Microsoft Entra

Manage and fetch information from Microsoft Entra

---

The Microsoft Entra connector links Suptask to your Microsoft Entra ID directory (formerly Azure AD). Once connected, an AI Assistant can look up user and group details and — depending on the permissions you grant — manage accounts and memberships directly from a ticket.

To connect it, you register an application in the Microsoft Entra admin center and copy three values into Suptask: the Tenant ID, the Application ID and a client secret value. This guide covers every step.

You set up this connector in the Suptask Web App as an admin. Your agents then use it from Slack while working on tickets.

---

Common workflows

A few common workflows for Microsoft Entra:

• Access requests — add a user to a group or security group after confirming their details.

• Onboarding — create a new team member's account and add them to the right groups.

• Offboarding — disable a leaver's account, revoke their sign-in sessions and remove group memberships.

• Ticket enrichment — read the requester's job title, department or group membership and post it on the ticket.

---

Before you begin

You'll need:

• An admin role in Suptask.

• Access to the Microsoft Entra admin center with rights to register applications.

• A role that can grant admin consent for your tenant, such as Global Administrator, Privileged Role Administrator or Cloud Application Administrator.

What you'll do:

• [ ] Register an application in Microsoft Entra

• [ ] Copy the Tenant ID and Application ID

• [ ] Create a client secret

• [ ] Add API permissions and grant admin consent

• [ ] Enter the three values in Suptask

• [ ] Choose which tools your Assistant may use

Keep the Connect Microsoft Entra window in Suptask open in a separate browser tab. You'll switch back to it at the end.

---

Step 1: Register an application in Microsoft Entra

1. Go to the Microsoft Entra admin center.

2. Open Identity → Applications → App registrations.

3. Click New registration.

4. For Name, enter something recognizable, for example Suptask AI. This name is only shown inside Entra and on the consent record.

5. Under Supported account types, select Accounts in this organizational directory only (single tenant).

6. Leave Redirect URI empty.

7. Click Register.

No redirect URI is needed. Suptask authenticates as the application itself using your Tenant ID, Application ID and client secret - there is no user sign-in step.

---

Step 2: Copy the Tenant ID and Application ID

The Overview page of your new app registration shows both values.

1. Copy the Application (client) ID.

2. Copy the Directory (tenant) ID.

Both are GUIDs, for example 1a2b3c4d-5e6f-7890-abcd-ef1234567890. Keep them somewhere handy - you'll paste them into Suptask in Step 5.

---

Step 3: Create a client secret

1. In your app registration, open Certificates & secrets.

2. On the Client secrets tab, click New client secret.

3. Enter a Description, for example Suptask connector.

4. Choose an Expires period according to your security policy.

5. Click Add.

6. Copy the Value immediately.

The secret Value is only shown once, right after you create it. If you navigate away you'll have to create a new secret. Copy the Value, not the Secret ID — the Secret ID will not work.

Make a note of the expiry date. When the secret expires, the connector stops working until you create a new secret and update it in Suptask.

---

Step 4: Add API permissions and grant admin consent

The connector reads and writes your directory through Microsoft Graph. Add only the permissions your team needs.

1. In your app registration, open API permissions.

2. Click Add a permission → Microsoft Graph.

3. Select Application permissions.

4. Search for and select the permissions you need (see the example below).

5. Click Add permissions.

6. Click Grant admin consent for <your tenant> and confirm.

Every permission should show Granted in the Status column before you continue.

Choose Application permissions, not Delegated permissions. Delegated permissions act on behalf of a signed-in user and won't work with this connector.

Example: manage users and groups

This is one example of a permission set - enough to read the directory, create and update users, and manage group memberships:

Permission	What it allows
User.Read.All	Read all users' full profiles
User.ReadBasic.All	Read all users' basic profiles
User.Create	Create users
User.ReadUpdate.All	Read and update users
User.ReadWrite.All	Read and write all users' full profiles
User.EnableDisableAccount.All	Enable and disable user accounts
User.RevokeSessions.All	Revoke all sign-in sessions for a user
UserAuthenticationMethod.Read.All	Read all users' authentication methods
Group.Read.All	Read all groups
Group.ReadWrite.All	Read and write all groups
GroupMember.Read.All	Read all group memberships
GroupMember.ReadWrite.All	Read and write all group memberships
AuditLog.Read.All	Read all audit log data

Start with the read-only permissions. You can return to API permissions later, add the write permissions you need and grant admin consent again.

---

Step 5: Connect in Suptask

Switch back to the Connect Microsoft Entra window in Suptask.

1. Paste your Tenant ID.

2. Paste your Application ID.

3. Paste your client secret value.

4. Click Authorize.

When it's done, the status changes from Not connected to connected.

---

Step 6: Choose which tools your Assistant may use

The permissions you granted in Entra set the outer boundary of what is possible. Inside Suptask you then decide, per Assistant, which of the connector's tools it may actually use and how much freedom it has.

Each tool can be set to:

• Auto — the Assistant uses the tool on its own when it's relevant.

• Ask — the Assistant prepares the action and pauses for an agent to approve before it runs.

• Off — the Assistant can't use the tool at all.

A common setup is Auto for read-only tools such as looking up a user, and Ask for anything that changes your directory, such as creating a user or updating group memberships.

Set write tools to Ask so an agent reviews the change before it's made in Entra.

AI Assistants

---

Troubleshooting

• Invalid client secret — You most likely copied the Secret ID instead of the secret Value (Step 3), or the secret has expired. Create a new client secret and update it in Suptask.

• Application not found / wrong tenant — Check that the Application ID and Tenant ID come from the same app registration, and that both were copied in full.

• Insufficient privileges / permission errors — Admin consent hasn't been granted, or the permissions were added as Delegated instead of Application. Return to Step 4 and confirm every permission shows Granted.

• It worked before and stopped — The client secret has expired. Create a new one and update it in Suptask.

• The Assistant won't perform an action — The tool is set to Off, or it's set to Ask and is waiting for an agent to approve. Check the tool settings on the Assistant.

• The Assistant can read but not change anything — Only read permissions were granted in Entra. Add the write permissions you need and grant admin consent again.

---

Need help?

Reach out to Suptask Support and our team will help you connect Microsoft Entra.