# Set up the Microsoft Entra ID connector

Integrate Microsoft Entra ID as a connector in Axiad Mesh to get the user data
necessary to fill out your environment and for Axiad to find correlations,
risks, and gaps in your population.

The integration requires updates on both Entra ID and Axiad Mesh. For an
overview of what this connector collects, see the
[Microsoft Entra ID connector reference](./microsoft-entra-id.mdx).

## Entra ID configuration steps

> **warning**
These steps are Axiad's current understanding of the configuration. Because
Entra ID is a third-party product, there may be slight variations between your
experience and what this guide describes. We work hard to keep things as up to
date as possible, but depending on the versions in use, the latest updates, and
so on, there may be some mismatches.

If you find any blatant differences or anything that doesn't make sense,
contact Axiad support so we can update this article.

> **note**
The Entra ID steps are similar for the integration as an identity provider and
as a connector with Axiad Mesh; however, it's important that each integration
type has its own enterprise application in Entra ID to ensure that the
permissions are assigned accordingly.

### Create a new enterprise application

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application
   Administrator.
2. Go to **Identity > Enterprise applications**.
3. Select **New application**.
4. On the **Browse Microsoft Entra Gallery** page, select **Create your own
   application**.
5. In the **Create your own application** pane, set the **name** to a friendly
   name.
6. Select **Register an application to integrate with Microsoft Entra ID (App
   you're developing)**.
7. Select **Create**.

{/* screenshot: Entra admin center — "Create your own application" pane with the app-registration option selected (original image EntraCreateNewApp.png is no longer available) */}

8. On the **Register an application** page, set the **Name** to the friendly
   name.
9. Select **Accounts in this organizational directory only (<Microsoft Entra
   Tenant Name> - Single tenant)**.

   :::tip Axiad recommendation
   We recommend that you create and test the integration with Axiad Mesh using
   a single tenant. Upon success, you can then change this setting to a
   multitenant environment as needed.
   :::

10. Select **Register**.

{/* screenshot: Entra admin center — "Register an application" page with single-tenant account type selected (original image EntraRegisterApp.png is no longer available) */}

### Configure application properties

1. In the Entra admin center, go to **Identity > Enterprise applications >
   All applications**.
2. Locate and open your newly created application.
3. Under **Manage** in the menu, select **Properties**.
4. Select **Yes** for **Enabled for users to sign-in?**
5. Select **Yes** for **Assignment required?**
6. Select **No** for **Visible to users?**
7. Select **Save**.

{/* screenshot: Enterprise application Properties page with the sign-in, assignment, and visibility settings (original image EntraAppProperties(2).png is no longer available) */}

8. Copy the **Application ID** — you need it in the Axiad Mesh configuration
   steps later in this guide.

### Generate a client secret

1. In the Entra admin center, go to **Identity > Applications > Enterprise
   applications > All applications**.
2. Locate and open your newly created application.
3. Under **Manage** in the menu, select **Single sign-on**.
4. On the **OIDC-based Sign-on** page, select **Go to application** in the
   **Configure application properties** section.
5. Under **Manage** in the menu, select **Certificates & secrets**.
6. Select **New client secret**.
7. On the **Add a client secret** page, provide a **Description**, set
   **Expires** to the expiration time, and then select **Add**.
8. After the secret is created, copy the **Value** from the
   **Certificates & secrets** page.

> **warning**
You can only copy this value immediately after creating it, and it's required
for the Axiad Mesh configuration steps. Be sure to copy this value now, because
you won't have another opportunity — otherwise you need to create a new client
secret instead.

{/* screenshot: Certificates & secrets page showing the new client secret and its Value column (original image EntraClientSecret.png is no longer available) */}

### Add API permissions

1. From the **Certificates & secrets** page, select **API permissions** under
   the **Manage** menu item.
2. Select **Add a permission**.
3. On the **Request API permissions** page, select **Microsoft Graph**.
4. Select **Application permissions** for the type of permissions required.
5. Under **Select permissions**, search for and select `Application.Read.All`.
6. Select **Add permissions**.

{/* screenshot: Request API permissions page with Microsoft Graph application permissions selected (original source image no longer available — recapture from the live product) */}

7. Repeat steps 2 through 6 for each of the following permissions (instead of
   `Application.Read.All`):
   - `AuditLog.Read.All`
   - `Directory.Read.All`
   - `Group.Read.All`
   - `UserAuthenticationMethod.Read.All`
   - `UserAuthMethod-Passkey.Read.All`
8. On the **API permissions** page, review the permissions in the table, and
   then select **Grant admin consent for <Microsoft Entra Tenant Name>**.
9. The **Status** column should update all permissions to **Granted**.

{/* screenshot: API permissions table with all six Graph permissions showing Granted status (original image image-1739301866808.png is no longer available) */}

## Axiad Mesh configuration steps

You can add Entra ID as a connector from the Mesh administrative portal.

1. From the homepage, select the gear icon menu button to open the
   **Settings** page.

{/* screenshot: Mesh homepage with the gear icon menu button highlighted (original image image-1738879228034.png is no longer available) */}

2. On the **Connectors** page, select the **Add connector** button — either in
   the middle of the page if this is your first connector, or at the top right
   of the screen.

{/* screenshot: Connectors page with the Add connector button (original image image-1738879440263.png is no longer available) */}

3. In the dialog, set the **Name** to a friendly name that appears on the
   **Connectors** page.
4. Select **Microsoft Entra ID** from the **Provider** list.
5. Set the **Microsoft Entra tenant ID** to your Entra environment's tenant ID.
   - [Learn how to find your tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant)
6. Set the **Application (client) ID** to the **Application ID** value you
   copied in [Configure application properties](#configure-application-properties).
7. Set the **Client secret value** to the client secret **Value** you copied in
   [Generate a client secret](#generate-a-client-secret).

{/* screenshot: Mesh Add connector dialog with the Entra ID provider fields filled in (original image "Screenshot 2025-02-11 at 11.05.40 AM.png" is no longer available) */}

8. Select the **Test connection** button once all values are provided.
9. Following a successful test, select **Add & connect** to complete the
   configuration.
10. Your Entra ID connector now appears on the **Connectors** page.