> For the complete documentation index, see [llms.txt](https://docs.userlane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.userlane.com/administration/attributes/connect-microsoft-entra-id.md).
# Connect Microsoft Entra ID
How to connect Microsoft Entra ID as an attribute source, including the permissions needed, setup steps, and the values to enter in Userlane.
This page walks through connecting Microsoft Entra ID so that Userlane can read employee information from your directory automatically. By the end, Entra ID appears as a connected attribute source and your user data begins syncing.
Entra ID is worth connecting first if you are not sure which source to use. Because almost everyone in your organization signs in through it, it usually reaches more people than any single HR system or CRM.
{% hint style="warning" %}
**Prerequisites.** You need an account that can create an app registration (by default any directory member, or the **Application Developer** role). A **Global Administrator** or **Privileged Role Administrator** must approve the permissions. On the Userlane side, you need an **Admin**, **Portfolio Owner**, or **Deployment Manager** role. Before starting, ask your Userlane contact for the redirect address for Microsoft Entra ID.
{% endhint %}
## What Userlane reads from Entra ID
Userlane matches Entra ID against its standard set of attributes, the same set it uses for every source. See [Connect an attribute source](/administration/attributes/connect-an-attribute-source.md) for the full list.
Three things follow from that:
* Anything Entra ID holds that is not in Userlane's set is dropped rather than stored, including any custom extension attributes.
* Anything in Userlane's set that Entra ID does not hold, or does not fill in, stays empty.
* Attributes are applied to people who already exist in Userlane. Someone in your directory who has never used Userlane is ignored, not created.
The connection is read-only. Userlane never writes to your directory and never changes anything in it.
{% hint style="info" %}
**Broad coverage, thinner detail.** Entra ID tells you who works at your organization very reliably, because everybody has a sign-in account. It is less reliable on what they do, since job title and department are optional fields an administrator has to maintain. If those are patchy in your directory, connecting an HR system alongside will give better results. Worth checking a few user profiles before connecting.
{% endhint %}
## Who you need
Two steps, and they can involve two different people.
**To register the application:** an account that can create an app registration. By default any member of the directory can do this. Organizations that restrict it usually grant the **Application Developer** role for the purpose.
**To approve the permissions:** a **Global Administrator** or a **Privileged Role Administrator**.
{% hint style="warning" %}
**The approval step is the one to plan for, and there is no way around it.** Microsoft only allows those two roles to grant tenant-wide consent for the kind of permission Userlane needs. Application Administrator and Cloud Application Administrator can approve permissions for other services but are specifically excluded from this one. Unlike Salesforce or Jira, there is no lesser permission an administrator can grant to an ordinary account instead. If your organization guards those roles closely, raise this on day one rather than when you are ready to connect.
{% endhint %}
## Register the application
{% stepper %}
{% step %}
#### Open app registrations
In the Microsoft Entra admin center, go to app registrations and create a new registration. Give it a name you will recognize later, for example "Userlane attribute sync."
{% endstep %}
{% step %}
#### Add the redirect address
Add the redirect address your Userlane contact gave you.
{% endstep %}
{% step %}
#### Add Graph permissions
Add the Microsoft Graph permissions needed to read user profiles.
{% endstep %}
{% step %}
#### Grant admin consent
Have a Global Administrator or Privileged Role Administrator grant consent for those permissions. Without this step the connection fails even though the registration looks complete.
{% endstep %}
{% step %}
#### Create a client secret
Create a client secret and copy the value immediately. Microsoft only shows it once.
{% endstep %}
{% endstepper %}
## Find the values Userlane asks for
Userlane asks for
In Entra ID this is
Application ID
Application (client) ID, on the registration overview
Client secret
The secret value you copied when creating it (not the secret ID)
Tenant ID
Directory (tenant) ID, on the same overview page
{% hint style="warning" %}
**Two fields that look alike.** Use the Application (client) ID, not the Application ID URI. And use the secret value, not the secret ID. Both pairs sit close together in the console and both are easy to copy by mistake.
{% endhint %}
Client secrets in Entra ID expire. Note the expiry date when you create it, because when it lapses your information will quietly stop updating rather than showing an error.
## Connect in Userlane
{% stepper %}
{% step %}
#### Open Attribute sources
In the Userlane portal, go to **Attribute sources** under company settings.
{% endstep %}
{% step %}
#### Select Microsoft Entra ID and enter the values
Select Microsoft Entra ID and enter the application ID, client secret, and tenant ID.
{% endstep %}
{% step %}
#### Complete the sign-in
Complete the Microsoft sign-in when prompted.
{% endstep %}
{% endstepper %}
{% hint style="success" %}
**Expected result.** Microsoft Entra ID appears under connected sources. The first update usually arrives within about fifteen minutes. After that, Userlane refreshes overnight once a day. See [Connect an attribute source](/administration/attributes/connect-an-attribute-source.md) for troubleshooting.
{% endhint %}
## Related articles
Related articles: TBA
## Frequently asked questions
Do I need a Global Administrator to connect?
A Global Administrator or Privileged Role Administrator is needed for one step: granting tenant-wide consent for the Graph permissions. The app registration itself can be done by any directory member or Application Developer. There is no way to delegate the consent step to a lesser role.
What happens when the client secret expires?
Userlane quietly stops receiving updates. No error appears. Create a new secret in the Entra admin center, enter it in Userlane, and the connection resumes.
Does Userlane write anything back to the directory?
No. The connection is read-only. Userlane never creates, updates, or deletes anything in your Microsoft directory.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.userlane.com/administration/attributes/connect-microsoft-entra-id.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.