Entra ID configuration fields

Field	Description
Enable applications	Enabled: Data Access imports Entra ID enterprise applications, in addition to users and groups. You can see which users and groups are assigned to each application. Disabled (default): Data Access imports only users and groups. Entra ID applications are not synchronized with Data Access, so you cannot see which users and groups are assigned to each application. Note Enable this option if you want to manage access to your enterprise applications from Data Access. The Entra ID data source in Data Access shows each application as a child data object. For each application that has directly assigned users or assigned groups, Data Access also creates an access control that lists them. You can add or remove beneficiaries in the access control, and Data Access applies the change in Entra ID. You can use the Include applications and Exclude applications fields to limit which applications are imported.
Enable group editing	Enabled: Entra ID groups become manageable in Data Access. Disabled (default): Entra ID groups become read-only in Data Access. Note On-premises synchronized groups, dynamic-membership groups, and role-assignable groups are always read-only. Microsoft 365 groups are not imported.
Exclude applications	A list of enterprise applications to exclude from the synchronization (sync). You can use regular expressions (for example, `TEST.`) to match multiple applications at once. Example The expression `TEST.` excludes every application whose name starts with `TEST`. The expression `TEST` excludes only an application that is named exactly `TEST`. It does not match `TEST-app`, because an expression needs to match the entire name. Note Expressions need to match the entire application name, and they are case-sensitive. To match several naming patterns in one expression, place the alternatives in parentheses, separated by a pipe character, for example, `(dev\|test\|sandbox)-.*`. Exclusion takes priority over inclusion. If an application is specified in both the Exclude applications and Include applications fields, it is excluded from the sync.
Include applications	A list of enterprise applications to include in the sync. If you specify any, Data Access imports only matching applications. You can use regular expressions (for example, `TEST.*`) to match multiple applications at once. The same name matching and expression rules apply as for Exclude applications.
Application data source mapping	A list that maps Entra ID enterprise applications to Data Access data sources. This mapping allows Data Access to show which Entra ID groups are assigned to a mapped application, and so which data source they are linked to. Each entry requires both of the following values: Application ID: The application (client) ID of the enterprise application, or its service principal object ID. Data source ID: The ID of an existing data source in Data Access. Note This field is optional. If you leave it empty, no links are created. Application data source mapping works even if the Enable applications option is disabled.
Application role mapping	Entra ID requires each application assignment to use one app role. Some enterprise applications offer more than one assignable app role. For those applications, use this field so that Data Access knows which role to assign when it adds users or groups to the application access control. Each entry requires both of the following values: Application ID: The service principal object ID of the enterprise application. Role: The value or display name of the app role. Applications that have one assignable role, or none, do not need an entry. Note Without an entry, assigning users or groups to an application with several roles fails.
Exclude groups	A list of groups to exclude from the sync. You can use regular expressions (for example, `TEST.`) to match multiple groups at once. Example The expression `TEST-.` excludes every group whose name starts with `TEST-`. The expression `TEST-` excludes only a group that is named exactly `TEST-`. It does not match `TEST-app`, because an expression needs to match the entire name. Note Expressions need to match the entire group name, and they are case-sensitive. To match several naming patterns in one expression, place the alternatives in parentheses, separated by a pipe character, for example, `(Finance\|HR\|Legal)`. Exclusion takes priority over inclusion. If a group is specified in both the Exclude groups and Include groups fields, it is excluded from the sync.
Include groups	A list of groups to include in the sync. If you specify any, Data Access imports only matching groups. You can use regular expressions (for example, `TEST.*`) to match multiple groups at once. The same name matching and expression rules apply as for Exclude groups.
Tag overwrite key for owners	Entra ID does not use this field. You can leave it empty.
Tag key and value to flag user as a machine	A tag key and tag value that determine whether an identity is classified as a machine user in Data Access. Enter the key-value pair, separated by a colon: `key:value`. If a tag on a user matches the specified pair, that user is set as a machine user instead of a human user. Example If you enter `Department:Automation`, any user whose Entra ID department is `Automation` is classified as a machine user in Data Access. Note The pair needs to contain exactly one colon, which separates a non-empty key from a non-empty value. The key and value cannot contain a colon, and they are not case-sensitive. The key needs to be one of the following user attributes: `Department` `OfficeLocation` `JobTitle`

Enable applications

Enabled: Data Access imports Entra ID enterprise applications, in addition to users and groups. You can see which users and groups are assigned to each application.
Disabled (default): Data Access imports only users and groups. Entra ID applications are not synchronized with Data Access, so you cannot see which users and groups are assigned to each application.

