Pre-Requisites

Install Requirements

note

This is specific to Self Hosted deployments. For Sath hosted connectors, these requirements are already in place.

• You need to install Helm version 3 or above.
• You can use Kubernetes cluster (1.26 or above) to install the connector

Connection Requirements

Below is needed to connect to Entra ID

• An active Microsoft Entra ID Subscription
• Entra ID Application credentials
  • Client ID
  • Client Secret
  • Tenant ID

Application Registration and Setup

An application (Entra ID terminology) will need to be registered within Entra ID instance for granting our connector permission to call the Microsoft Graph API.

To create a new application in Entra ID, follow the steps below:

1. Login with administrator credentials in your Entra ID instance
2. Go to App Registrations section
3. Click on + New Registration to create a new application (This application will be the anchor between IDHub and Entra ID)

4. Provide a name for the application and for supported account types, pick “Accounts in this Organizational Directory Only” and hit on “Register”
5. Copy the values for Client ID, Tenant ID and save them for later use. (These will be used to authenticate the connection between IDHub and Entra ID)
6. Next, Click on Certificates & secrets
7. Go to Client Secrets section and Click on + New client secret to add a new client secret
8. To add new client secret, add secret description and expiry as ‘Never’ (preferred) and click on Add
   info

   If Expiry is 6 months or 12 months, the secrets will need to be updated in the Connector Manager post expiry for continued provisioning and reconciliation.

9. Copy the Client Secret value by clicking on the copy icon and save it.

tip

Your application is now registered successfully. Make sure to save Client ID, Tenant ID and Client Secret from the application. These will be used while connecting IDHub to application.

Permissions

Post registration, the application added in Entra ID will be need to required permissions to perform various functions.

Required Permissions

To perform basic directory operations below permission needs to be provided to the application registered in Entra:

• Read Directory Data - Directory.Read.All
• Read and Write Directory Data - Directory.ReadWrite.All

Post that detailed permissions are available to manage and control specific entitlements and licenses across Entra. See below for more information:

Permission	Type	Purpose
User.Read.All	Application	Account Reconciliation, Fetch Objects like Roles and Groups Membership
User.ReadWrite.All	Application	Create User, Update User Properties (Non Entitlement), Add / Remove License Pack and Plan, Enable/ Disable User Account, Delete User
Organization.Read.All	Application	Reconcile License Pack and Plan Details of tenant
RoleManagement.ReadWrite.Directory	Application	Add / Remove Directory Roles and Role Provisioning
RoleManagement.Read.Directory	Application	Role Reconciliation
Group.Read.All	Application	Group Reconciliation
Group.ReadWrite.All	Application	Create Group, Update Group, Delete Group

Built-In Roles

• To manage all aspects of users and groups, including resetting passwords for limited admins, the application registered on Entra must have the User Administrator role
• To manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities the application registered on Entra must have Global Administrator role
• To manage view, set and reset authentication method information for any user (admin or non-admin) the application needs to have Privileged Authentication Administrator role

To know more about Entra ID Roles, view doc here.

How to grant permissions

To add permission, see below steps:

1. Go to the registered application and click on API Permissions and then on Add a permission.
2. In the window that pops up, click on Microsoft Graph
3. Click on Application permissions
4. Search and add the following Application permissions - See example below:

• Directory.ReadWrite.All
• User.ManageIdentities.All
• User.ReadWrite.All

5. After adding all the permissions, the Status initially shows as Not granted. Click on “Grant admin consent for..”
6. After granting the permissions, a green tick mark should be seen under the status column for each of the permissions