> For the complete documentation index, see [llms.txt](https://support.suptask.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.suptask.com/integrations-automations-and-workflows/integration-guides/microsoft-entra.md).

# Microsoft Entra

Manage and fetch information from Microsoft Entra

***

The Microsoft Entra connector links Suptask to your Microsoft Entra ID directory (formerly Azure AD). Once connected, an AI Assistant can look up user and group details and — depending on the permissions you grant — manage accounts and memberships directly from a ticket.

To connect it, you register an application in the **Microsoft Entra admin center** and copy three values into Suptask: the **Tenant ID**, the **Application ID** and a **client secret value**. This guide covers every step.

{% hint style="info" %}
You set up this connector in the Suptask Web App as an admin. Your agents then use it from Slack while working on tickets.
{% endhint %}

***

### Common workflows

A few common workflows for Microsoft Entra:

* **Access requests** — add a user to a group or security group after confirming their details.
* **Onboarding** — create a new team member's account and add them to the right groups.
* **Offboarding** — disable a leaver's account, revoke their sign-in sessions and remove group memberships.
* **Ticket enrichment** — read the requester's job title, department or group membership and post it on the ticket.

***

### Before you begin

You'll need:

* An **admin** role in Suptask.
* Access to the [Microsoft Entra admin center](https://entra.microsoft.com/) with rights to register applications.
* A role that can **grant admin consent** for your tenant, such as Global Administrator, Privileged Role Administrator or Cloud Application Administrator.

What you'll do:

* \[ ] Register an application in Microsoft Entra
* \[ ] Copy the Tenant ID and Application ID
* \[ ] Create a client secret
* \[ ] Add API permissions and grant admin consent
* \[ ] Enter the three values in Suptask
* \[ ] Choose which tools your Assistant may use

{% hint style="info" %}
Keep the Connect Microsoft Entra window in Suptask open in a separate browser tab. You'll switch back to it at the end.
{% endhint %}

***

### Step 1: Register an application in Microsoft Entra

1. Go to the [Microsoft Entra admin center](https://entra.microsoft.com/).
2. Open **Identity → Applications → App registrations**.
3. Click **New registration**.
4. For **Name**, enter something recognizable, for example `Suptask AI`. This name is only shown inside Entra and on the consent record.
5. Under **Supported account types**, select **Accounts in this organizational directory only (single tenant)**.
6. Leave **Redirect URI** empty.
7. Click **Register**.

{% hint style="info" %}
No redirect URI is needed. Suptask authenticates as the application itself using your Tenant ID, Application ID and client secret - there is no user sign-in step.
{% endhint %}

***

### Step 2: Copy the Tenant ID and Application ID

The **Overview** page of your new app registration shows both values.

1. Copy the **Application (client) ID**.
2. Copy the **Directory (tenant) ID**.

Both are GUIDs, for example `1a2b3c4d-5e6f-7890-abcd-ef1234567890`. Keep them somewhere handy - you'll paste them into Suptask in Step 5.

***

### Step 3: Create a client secret

1. In your app registration, open **Certificates & secrets**.
2. On the **Client secrets** tab, click **New client secret**.
3. Enter a **Description**, for example `Suptask connector`.
4. Choose an **Expires** period according to your security policy.
5. Click **Add**.
6. Copy the **Value** immediately.

{% hint style="warning" %}
The secret Value is only shown once, right after you create it. If you navigate away you'll have to create a new secret. Copy the Value, not the Secret ID — the Secret ID will not work.
{% endhint %}

{% hint style="info" %}
Make a note of the expiry date. When the secret expires, the connector stops working until you create a new secret and update it in Suptask.
{% endhint %}

***

### Step 4: Add API permissions and grant admin consent

The connector reads and writes your directory through **Microsoft Graph**. Add only the permissions your team needs.

1. In your app registration, open **API permissions**.
2. Click **Add a permission → Microsoft Graph**.
3. Select **Application permissions**.
4. Search for and select the permissions you need (see the example below).
5. Click **Add permissions**.
6. Click **Grant admin consent for \<your tenant>** and confirm.