Note Enable this option if you want to manage access to your enterprise applications from Data Access.

The Entra ID data source in Data Access shows each application as a child data object.
For each application that has directly assigned users or assigned groups, Data Access also creates an access control that lists them. You can add or remove beneficiaries in the access control, and Data Access applies the change in Entra ID.
You can use the Include applications and Exclude applications fields to limit which applications are imported.

Enable group editing

Enabled: Entra ID groups become manageable in Data Access.
Disabled (default): Entra ID groups become read-only in Data Access.

Note

On-premises synchronized groups, dynamic-membership groups, and role-assignable groups are always read-only.
Microsoft 365 groups are not imported.

Exclude applications

A list of enterprise applications to exclude from the synchronization (sync). You can use regular expressions (for example, TEST.*) to match multiple applications at once.

Example The expression TEST.* excludes every application whose name starts with TEST. The expression TEST excludes only an application that is named exactly TEST. It does not match TEST-app, because an expression needs to match the entire name.

Note

Expressions need to match the entire application name, and they are case-sensitive.
To match several naming patterns in one expression, place the alternatives in parentheses, separated by a pipe character, for example, (dev|test|sandbox)-.*.
Exclusion takes priority over inclusion. If an application is specified in both the Exclude applications and Include applications fields, it is excluded from the sync.

Include applications

A list of enterprise applications to include in the sync. If you specify any, Data Access imports only matching applications.

You can use regular expressions (for example, TEST.*) to match multiple applications at once. The same name matching and expression rules apply as for Exclude applications.

Application data source mapping

A list that maps Entra ID enterprise applications to Data Access data sources. This mapping allows Data Access to show which Entra ID groups are assigned to a mapped application, and so which data source they are linked to.

Each entry requires both of the following values:

Application ID: The application (client) ID of the enterprise application, or its service principal object ID.
Data source ID: The ID of an existing data source in Data Access.

Note

This field is optional. If you leave it empty, no links are created.
Application data source mapping works even if the Enable applications option is disabled.

Application role mapping

Entra ID requires each application assignment to use one app role. Some enterprise applications offer more than one assignable app role. For those applications, use this field so that Data Access knows which role to assign when it adds users or groups to the application access control.

Each entry requires both of the following values:

Application ID: The service principal object ID of the enterprise application.
Role: The value or display name of the app role.

Applications that have one assignable role, or none, do not need an entry.

Note Without an entry, assigning users or groups to an application with several roles fails.

Exclude groups

A list of groups to exclude from the sync. You can use regular expressions (for example, TEST.*) to match multiple groups at once.

Example The expression TEST-.* excludes every group whose name starts with TEST-. The expression TEST- excludes only a group that is named exactly TEST-. It does not match TEST-app, because an expression needs to match the entire name.

Note

Expressions need to match the entire group name, and they are case-sensitive.
To match several naming patterns in one expression, place the alternatives in parentheses, separated by a pipe character, for example, (Finance|HR|Legal).
Exclusion takes priority over inclusion. If a group is specified in both the Exclude groups and Include groups fields, it is excluded from the sync.

Include groups

A list of groups to include in the sync. If you specify any, Data Access imports only matching groups.

You can use regular expressions (for example, TEST.*) to match multiple groups at once. The same name matching and expression rules apply as for Exclude groups.

Tag overwrite key for owners

Entra ID does not use this field. You can leave it empty.

Tag key and value to flag user as a machine

A tag key and tag value that determine whether an identity is classified as a machine user in Data Access. Enter the key-value pair, separated by a colon: key:value. If a tag on a user matches the specified pair, that user is set as a machine user instead of a human user.

Example If you enter Department:Automation, any user whose Entra ID department is Automation is classified as a machine user in Data Access.

Note

The pair needs to contain exactly one colon, which separates a non-empty key from a non-empty value. The key and value cannot contain a colon, and they are not case-sensitive.
The key needs to be one of the following user attributes:
- Department
- OfficeLocation
- JobTitle

Entra ID configuration fields

Related topics