Configure Microsoft Entra ID permissions

Before setting up the Microsoft Entra ID data source for Data Access, configure the underlying data source with the required permissions to allow Data Access to synchronize users and groups.

Steps

To configure Microsoft Entra ID permissions for Data Access:

  1. In the Microsoft Entra admin center, click Entra ID > App registrations > New registration.
  2. Register Data Access, and then record the client ID and tenant ID for later use.
  3. Go to Overview > Client credentials > Add a certificate or secret.
  4. Create a new secret, and then record the secret value for later use.
  5. Click API permissions > Add a permission > Microsoft Graph > Application permissions.
  6. Add the following permissions, and then grant admin consent to each.
    PermissionWhy
    Group.Read.All

    To read all groups in the Microsoft Entra ID tenant.

    User.Read.All

    To read all users in the Microsoft Entra ID tenant.

  7. If you want Data Access to push group changes back to Microsoft Entra ID (controlled by the Enable Group Editing option in Data Access), add the following permissions.
    PermissionPurpose
    Group.ReadWrite.All

    To create, update, and delete groups directly in Microsoft Entra ID.

    GroupMember.ReadWrite.All

    To add and remove members to and from Microsoft Entra ID groups when reconciling group membership.

What's next

Create Azure connection