Every permission should show **Granted** in the **Status** column before you continue.

{% hint style="warning" %}
Choose Application permissions, not Delegated permissions. Delegated permissions act on behalf of a signed-in user and won't work with this connector.
{% endhint %}

#### Example: manage users and groups

<figure><img src="https://621243658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FO5JbdwXcuzsmDvD73Ccf%2Fuploads%2Fgit-blob-b3566e6eea373c0a1e0dcc356f68e5cfb6f04bf4%2Fimage.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

This is one example of a permission set - enough to read the directory, create and update users, and manage group memberships:

| Permission                          | What it allows                          |
| ----------------------------------- | --------------------------------------- |
| `User.Read.All`                     | Read all users' full profiles           |
| `User.ReadBasic.All`                | Read all users' basic profiles          |
| `User.Create`                       | Create users                            |
| `User.ReadUpdate.All`               | Read and update users                   |
| `User.ReadWrite.All`                | Read and write all users' full profiles |
| `User.EnableDisableAccount.All`     | Enable and disable user accounts        |
| `User.RevokeSessions.All`           | Revoke all sign-in sessions for a user  |
| `UserAuthenticationMethod.Read.All` | Read all users' authentication methods  |
| `Group.Read.All`                    | Read all groups                         |
| `Group.ReadWrite.All`               | Read and write all groups               |
| `GroupMember.Read.All`              | Read all group memberships              |
| `GroupMember.ReadWrite.All`         | Read and write all group memberships    |
| `AuditLog.Read.All`                 | Read all audit log data                 |

{% hint style="info" %}
Start with the read-only permissions. You can return to API permissions later, add the write permissions you need and grant admin consent again.
{% endhint %}

***

### Step 5: Connect in Suptask

Switch back to the **Connect Microsoft Entra** window in Suptask.

1. Paste your **Tenant ID**.
2. Paste your **Application ID**.
3. Paste your client **secret value**.
4. Click **Authorize**.

When it's done, the status changes from **Not connected** to connected.

***

### Step 6: Choose which tools your Assistant may use

The permissions you granted in Entra set the outer boundary of what is possible. Inside Suptask you then decide, per Assistant, which of the connector's **tools** it may actually use and how much freedom it has.

Each tool can be set to:

* **Auto** — the Assistant uses the tool on its own when it's relevant.
* **Ask** — the Assistant prepares the action and pauses for an agent to approve before it runs.
* **Off** — the Assistant can't use the tool at all.

A common setup is **Auto** for read-only tools such as looking up a user, and **Ask** for anything that changes your directory, such as creating a user or updating group memberships.

{% hint style="info" %}
Set write tools to Ask so an agent reviews the change before it's made in Entra.
{% endhint %}

{% content-ref url="/pages/EMXzCysY1oz2JPFXI8gH" %}
[AI Assistants](/suptask-ai/ai-assistants.md)
{% endcontent-ref %}

***

### Troubleshooting

* **Invalid client secret** — You most likely copied the **Secret ID** instead of the secret **Value** (Step 3), or the secret has expired. Create a new client secret and update it in Suptask.
* **Application not found / wrong tenant** — Check that the Application ID and Tenant ID come from the same app registration, and that both were copied in full.
* **Insufficient privileges / permission errors** — Admin consent hasn't been granted, or the permissions were added as **Delegated** instead of **Application**. Return to Step 4 and confirm every permission shows **Granted**.
* **It worked before and stopped** — The client secret has expired. Create a new one and update it in Suptask.
* **The Assistant won't perform an action** — The tool is set to **Off**, or it's set to **Ask** and is waiting for an agent to approve. Check the tool settings on the Assistant.
* **The Assistant can read but not change anything** — Only read permissions were granted in Entra. Add the write permissions you need and grant admin consent again.

***

### Need help?

Reach out to [Suptask Support](https://claude.ai/getting-started/contact-support.md) and our team will help you connect Microsoft Entra.