Microsoft Entra ID Connector

Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management service from Microsoft that helps employees sign in and access resources.

Use the Microsoft Entra ID component to manage users, groups, and applications.

API Documentation

This component was built using the Microsoft Graph REST API v1.0.

Connections

OAuth 2.0

Authenticate using OAuth 2.0

This authentication method may be used when an App requires granting admin consent to API permissions, in addition to authorizing the integration with the App's configured client credentials.

The Microsoft Entra ID component authenticates requests through the Microsoft Graph API.

Prerequisites

• A Microsoft Azure account with access to the Microsoft Entra Admin Center or Microsoft Azure Portal
• Permissions to create App Registrations in the tenant

Setup Steps

1. Navigate to App Registrations.
2. When creating the application, select Supported account types.
3. Select Accounts in any organizational directory (Any Azure AD directory - Multitenant).
4. Navigate to Redirect URI and add the Web platform. Enter the redirect URI as https://oauth2.flowbuilder.eu.lansweeper.com/callback for EU sites or https://oauth2.flowbuilder.us.lansweeper.com/callback for US sites.
5. Select Register to complete.
6. In the App, navigate to Certificates & Secrets and select New client secret. Copy and save the Value for use in the connection configuration of the integration (the value will not be shown again).
7. Next, navigate to the Overview section and copy the Application (client) ID.
8. Navigate to the API Permissions section to assign the proper permissions for the integration. Select Add Permission and select all permissions that are required for the desired integration. A full list of scopes can be found on the Microsoft Graph API documentation.
   • Recommended scopes for Active Directory can be found in Microsoft Graph > Delegated permissions:
   • Group.ReadWrite.All GroupMember.ReadWrite.All Application.ReadWrite.All User.Read.All offline_access

Configure the Connection

Supply the following values to the OAuth 2.0 connection:

• Client ID: The Application (client) ID from the App Registration.
• Client Secret: The Value provided from Certificates & Secrets (not the Secret ID).
• Scopes: The assigned API permissions. The default value is set to: Group.ReadWrite.All GroupMember.ReadWrite.All Application.ReadWrite.All User.Read.All offline_access
• Authorize URL: The OAuth 2.0 authorization endpoint. Defaults to https://login.microsoftonline.com/common/oauth2/v2.0/authorize. If Multitenant was not selected when creating the App, replace with a tenant-specific URL.
• Token URL: The OAuth 2.0 token endpoint. Defaults to https://login.microsoftonline.com/common/oauth2/v2.0/token. If Multitenant was not selected, replace with a tenant-specific URL.

App Verification and Admin Consent

Microsoft requires Azure AD app registrations used in multi-tenant deployments to complete a publisher verification process. This review confirms the app developer's identity, giving end users confidence that they are authorizing a legitimate, verified application.

Azure AD app registrations have two distinct verification concepts that affect how users experience the authentication flow.

Publisher Verification

Complete publisher verification before deploying to end users. Without it, the Microsoft consent screen displays "Unverified" next to the app name. This reduces user trust and may prevent users in organizations with strict Azure AD policies from being able to authorize the app at all.

To verify the publisher:

1. Ensure the organization has a Microsoft Partner Network (MPN) account
2. In the Microsoft Entra Admin Center, open the app registration
3. Under Branding & properties, click Add a verified publisher
4. Enter the MPN ID and confirm

Once verified, the consent screen displays the organization name with a verified badge instead of "Unverified."

Admin Consent

Apps requesting application permissions (permissions that act without a signed-in user) or high-privilege delegated permissions require admin consent before any user in a Microsoft 365 tenant can authenticate. Without admin consent, users see a "Need admin approval" error.

A tenant administrator can grant consent using either method:

Method 1 — Admin Consent URL:

Navigate to the following URL, replacing {tenant} with the Directory tenant ID and {client_id} with the Application client ID:

https://login.microsoftonline.com/{tenant}/adminconsent?client_id={client_id}

Method 2 — Microsoft Entra Admin Center:

1. Navigate to Microsoft Entra Admin Center → Enterprise applications
2. Select the app registration
3. Under Permissions, click Grant admin consent for [organization name]

This connection uses OAuth 2.0, a common authentication mechanism for integrations.
Read about how OAuth 2.0 works here.

OAuth 2.0 Client Credentials

Authenticates actions in all Microsoft's Graph API services.

