/
Source Configuration for Microsoft Entra ID Importer

Source Configuration for Microsoft Entra ID Importer

Microsoft Graph API Connection Configuration

To integrate with Microsoft Entra ID (previously Azure AD), an application must be registered with an Entra ID tenant. Once you register the application, you can fill in the Application ID, Directory (tenant) ID, and Application Secret values for the Entra ID Connection Configuration.

 

You will need help from the Azure Admin in your organization for the following configuration.

 

  1. Login to Azure Portal (portal.azure.com).

  2. Select Microsoft Entra ID.

 

  1. Click "Add", then choose "App registration" from the options.

  1. Enter a Name and click "Register".

  1. After registration:

  • Copy Application (Client) ID.

  • Copy Directory (Tenant) ID.

To generate an Application Secret:

  • Navigate to Add a certificates or secret.

  • Click New Client Secret → Set expiration → Copy the generated secret.

  1. Enter the description e.g. "Azure AD Importer for JSM Assets", choose the desired expiration date, and click "Add".

  1. Copy the "Value" of the newly created client secret.

Important: Ensure you copy the Value, not the Secret ID. The Value is required for authentication and will be hidden once you leave the page.

 

  1. Select the "API Permissions" menu on the left side, then click "Add a permission".

 

9- Select “Microsoft Graph” and add Directory.Read.All

 

 

Pro Tip:

To grant the minimum permissions, you may use:

  • User.Read.All

  • GroupMember.Read.All

  • Application.Read.All

  • Device.Read.All

  • AgentIdentity.Read.All (Coming soon)

  • AgentIdentityBlueprintPrincipal.Read.All (Coming Soon)

You may encounter permission errors if your environment has nested groups, where a parent group has sufficient access but a child group does not. In that case, you may use:

  • User.Read.All

  • Group.Read.All

If you need to collect the licenses, you need permission to read the directory.

  • Directory.Read.All

In addition, to import employeeLeaveDateTime please enable

  • User-LifeCycleInfo.Read.All

In order to import Access Packages and Catalogs please enable

  • EntitlementManagement.Read.All

Important Notes (Coming Soon)

  1. Classic Agents — Application.Read.All is already required by the existing Entra ID importer, so no new permission needed for customers already using it

  2. Agent Identities — requires the new AgentIdentity.Read.All permission. Also note the known Microsoft bug: if the app also has Directory.ReadWrite.All granted, Agent Identity calls will return 403 even with the correct permission. Solution: remove Directory.ReadWrite.All

  3. Agent Blueprints — requires AgentIdentityBlueprintPrincipal.Read.All. This is a separate permission from AgentIdentityBlueprint.Read.All (which is for the application objects, not the service principal/principal objects)

  4. Microsoft 365 Copilot Agents — requires the new AgentIdentity.Read.All permission.

The tables below explains the different levels of main permissions and their capabilities.

Agents Tree Permissions

Object Type

Permission Required

Type

Object Type

Permission Required

Type

Classic Agents

Application.Read.All

Application

Agent Identities

Microsoft 365 Copilot Agents

AgentIdentity.Read.All

Application

Agent Blueprints

AgentIdentityBlueprintPrincipal.Read.All

Application

Permissions and their capabilities

  • User.Read.All

  • GroupMember.Read.All

  • User.Read.All

  • Group.Read.All

  • Directory.Read.All

Permissions and their capabilities

  • User.Read.All

  • GroupMember.Read.All

  • User.Read.All

  • Group.Read.All

  • Directory.Read.All

Collects Users and Groups

Collects nested groups (parent-child relationship)

Collects the Licenses

 

  1. Ask your Azure Admin to provide consent for the required permission. The settings should be as follows:

  • Permission: Directory.Read.All

  • Type: Application

  • Admin Consent Requested: Yes

  • Status: Granted for <your organization>

See the example screenshot below:

This step is crucial, as we frequently receive customer tickets related to permission errors. The most common mistake Azure Admins make is selecting "Delegated" (the default) instead of "Application" as the permission type.

  1. Fill in the required fields under Azure Connection Configuration in the Source tab of Azure AD Importer for JSM Assets. Then, click "Save & Check Connection" to confirm the configuration is successful.

File Explorer - Downloads - File Explorer - 7 February 2025 (2).mp4
Screenshot 2025-08-25 at 22.09.09.png

 

New in 5.0.0
We’ve added support for multiple Azure environments:

Azure US Government – graph.microsoft.us

Azure Global Service – graph.microsoft.com

Users can now select the appropriate environment when connecting.

  1. (Optional) You can apply filters for Users and Groups to reduce the number of imported records and focus on relevant data. For more details, visit: Filter

  2. Next configure the Destination settings.