title: Connecting to Entra ID (Azure AD) category: Connections tags: entra-id, azure-ad, cloud, connection, app-registration priority: Normal

Connecting to Entra ID (Azure AD)

This guide walks you through creating a connection between IdentityCenter and Microsoft Entra ID (formerly Azure Active Directory). Entra ID connections use the Microsoft Graph API instead of LDAP, so the setup process differs from on-premises Active Directory.

Prerequisites

Before you begin, ensure you have:

• An Azure subscription with an Entra ID tenant
• Global Administrator or Application Administrator role in Entra ID
• Administrator access to IdentityCenter
• Outbound HTTPS (port 443) connectivity from the IdentityCenter server to the internet

Step 1: Register an Application in Entra ID

1. Sign in to the Azure Portal
2. Navigate to Microsoft Entra ID > App registrations
3. Click New registration
4. Configure the registration:

5. Click Register
6. On the overview page, note the Application (client) ID and Directory (tenant) ID -- you will need both values later

Step 2: Configure API Permissions

The app registration needs Microsoft Graph permissions to read directory data.

1. In your app registration, go to API permissions
2. Click Add a permission
3. Select Microsoft Graph
4. Choose Application permissions (not Delegated)
5. Search for and add the following permissions:

6. Click Add permissions
7. Click Grant admin consent for [your tenant]
8. Confirm that all permissions show a green check mark under "Status"

Tip: If you plan to use IdentityCenter for write-back operations to Entra ID in the future, you may also want to add User.ReadWrite.All and Group.ReadWrite.All. However, start with read-only permissions for initial synchronization.

Optional: Additional Permissions

Step 3: Create a Client Secret

1. In your app registration, go to Certificates & secrets
2. Click New client secret
3. Configure:

4. Click Add
5. Copy the secret value immediately -- it will not be displayed again after you leave this page

Important: Store the client secret securely. If you lose it, you will need to create a new one and update the connection in IdentityCenter.

Alternative: Certificate Authentication

For higher security, you can use a certificate instead of a client secret:

1. Generate or obtain an X.509 certificate
2. Upload the public key (.cer) to the app registration under Certificates & secrets > Certificates
3. Install the private key (.pfx) on the IdentityCenter server
4. When creating the connection in IdentityCenter, select Certificate as the authentication method and provide the certificate thumbprint

Step 4: Gather Connection Details

You should now have three values ready:

Step 5: Create the Connection in IdentityCenter

1. Log in to IdentityCenter as an administrator
2. Navigate to Administration > Connections
3. Click New Connection
4. Select Entra ID (Azure AD) as the connection type
5. Fill in the connection details:

Step 6: Test the Connection

1. Click Test Connection
2. IdentityCenter will attempt to:
   • Authenticate with the Microsoft Graph API using your credentials
   • Query a small set of users to verify permissions
   • Confirm that the tenant ID is valid
3. Review the test results and resolve any issues before saving

Common test failures:

Step 7: Save and Create Sync Projects

1. Click Save to create the connection
2. The connection will appear in your connection list with an Active status
3. Navigate to Synchronization > Sync Projects and create projects for Entra ID users and groups

Differences from On-Premises Active Directory

Entra ID uses the Microsoft Graph API, not LDAP. This means several things work differently:

Attribute Mapping for Entra ID

When creating sync projects for Entra ID objects, the attribute mappings differ from AD:

Hybrid Environments

Many organizations run both on-premises Active Directory and Entra ID, synchronized via Entra Connect (formerly Azure AD Connect). In these hybrid environments:

Syncing Both Sources

1. Create an Active Directory connection for your on-premises forest
2. Create an Entra ID connection for your cloud tenant
3. Create separate sync projects for each source
4. IdentityCenter's person-centric model will match users from both sources to a single Person record, using email address as the primary correlation key

Avoiding Duplicates

When an object exists in both on-prem AD and Entra ID (which is common with Entra Connect), IdentityCenter distinguishes them by their SourceConnectionId. Each connection produces its own set of Objects, and the Person matching layer links them together.

Choosing an Authoritative Source

Decide which source is authoritative for each attribute:

Security Recommendations

1. Use certificate authentication for production deployments instead of client secrets
2. Set secret expiration reminders if using client secrets -- expired secrets will silently break sync
3. Apply least-privilege permissions -- only grant the Graph permissions you actually need
4. Monitor the app registration -- review sign-in logs in Entra ID to detect unusual activity
5. Restrict the app to specific IPs if your Azure subscription supports conditional access for workload identities

Next Steps

• Creating a Connection -- General connection creation guide
• Multi-Forest & Multi-Domain Setup -- Complex environment configurations
• Connection Troubleshooting -- Diagnose connectivity issues
• Creating a Sync Project -- Set up synchronization for Entra ID objects
• Custom Attribute Mapping -- Map Entra ID attributes to IdentityCenter fields