Source
- Pio
Microsoft Graph API Connection Configuration
To integrate with Microsoft Entra ID (previously Azure AD), an application must be registered with an Entra ID tenant. Once you register the application, you can fill in the Application ID, Directory (tenant) ID, and Application Secret values for the Entra ID Connection Configuration.
You will need help from the Azure Admin in your organization for the following configuration.
1- Login to Azure Portal (portal.azure.com)
2- Select Microsoft Entra ID.
|
3- Click “Add” and select “App registration”
 |
4- Add the “Name” and click the “Register” button.
5- Note down “Application (client) ID” and “Directory (tenant) ID” and click “Add a certificate or a secret” on the right side.
6- Add the description “Azure AD Importer for JSM Assets”, set the expiration date as you wish, and click the “Add” button below.
7- Copy the “Value” of the new client secret.
|
8- Select the “API Permissions” menu on the left side and click “Add a permission”.
|
9- Select “Microsoft Graph” and add Directory.Read.All for the “Application” type.
Pro Tip: If you want to grant the minimum permissions, then you can use the following:
User.Read.All and GroupMember.Read.All
If there are nested groups in your environment where the parent group, a group that possesses other groups as members, has sufficient permission that the application can access, but the child group, a group that is a member of another group, doesn't, it causes failure in accessing both the child and the parent groups. You may get a permission error for the groups. Then please use the following permissions:
User.Read.All and Group.Read.All
|
10- Make sure your Azure Admin provides consent for the permission. The screen needs to be as follows.
Permission: Directory.Read.All
Type: Application
Admin consent requested: Yes
Status: Granted for <your definition>
An example screenshot is provided below:
Just wanted to highlight that this step is important and we receive tickets from our customers regarding permission errors. Most common mistake done by Azure Admins is defining the type as “Delegated” which is the default, instead of “Application”.
11- Fill in the appropriate fields of Azure Connection Settings in the Configuration tab of Azure AD Importer for JSM Assets. Click “Save & Check Connection” to verify the configuration is successful.
12- Optionally, you can set filters for the Users and Groups. This way you can decrease the number of records you are importing and focus only on the relevant data. For more details: Filter
13- Now configure the Destination