Pre-Requisites
Install Requirements
This is specific to Self Hosted deployments. For Sath hosted connectors, these requirements are already in place.
- You need to install Helm version 3 or above.
- You can use Kubernetes cluster (1.26 or above) to install the connector
Connection Requirements
Below is needed to connect to Entra ID
- An active Microsoft Entra ID Subscription
- Entra ID Application credentials
- Client ID
- Client Secret
- Tenant ID
Application Registration and Setup
An application (Entra ID terminology) will need to be registered within Entra ID instance for granting our connector permission to call the Microsoft Graph API.
To create a new application in Entra ID, follow the steps below:
- Login with administrator credentials in your Entra ID instance
- Go to App Registrations section
- Click on + New Registration to create a new application (This application will be the anchor between IDHub and Entra ID)
- Provide a name for the application and for supported account types, pick “Accounts in this Organizational Directory Only” and hit on “Register”
- Copy the values for Client ID, Tenant ID and save them for later use. (These will be used to authenticate the connection between IDHub and Entra ID)
- Next, Click on Certificates & secrets
- Go to Client Secrets section and Click on + New client secret to add a new client secret
- To add new client secret, add secret description and expiry as ‘Never’ (preferred) and click on Addinfo
If Expiry is 6 months or 12 months, the secrets will need to be updated in the Connector Manager post expiry for continued provisioning and reconciliation.
- Copy the Client Secret value by clicking on the copy icon and save it.
Your application is now registered successfully. Make sure to save Client ID, Tenant ID and Client Secret from the application. These will be used while connecting IDHub to application.
Permissions
Post registration, the application added in Entra ID will be need to required permissions to perform various functions.
Required Permissions
To perform basic directory operations below permission needs to be provided to the application registered in Entra:
- Read Directory Data - Directory.Read.All
- Read and Write Directory Data - Directory.ReadWrite.All
Post that detailed permissions are available to manage and control specific entitlements and licenses across Entra. See below for more information:
Permission | Type | Purpose |
---|---|---|
User.Read.All | Application | Account Reconciliation, Fetch Objects like Roles and Groups Membership |
User.ReadWrite.All | Application | Create User, Update User Properties (Non Entitlement), Add / Remove License Pack and Plan, Enable/ Disable User Account, Delete User |
Organization.Read.All | Application | Reconcile License Pack and Plan Details of tenant |
RoleManagement.ReadWrite.Directory | Application | Add / Remove Directory Roles and Role Provisioning |
RoleManagement.Read.Directory | Application | Role Reconciliation |
Group.Read.All | Application | Group Reconciliation |
Group.ReadWrite.All | Application | Create Group, Update Group, Delete Group |
Built-In Roles
- To manage all aspects of users and groups, including resetting passwords for limited admins, the application registered on Entra must have the User Administrator role
- To manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities the application registered on Entra must have Global Administrator role
- To manage view, set and reset authentication method information for any user (admin or non-admin) the application needs to have Privileged Authentication Administrator role
To know more about Entra ID Roles, view doc here.
How to grant permissions
To add permission, see below steps:
- Go to the registered application and click on API Permissions and then on Add a permission.
- In the window that pops up, click on Microsoft Graph
- Click on Application permissions
- Search and add the following Application permissions - See example below:
- Directory.ReadWrite.All
- User.ManageIdentities.All
- User.ReadWrite.All
- After adding all the permissions, the Status initially shows as Not granted. Click on “Grant admin consent for..”
- After granting the permissions, a green tick mark should be seen under the status column for each of the permissions