---
title: "How To Connect Entra ID"
canonical: "https://ai-docs.certero.com/space/CXSM/108299867/How%20To%20Connect%20Entra%20ID"
format: markdown
---
---

# Overview

To create a connector for Entra ID in Certero you will need a Client ID, a Client Secret, and an Entra App Registration with the right permissions.

The Certero connector for Entra ID uses the Microsoft Graph APIs to connect to and retrieve data from Entra ID. The APIs use industry standard OAuth 2.0 protocols for authentication and authorization.

- [OAuth 2.0 and OpenID Connect protocols on the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols)

In order to create a connector for Microsoft Entra in the Certero, there are several details you will need to enter. These are:

- Client Id
- Client Secret

The aim of this document is to show the user how to prepare to create these values so they are ready for use when the Certero Microsoft Entra connector is created.

---

# Entra Configuration

## Create the App Registration

1. Log into the Entra Admin Centre by clicking [Microsoft Entra admin center](https://entra.microsoft.com/)
2. In the portal home page search for '**App Registration**'.
3. Click on the **'App Registrations**' link shown.
4. Click** + New registration**.
5. Give the application a meaningful name and select which account types are to be supported (by default Single tenant will be selected):
6. Click **Register** at the bottom of the form to register the application.

> ๐Ÿ“ You can return to the app at any time via App registrations in the menu blade, or by searching for "App registrations" in the main search bar. Clicking the app name reopens the Overview.

# Obtaining a Client ID and Secret from an App

1. Once your app is registered you will automatically be taken to the App registration screen. The top of this screen will show your **Application (client) ID**.  
  
This is the value we will use in our connector, make a note of it:
2. From the App Registration screen, click the **Client credentials** hyperlink shown below:
3. The Certificates and Secrets section should be displayed:
4. Click **+ New client secret.**
5. Enter a description. Select when the secret should expire and click **Add**:
6. Your new Client Value and Secret ID will be displayed. Note down the **Client Value**, this forms your โ€˜Client Secretโ€™ for the Entra Connector.

> โš ๏ธ IMPORTANT: Copy the secret's **Value** immediately and store it securely. This is the only time it is shown. Once you navigate away from the page you cannot retrieve it, and you will have to delete the secret and create a new one.

> ๐Ÿ“ Make a note of when the secret expires โ€” the connector will stop collecting data once it does, and a new secret will need to be created and entered in CerteroX.

---

## Adding API Permissions

1. Navigate to the app created in the step above and click **API permissions** from the menu.
2. Click **Add a permission.**
3. Select **Microsoft Graph.**
4. Add the following permissions:
  - AuditLog.Read.All
  - Directory.Read.All
  - Group.Read.All
  - GroupMember.Read.All
  - Reports.Read.All
  - User.Read.All
5. You will also need to grant admin consent. Click the **Grant admin consent** button and click **Yes** when prompted.
6. The resulting permissions should look like what is shown below.

> โ„น๏ธ Nothing beyond the permissions mentioned is required. No write permissions are used, and the default delegated **User.Read** that Entra adds to every new App Registration is not used โ€” it can be removed if your organization requires it.

---

# Connect to CerteroX

With the App Registration in place, the connection can now be created in CerteroX.

1. Go to CerteroX SaaS Management โ†’ **Settings **โ†’ **Identity & Connectors**.
  
2. Click **Add a new connection**.
  
3. In the modal window that appears, select **Entra ID**.
  
4. Enter the App Registration details gathered in the [Entra Configuration](https://certero.atlassian.net/wiki/spaces/CXSM/pages/108299867/How+To+Connect+Entra+ID#Entra-Configuration) steps above โ€” a Name for the connection, along with the Tenant ID, Client ID and Client Secret
5. Press โ€˜**Validate Connection**' to confirm a successful connection.
6. Press โ€˜**Create & Continue**โ€™ to add the Entra Connector.