scope is present.