Skip to content

guides

Intended Documentation

Microsoft Entra (Azure AD) Connector Setup (Beta)

Connect Intended to Microsoft Entra ID (Azure AD) via Microsoft Graph. Acquire a Graph bearer access token with the User.* scopes and run Test connection. Host-pinned to graph.microsoft.com and national-cloud Graph hosts. Beta until validated against your live tenant.

intermediate3 min readpartial
PartialSource: codeValidated: 2026-07-09

Microsoft Entra (Azure AD) Connector Setup (Beta)#

Connect Intended to Microsoft Entra ID (formerly Azure AD) so approved intents can disable, enable, and revoke sign-in sessions for users through the real Microsoft Graph adapter (packages/execution-engine/src/adapters/entra.ts). The adapter is registered under the AZURE connector type. Every write is Authority-Token-verified, ESCALATEs for approval under the starter policy, and carries an X-Idempotency-Key.

This connector is Beta

The adapter is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. Live proof against your real Entra tenant is pending — treat Entra as Beta, not GA. See the Capability Truth Matrix.

What the adapter does#

PropertyValue
Actionsentra.user.disable, entra.user.enable, entra.user.revoke-sessions
AuthMicrosoft Graph bearer token — Authorization: Bearer <accessToken>
Pinned hostsgraph.microsoft.com, graph.microsoft.us, dod-graph.microsoft.us, microsoftgraph.chinacloudapi.cn
Test connectionGET /v1.0/organization?$select=id&$top=1

The credential schema is strict — only accessToken and an optional baseUrl are accepted. The adapter consumes a pre-acquired Graph bearer token; it does not perform the OAuth token exchange itself.

Provider-side steps#

1. Register an app and grant Graph permissions#

  1. In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration.
  2. Under API permissions, add Microsoft Graph → Application permissions for the least-privilege scopes below and Grant admin consent.
  3. Under Certificates & secrets, create a client secret (or upload a certificate) for the app to authenticate.

2. Acquire the Graph access token (accessToken, required)#

Because the adapter takes a pre-acquired bearer token, mint one with the client-credentials flow, for example:

bash
curl -X POST \
  "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token" \
  -d "client_id=<app-client-id>" \
  -d "client_secret=<app-client-secret>" \
  -d "scope=https://graph.microsoft.com/.default" \
  -d "grant_type=client_credentials"

Copy the access_token from the response — that is your accessToken. Graph access tokens are short-lived (typically ~1 hour), so re-credential the connector (rotate) when the token expires.

Least-privilege scope guidance#

  • Matrix scopes for this connector: User.ReadWrite.All, User.EnableDisableAccount.All.
  • User.EnableDisableAccount.All — enable/disable accounts (accountEnabled PATCH).
  • User.ReadWrite.All — required for revokeSignInSessions and read.
  • Grant these as application permissions with admin consent; do not add directory-wide roles the actions don't need.

Fields to paste into the connect dialog#

Open Connectors → Connect a system → Microsoft Entra (Azure AD) → Configure auth:

Field labelKeyRequiredValue
Microsoft Graph Access TokenaccessTokenYesA pre-acquired Graph bearer token with the User.* scopes
Graph Base URLbaseUrlOptionalLeave blank; defaults to https://graph.microsoft.com (national-cloud Graph hosts accepted)

Credentials are stored per-tenant, AES-256-GCM-encrypted, and never displayed back.

Run Test connection#

  1. Finish the connect wizard to store the credential.
  2. On the connector card, click Test connection.
  3. The adapter calls GET /v1.0/organization?$select=id&$top=1. A green result means the token is valid and the Graph host resolved. If it fails, the token has likely expired — rotate it.

Next steps#

Microsoft Entra (Azure AD) Connector Setup (Beta) | Intended