> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/admin-portal/directory-integrations/connect-to-microsoft-entra-id.md).

# Connect to Microsoft Entra ID

***

### Prerequisites for Azure

AdminX and 1Kosmos integrate with Microsoft Entra ID natively using Microsoft Graph. To set up this integration, you need to create a few things in Azure.

{% hint style="info" %}
Ensure that your Azure environment has permission to perform the following steps.
{% endhint %}

#### Registering an application

1. Go to <https://portal.azure.com/> and log in with your Azure credentials. Once logged in, scroll down to **Azure services**.
2. Click **Microsoft Entra ID**.
3. From the application **Overview** page, under the **Manage** drop-down menu, click **App registrations**.
4. On the **App registrations** page, click **New registration**.
5. On the **Register an application** page, enter a user-facing display name for your application. (This example uses the name *Test Demo Wiki*.)
6. Under **Supported account types**, select **Accounts in this organizational directory only (application name only - Single-tenant)**.
7. Leave the **Redirect URI (optional)** section blank.
8. Review your selections, then click **Register**.
9. Once the app is registered, you're redirected to a page listing various details. Make a note of (or copy) the **Application (client) ID** — you'll need it to configure AdminX for Azure AD.

#### Creating the application secret

1. From the same application overview page, click **Certificates & secrets** in the left-hand menu, under **Manage**.
2. Click **New client secret**. Enter a name in the **Description** box and select how soon the secret should expire.
3. Click **Add**.
4. Your secret now appears under **Client secrets**. Make a note of (or copy) the **Value** parameter — you'll need this secret to configure AdminX for Azure AD.

#### Creating the application permissions

To use Microsoft Entra ID with AdminX:

1. Under the **Manage** drop-down menu of the application's overview page, click **Authentication**.
2. Scroll down to **Advanced settings** and toggle **Allow public client flows** to **Yes**.
3. Click **Save**.

{% hint style="danger" %}
Set Allow public client flows to **Yes** to use Microsoft Entra ID in AdminX.
{% endhint %}

4. Under the **Manage** drop-down menu, click **API permissions**.
5. On the **API permissions** page, click **Add a permission**. In the **Request API permissions** window that opens, select **Microsoft Graph** (the largest of the available icons).
6. Click **Application permissions**.
7. Under **Select permissions**, use the search box to find each permission — enter the first word (such as `Directory`), then expand the result to see the full list of permissions.

   To enable **reading and writing** to the user directory (adding or deleting users), enable the following permissions:

   * `Directory.Read.all`
   * `Directory.ReadWrite.all`
   * `User.Read`
   * `User.ReadWrite.all`

   To only **read** from the user directory (without being able to add new users), enable the following permissions instead:

   * `Directory.Read.all`
   * `User.Read`
   * `User.Read.all`
8. After selecting all the required permissions, click **Add permissions**.
9. An administrator must approve the permissions before they can be used. To grant consent, click **Grant admin consent for \[your application]**.
10. After consent is approved, the status changes to **Granted**.

#### Configuring Microsoft Entra ID in AdminX

The following items are needed to configure Microsoft Entra ID in AdminX:

* [ ] **Application (client) ID** — found on the **App registrations** page: `Azure Home -> Microsoft Entra ID -> App registrations`
* [ ] **Tenant ID** — found on the Microsoft Entra ID **Overview** page: `Azure Home -> Microsoft Entra ID` The Tenant ID can also be found on your application's **Overview** page: `Azure Home -> Microsoft Entra ID -> App registrations -> [your application name]`
* [ ] **(Tenant) Name** — your Azure tenant **Name**, found on the Microsoft Entra ID **Overview** page: `Azure Home -> Microsoft Entra ID`
* [ ] **Client Secret** — the secret for your app registration, located on the application's **Certificates & secrets** page: `Azure Home -> Microsoft Entra ID -> App registrations -> [your application name] -> Certificates and secrets` You can view the secret only when you create it. If you lose your secret, create a new one by clicking **New client secret**.
* [ ] **Login URL** — defaults to `https://login.microsoftonline.com`
* [ ] **Graph API URL** — defaults to `https://graph.microsoft.com`
* [ ] **Graph Query Filter** - Enter your OData filter. To scope by group membership:

  memberOf/any(g:g/id eq '\<group-id>')\
  When configured, the platform retrieves only the users matching that filter instead of all users in the tenant. If you leave the field empty, it syncs all users (default behavior).&#x20;

| Scenario                       | Result                                                        |
| ------------------------------ | ------------------------------------------------------------- |
| No filter configured           | All users are synced (default)                                |
| Valid group ID in filter       | Only that group's members are synced                          |
| Invalid group ID               | Test Connection fails with "Group not found"                  |
| Search within a filtered group | Matches any field (first name, last name, email, or username) |

{% hint style="info" %}
**Required App Registration permissions (Microsoft Entra)**&#x20;

The Azure AD App Registration must have the following Application permissions (not Delegated), with admin consent granted:&#x20;

* User.Read.All&#x20;
* Group.Read.All&#x20;
* GroupMember.Read.All
  {% endhint %}

### Setting up Microsoft Entra ID in AdminX

After configuring all the necessary prerequisites, you can connect to Microsoft Entra ID from AdminX.

1. Log in to your tenant as a community administrator.
2. From the left pane, go to the **Directory** menu.
3. On the **Directory Integrations** page, click **Add new directory**.
4. Select **Azure AD**.
5. Review the information displayed, then click **Setup Azure AD**.
6. Enter all the information you copied from Azure.
7. Configure attribute mapping for the 1Kosmos data store used internally by AdminX. This mapping links Azure directory attributes (such as name, number, and so on) to the attributes used by 1Kosmos.

   The following attributes need to be mapped:

   | Azure Directory Attribute | 1Kosmos Attribute Name |
   | ------------------------- | ---------------------- |
   | givenName                 | firstname              |
   | surname                   | lastname               |
   | userPrincipalName         | email                  |
   | mobilePhone               | phone                  |
   | userPrincipalName         | username               |
8. Click **Add new mapping**.
9. Enter the Azure attribute in the top box labeled **Directory attribute**. Use the drop-down menu to select the corresponding 1Kosmos attribute from the table above, then click **Create**.
10. Repeat this process until all the attributes from the table above are mapped, then click **Next**.

    Once the attributes are mapped, you're done. You can click **View Users** to preview your Azure AD users.
11. Click **Complete** to finish adding your Azure AD directory to AdminX.

The added Azure AD directory now appears on the **Directory Integrations** page in AdminX.

AdminX uses the configured mappings when it imports Azure AD users. Review the mappings before adding the directory, because they control how user data appears in AdminX.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/admin-portal/directory-integrations/connect-to-microsoft-entra-id.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.