Configure Entra ID permissions

October 19, 2026

Before setting up the Microsoft Entra ID data source for Data Access, configure the target data source with the required permissions to allow Data Access to synchronize users and groups.

Steps

To configure Microsoft Entra ID permissions for Data Access:

1. In the Microsoft Entra admin center, click Entra ID > App registrations > New registration.
2. Register Data Access, and then record the client ID and tenant ID for later use.
3. Go to Overview > Client credentials > Add a certificate or secret.
4. Create a new secret, and then record the secret value for later use.
5. Click API permissions > Add a permission > Microsoft Graph > Application permissions.
6. Add the following permissions, and then grant admin consent to each.

   Permission	Purpose
   Group.Read.All	To read all groups in the Microsoft Entra ID tenant.
   User.Read.All	To read all users in the Microsoft Entra ID tenant.

7. If you want Data Access to push group changes to Microsoft Entra ID (controlled by the Enable Group Editing option in Data Access), add the following permissions, and then grant admin consent to each.

   Permission	Purpose
   Group.ReadWrite.All	To create, update, and delete groups directly in Microsoft Entra ID.
   GroupMember.ReadWrite.All	To add and remove members to and from Microsoft Entra ID groups when reconciling group membership.

8. If you want to configure application data source mappings in Data Access (controlled by the Application data source mapping option in Data Access), add the following permission, and then grant admin consent to it.
   Note Application data source mappings associate Microsoft Entra ID groups that are assigned to a Microsoft Entra ID enterprise application (for example, through the SCIM Group Push feature) with specific Collibra data sources.

   Permission	Purpose
   Application.Read.All	To read the groups that are assigned to your configured Microsoft Entra ID applications.

What's next

Create Azure connection