...
Microsoft Graph API Connection Configuration
To integrate with Microsoft Entra ID (previously Azure AD), an application must be registered with an Azure AD Entra ID tenant. Once you register the application, you can fill in the Application ID, Directory (tenant) ID, and Application Secret values for the Azure Entra ID Connection Configuration.
| Info |
|---|
You will need help from the Azure Admin in your organization for the following configuration. |
Login to Azure Portal (portal.azure.com)
...
Select Microsoft Entra ID.
 |
...
Click "Add", then choose "App registration" from the options.
 |
4- Add the “Name” and click the “Register” button.
...
5- Note down “Application (client) ID” and “Directory (tenant) ID” and click “Add a certificate or a secret” on the right side.
...
6- Add the description “Azure AD Importer for JSM Assets”, set the expiration date as you wish, and click the “Add” button below.
...
7- Copy the “Value” of the new client secret.
...
...
Enter the Name, then click "Register"
 |
After registration, go to Overview:
Copy Application (Client) ID.
Copy Directory (Tenant) ID.
To generate an Application Secret:
Navigate to Add a certificates or secret.
Click New Client Secret → Set expiration → Copy the generated secret.
 |
Enter the description e.g. "Azure AD Importer for JSM Assets", choose the desired expiration date, and click "Add".
 |
Copy the "Value" of the newly created client secret.
| Note |
|---|
Important: Ensure you copy the Value, not the Secret ID. The Value is required for authentication and will be hidden once you leave the page. |
 |
Select the "API Permissions" menu on the left side, then click "Add a permission".
 |
9- Select “Microsoft Graph” and add “Directory.Read.All“ for the “Application” type.
...
10- Make sure your Azure Admin provides consent for the permission. The screen needs to be as follows..
 |
| Info |
|---|
Pro Tip:To grant the minimum permissions, you may use:
You may encounter permission errors if your environment has nested groups, where a parent group has sufficient access but a child group does not. In that case, you may use:
If you need to collect the licenses, you need permission to read the directory.
The table below explains the different levels of permissions and their capabilities. |
Permissions and their capabilities |
|
|
|
|---|---|---|---|
Collects Users and Groups |
|
|
|
Collects nested groups (parent-child relationship) |
|
|
|
Collects the Licenses |
|
|
|
Ask your Azure Admin to provide consent for the required permission. The settings should be as follows:
Permission:
Directory.Read.AllType: Application
Admin
...
Consent Requested: Yes
Status: Granted for <your
...
organization>
An See the example screenshot is provided below:
 |
| Note |
|---|
Just wanted to highlight that this This step is important and crucial, as we frequently receive tickets from our customers regarding customer tickets related to permission errors. Most The most common mistake done by Azure Admins is defining the type as “Delegated” which is the default, instead of “Application”. |
...
make is selecting "Delegated" (the default) instead of "Application" as the permission type. |
Fill in the required fields under Azure Connection Settings in the
...
Source tab of Azure AD Importer for JSM Assets.
...
Then, click "Save & Check
...
Connection" to
...
confirm the configuration is successful.
...
(Optional) You can apply filters for Users and Groups to reduce the number of imported records and focus on relevant data. For more details, visit: Filter
...
Next configure the Destination settings.