To connect to Microsoft Entra ID using the OAuth 2.0 Client Credentials flow, create an app registration in Microsoft Entra. The client credentials flow is used for server-to-server authentication where the application acts on its own behalf rather than on behalf of a specific user.

The Microsoft Entra ID component authenticates requests through the Microsoft Graph API. For more information on the Client Credentials flow, refer to the Microsoft documentation.

Prerequisites

• A Microsoft Azure account with administrative access to the Microsoft Entra Admin Center
• Permissions to create App Registrations in the tenant
• Admin consent privileges to grant application-level permissions

Setup Steps

1. Navigate to the Microsoft Entra admin center and go to Identity > Applications > App registrations, then select New registration.
2. Configure the app registration:
   • Set Supported account types to Accounts in any organizational directory (Any Azure AD directory - Multitenant) to allow authentication across different organizations, or to a single-tenant option for tenant-specific access.
   • Select Register to complete the initial setup.
3. Navigate to Certificates & Secrets and create a new Client Secret. Copy the Value immediately (it will not be shown again).
4. Navigate to the Overview page and copy the Application (client) ID.
5. Navigate to the Overview page and copy the Directory (tenant) ID. This value is required, as the client credentials flow cannot use the common endpoint.
6. Navigate to API Permissions and select Add a permission:
   • Select Microsoft Graph
   • Select Application permissions
   • Add all permissions required for the intended use case
7. After adding all required permissions, select Grant admin consent to authorize the application to use these permissions. This step is required for the client credentials flow to function properly.

For more information on application versus delegated permissions, refer to the Microsoft Graph permissions reference.

Configure the Connection

Supply the following values to the OAuth 2.0 Client Credentials connection:

• Client ID: The Application (client) ID from the App Registration.
• Client Secret: The Value provided from Certificates & Secrets (not the Secret ID).
• Tenant: The Directory (tenant) ID or name from the Overview page. The client credentials flow requires a tenant-specific value and cannot use common.
• Microsoft Entra ID Endpoint: The Microsoft Entra ID login endpoint. Defaults to https://login.microsoftonline.com. Adjust this value for sovereign or national cloud environments.
• Base URL: The Microsoft Graph API base URL. Defaults to https://graph.microsoft.com. Adjust this value for sovereign or national cloud environments.
• Scopes: The Microsoft Graph API scope. Defaults to https://graph.microsoft.com/.default, which requests all application permissions configured on the App Registration.

This connection uses OAuth 2.0, a common authentication mechanism for integrations.
Read about how OAuth 2.0 works here.

Triggers

Group Changes

Receive group change notifications from Microsoft Entra ID. Automatically creates and manages a webhook subscription for groups when the instance is deployed, and removes the subscription when the instance is deleted.

User Changes

Receive user change notifications from Microsoft Entra ID. Automatically creates and manages a webhook subscription for users when the instance is deployed, and removes the subscription when the instance is deleted.

Webhook

Receive and validate webhook requests from Microsoft Entra ID for manually configured webhook subscriptions.

Actions

Add Member to Group

Add a member to a group.

Create Application

Creates (registers) a new application.

Create Group

Create a new group. It can be a Microsoft 365 group, dynamic group, or security group.

Create Subscription

Create a subscription to receive notifications when changes occur in the specified object.

Create User

Create a new user.

Delete Application

Deletes an application object.

Delete Group

Deletes a group object.

Delete Instanced Subscriptions

Delete all webhooks that point to a flow in this instance.

Delete Subscription

Deletes a subscription object.

Delete User

Deletes a user.

Get Application

Read properties of an application object.

Get Group

Read properties of a group object.

Get Subscription

Read properties of a subscription object.

Get User

Reads the properties and relationships of a user object.

List Applications

Retrieve the list of applications in the organization.

List Changes

Retrieves a list of changes in an object and its children over time.

List Group Members

Retrieves the direct members of a group.

List Groups

List group objects and their properties.

List Subscriptions

Retrieves a list of active subscriptions.

List Users

Retrieve a list of user objects.

Raw Request

Send raw HTTP request to Microsoft Entra ID.

Remove Member From Group

Removes a member from a Microsoft 365 group or a security group.

Update Subscription

Updates a subscription expiration time for renewal and/or updates the notificationUrl for delivery.

Update User

Update the properties of a User object.

Upsert Application

Create a new application if it doesn't exist, or update the properties of an existing application.

Upsert Group

Create a new group if it doesn't exist, or update the properties of an existing group.