> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure Microsoft Entra ID

You can configure an Microsoft Entra ID directory to manage your users and groups through IDaaS. You can also manage your Microsoft Entra ID password (change or reset) through IDaaS and can use them to log in to IDaaS.

## Changing Microsoft Entra ID authorization permissions

IDaaS uses Read/Write as the default permission to allow all operations. Once the directory is created with the Read/Write permission, the Enterprise application will have all the scopes associated to Read/Write.

To change it back to Read-Only, the associated Read/Write scopes must be revoked from the Enterprise application. This can be done in two ways:

1. Manually revoke all read/write the scopes associated with the enterprise application.
2. Delete the Enterprise application and reauthorize.

### Permission details

- IDaaS Read Permission is associated with `openid,offline_access,User.Read.All,Group.Read.All,Directory.Read.All` Microsoft Graph API permissions (claim values).
- IDaaS Read/Write Permission is associated with `openid,offline_access,User.ReadWrite.All,Group.Read.All,Directory.ReadWrite.All`, and `Directory.AccessAsUser.All` Microsoft Graph API permissions (claim values).

note

The Administrator who has the privilege to grant the permission can be used to consent for the requested scopes, for example, the Global Administrator.

## Supported Microsoft Entra ID user roles and operations

The following table outlines the tested roles and supported actions.

note

Roles 2, 3, and 4 do not have the privilege to grant consent. A requisite Global Administrator must grant consent.

| SI No. | Role                                | Permission | User Sync | Group Sync | Password Reset |
| ------ | ----------------------------------- | ---------- | --------- | ---------- | -------------- |
| 1      | Global Administrator                | Read-Only  | Yes       | Yes        | No             |
|        |                                     | Read/Write | Yes       | Yes        | Yes            |
| 2      | Reauthorize with User Administrator | Read-Only  | Yes       | Yes        | No             |
|        |                                     | Read/Write | Yes       | Yes        | Yes            |
| 3      | Reauthorize with Global Reader      | Read-Only  | Yes       | Yes        | No             |
|        |                                     | Read/Write | Yes       | Yes        | No             |
| 4      | Reauthorize with Directory Reader   | Read-Only  | Yes       | Yes        | No             |
|        |                                     | Read/Write | Yes       | Yes        | No             |

## Migrating an Microsoft Entra ID LDAP to Microsoft Entra ID C2C

To migrate an Microsoft Entra ID LDAP to Microsoft Entra ID C2C, you must do the following:

1. Note any groups filters that you configure for Microsoft Entra ID LDAP.

2. Delete the existing on-premises directory configuration on IDaaS. Note that there will be an outage period until you complete steps 3 and 4.

3. Follow the steps to [Add a Microsoft Entra ID](#add-a-microsoft-entra-id-directory). Make sure that you add the group filters noted in step 1.

note
When creating the Microsoft Entra ID Cloud to Cloud configuration, if you set the following additional Custom Attribute mapping, CustomAttribute=onPremisesImmutableId, you can get the ImmutableID from Microsoft Entra ID, which can be used in any Office 365 configurations and subsequent authentications.

4. [Force sync the directory](/docs/directories-and-provisioning/manage-directories/manage-directory-synchronization.md#run-a-force-sync).

## Migrating an On-Premises (Windows server-based) active directory to Microsoft Entra ID C2C

To migrate an Microsoft Entra ID LDAP to Microsoft Entra ID C2C, you must do the following:

1. Note any groups filters that you configure for the on-premises Active Directory.
2. Create a new dummy custom attribute. See [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md).
3. Change the directory configuration and map this newly created custom attribute to a valid directory attribute.
4. The directory configuration change triggers a directory sync. Wait for the sync to complete successfully. successfully.
5. Follow the steps to [Add a Microsoft Entra ID](#add-a-microsoft-entra-id-directory). Make sure that you add the group filters noted in step 1.
6. [Force sync the directory](/docs/directories-and-provisioning/manage-directories/manage-directory-synchronization.md#run-a-force-sync).

note

Steps 2 and 4 are only necessary if you configured the on-premises directory.

## Add a Microsoft Entra ID directory

1. Click Menu icon **Directories**. The **Directories List** page appears.

2. Click Circle Plus icon and select **Microsoft Entra ID** from the drop-down list. The **Azure Authorization** dialog box appears.

3. Select the **Authorization permission** for Microsoft Entra ID sync with IDaaS. If you select, **Read Only**, password change and password reset will not be available.

