Microsoft Entra
Service ID: azure-active-directory
Microsoft Entra formerly know as Azure Active Directory (Azure AD) is Microsoft’s cloud-based identity and access management service, which helps your employee's sign in and access resources in.
At a Glance
- Difficulty
- ⚡MODERATESelf-Service OAuth App + Approval Required
- Authentication
- OAuth 2.0OAuth 2.0 authorization code flow via the Microsoft identity platform, reading directory data through Microsoft Graph.
- Webhooks
- Virtual webhooks (Apideck polls for employee created and updated events only, no terminated event)
- Partnership Required
- No(Not required. A multi-tenant app may need Microsoft publisher verification: free, but it requires a Partner Center account, not just a Microsoft sign-in.)
- Partnership Application
- Microsoft Entra admin center↗
- Apideck Credentials
- Not available(Not available: you register your own Microsoft Entra app, so the consent screen carries your own branding and verified publisher.)
- Costs
- No separate charge: Microsoft Entra ID is included in every Microsoft 365 and Azure tenant, and Microsoft Graph has no per-call fee.
- Sandbox Availability
- Not available(No dedicated sandbox. Create a free Microsoft Entra tenant and populate it with test users and groups.)
- Account Type Required
- A Microsoft work or school account in the tenant being connected, on any Microsoft Entra ID tier.
- Consumer Access Level
- A Microsoft administrator, or a user in a tenant where an administrator has already consented to the directory scopes.
- Rate Limits
- Microsoft Graph throttles dynamically by resource and tenant size rather than by a fixed quota, under a ceiling of 130,000 requests per 10 seconds per tenant.
Responsibility matrix
| Task | You (Customer) | Your Consumer | Apideck |
|---|---|---|---|
| Register Microsoft Entra app | ✓ | — | Documentation provided |
| Complete Microsoft publisher verification | ✓ (multi-tenant apps) | — | — |
| Configure Graph permissions and add credentials to Apideck | ✓ | — | — |
| Grant administrator consent for the directory scopes | Design the flow around it | ✓ | — |
| Authorize connection (OAuth) | — | ✓ | Handles the OAuth flow |
| Set the connection timezone | — | ✓ (optional) | — |
| Token refresh | — | — | ✓ Automatic |
| Connection sync | — | — | ✓ Polls via virtual webhooks |
| Build via the Unified API | ✓ | — | Maintains the connector |
| Monitor connections | ✓ Via the Apideck Dashboard | Can revoke consent at any time | Logs and alerts |
Environments
- Single environment
- Microsoft Entra ID uses one set of app credentials for testing and production: there is no separate sandbox with its own client ID and secret. If your organisation already has a tenant, work against a dedicated set of test users rather than real staff records. Note that the Microsoft 365 Developer Program is not a general route to a free sandbox: Microsoft restricted it in 2024 to Visual Studio Professional and Enterprise subscribers and to certain partner programmes. Take care when testing against a live directory.
🚨Important to Know About Microsoft Entra
- The Graph scopes this connector requests require administrator approval in the consumer's tenant, so design your onboarding around an administrator completing or pre-approving the authorisation. An ordinary employee cannot connect on their own.
- Microsoft Entra ID is a directory, not an HR system. Field coverage depends on what each organisation maintains in its user profiles, HR data such as compensation does not exist there, and the connector is read-only, so Entra cannot be your write target for people records.
- Microsoft renamed the product from Azure Active Directory to Microsoft Entra ID in 2023, but Apideck's service id remains azure-active-directory: that is the value you use in API paths and see in the Apideck Dashboard.
⚠️
3 gotchas across 3 resources
Connector-specific behaviors and limitations to be aware of
📦
2 supported resources
View field mappings, supported operations, and schema details