4. Click **Authorize**. You are redirected to Microsoft to sign in to your account.

5. Sign in to your Microsoft Entra ID account. You are redirected to the Microsoft **Permissions** page. The **Permissions** page lists all the permissions needed for IDaaS to import users and groups from your Microsoft Entra ID.

6. Click **Consent on behalf of your organization**. You must select this checkbox to use an Microsoft Entra ID directory with IDaaS.

7. Click **Accept**. You are redirected to the **Add Directory** page.

note
When you log in to Microsoft Entra ID, a token is generated. The token remains valid for 10 minutes. If you do not complete log in and permission acceptance within 10 minutes, the token expires. If this happens, IDaaS creates the directory but it is in an unauthorized state. On the **Directories List** page, click the directory name. The **Edit Azure Directory** page appears. Click **Re-Authorize**.

8. Enter a **Directory Name** to identify your Microsoft Entra ID.

9. In the **Group Filters** field enter the name of the group that you want to filter. For example, enter Sales to sync all users in the Sales Department. By default all groups are synchronized.

note
If there are no group filters set, all users are imported. If there is more than one group filter set, the user must belong to one of the groups identified by the group filters. Only enter one value per **Group Filter** text box.

10. Optional: Click **Add** to add more group filters.

11. In the **Attributes Mappings** section, map the user attributes to the Microsoft Entra ID attributes.

note
If a user does not have an email and phone or mobile attribute in Microsoft Entra ID or they are not properly mapped, they will not have the OTP capability. You must at a minimum map the mandatory system attributes. They are flagged with an asterisk (*).

12. Optional. Add **Custom User Attributes**. (See [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md)).

note
You must map attributes to the Microsoft Entra ID attributes. For a complete list, on the **Add Directory** page, click Circle Question Mark icon next to either **System User Attributes** or **Custom User Attributes** and then click the **Azure user attributes** link. For example, if you want to add a custom user attribute for a user's a Hire Date, you can create it in IDaaS and call it **Hire Date** (or anything you want) but you must map it to hireDate, which is the acceptable Azure attribute.

13. In the **Synchronization** section, do the following:

    1. From the **Group Synchronization** drop-down list, select the groups that you want to add to IDaaS. Only groups with users synced to IDaaS are created. The group synchronization options include:

       1. **All groups**: All groups from users synced to IDaaS are added.
       2. **Groups Matching Group Filter**: Only groups matching the filter are added to IDaaS.
       3. **No Groups**: No groups are added to IDaaS.

    2. Select the **User Desynchronization Policy** from the drop-down list. This policy determines what happens to user accounts in IDaaS that are no longer found in the directory or no longer match the filters. Options include:

       1. **Group removed from Identity as a Service** to remove the group from IDaaS.
       2. **Group becomes a directory-localized IDaaS group** to keep the group but change it to an unsynchronized group.

    note
    Microsoft Entra ID synchronization occurs automatically every 8 hours.

14. Click **Add**.

When synchronization completes, the new directory appears on the **Directories** **List** page. A check mark Check icon appears in the **Connection Status** column to indicate that IDaaS has successfully connected to Azure AD.

## Troubleshoot

### Unauthorized icon appears

If an Triangle Alert icon unauthorized icon appears, you cannot access the Microsoft Entra ID account or revoke permissions for IDaaS. This might happen if you remove an application from Microsoft Entra ID. If this occurs, do the following:

1. In the IDaaS **Directories List** page, select the Microsoft Entra ID directory name. The **Edit Directory** page appears, click **Re-authorize**.
2. Sign in to your Microsoft Entra ID account. You are redirected to the Microsoft **Permissions** page. The Permissions page lists all the permissions needed for IDaaS to import users and groups from your Microsoft Entra ID.
3. Click **Consent on behalf of your organization**. You must select this check box to use a Microsoft Entra ID directory with IDaaS.
4. Click **Accept**. You are redirected to the **Edit Directory** page.
5. Click **Save**.

### Password authentication failure with conditional access enabled

When syncing users through Microsoft Entra ID with Conditional Access enabled or users with Office365 federated domains, IDaaS is unable to perform password authentication. Only second-factor authentication for users protected by conditional access is available. This only affects Microsoft Entra ID Cloud to Cloud sync. This is not an issue if you are syncing users from Microsoft Entra ID through the Enterprise Service Gateway.