Microsoft Entra ID connector for identity
Microsoft Entra ID is the identity backbone of the Demiton platform. Beyond authentication (handled natively via OIDC), the Entra ID adapter enables workflows to read directory data, manage group membership, and write identity attributes as part of workforce lifecycle automation.
Authentication: OAuth 2.0 via service principal (Microsoft Graph)
System type: ENTRA_ID
Protocol: Microsoft Graph API v1
API reference: Microsoft Graph - Identity
See your Entra ID users and groups in Claude — book a 30-minute call.
Supported resources
Section titled “Supported resources”| Resource | FETCH | PUSH | LOOKUP | EXECUTE | License |
|---|---|---|---|---|---|
users | ✓ Yes | — No | ✓ Yes | — No | Free |
groups | ✓ Yes | — No | ✓ Yes | — No | Free |
group_members | ✓ Yes | — No | — No | — No | Free |
group_membership | ✓ Yes | ✓ Yes | — No | — No | Free |
user_clearance | — No | — No | ✓ Yes | — No | Free |
security_groups | ✓ Yes | — No | — No | ✓ Yes | Free |
directory_role_assignments | ✓ Yes | — No | — No | — No | Free |
service_principals | ✓ Yes | — No | — No | — No | Free |
signin_logs | ✓ Yes | — No | — No | — No | P1 |
mfa_registration | ✓ Yes | — No | — No | — No | P1 |
risky_users | ✓ Yes | — No | — No | — No | P2 |
PUSH on group_membership adds or removes members in batch. LOOKUP on user_clearance resolves a user’s transitive group memberships. EXECUTE on security_groups supports create_group, add_member, and remove_member commands.
signin_logs, mfa_registration, and risky_users are used for security audit workflows. Resources marked P1/P2 return an empty dataset (not an error) on tenants without the required Entra ID licence - the audit report will note the gap rather than failing.
Registers this connector fills
Microsoft Entra ID keeps 2 registers current in Civil Memory. Each name is the record you ask for, not the system it came from - ask for it in Studio or from your own AI client.
| Register | What it holds | Fields from Microsoft Entra ID |
|---|---|---|
Group membersgroup_members | Members of each group in your identity directory. | Fills all of 10 |
User listuser_list | Users in your identity directory and operational systems. | Fills all of 13 |
The full field list, requiredness and an example record for any register are on its published contract. Where more than one system fills a register, the register is the same shape either way.
Integration model
Section titled “Integration model”Used in two contexts:
Access resolution - Demiton reads Entra user attributes and group memberships at query time to determine what data each user is authorised to see. This happens automatically for every platform interaction.
Workforce lifecycle workflows - When a new hire is created in KeyPay, Demiton can add them to the Entra security groups their role requires, and on termination it removes them. Group membership is the write the adapter actually performs: add_member_to_group, remove_member_from_group, create_group and their batch forms. Demiton does not create Entra user accounts and does not write accountEnabled - accounts and their enabled state remain owned by Entra. The writer also defines an HR-attribute update covering department, jobTitle, city, employeeType, employeeId and manager, which has no live caller today.
Connection setup
Section titled “Connection setup”Required values:
- Tenant ID
- Client ID - Entra app registration
- Client Secret
The Entra ID connector is typically configured during platform onboarding by your Customer Success Manager.
Required Graph permissions
Section titled “Required Graph permissions”Grant these on the app registration used by the Demiton service principal. All permissions are application type (not delegated).
| Permission | Purpose | Minimum licence |
|---|---|---|
User.Read.All | Directory user reads | Free |
Group.Read.All | Directory group reads | Free |
RoleManagement.Read.Directory | Directory role assignments | Free |
Application.Read.All | Service principals & enterprise apps | Free |
GroupMember.ReadWrite.All | Group membership write-back workflows | Free |
User.ReadWrite.All | HR attribute write-back workflows | Free |
AuditLog.Read.All | Sign-in logs and MFA registration reports | P1 |
UserAuthenticationMethod.Read.All | MFA registration details per user | P1 |
IdentityRiskyUser.Read.All | Identity Protection risky user data | P2 |
Minimum for read-only directory access: User.Read.All, Group.Read.All
For security audit workflows: additionally RoleManagement.Read.Directory, Application.Read.All, and the P1/P2 permissions above depending on your licence
For workforce lifecycle write-back: additionally User.ReadWrite.All, GroupMember.ReadWrite.All
To grant consent: open Entra admin centre → App registrations → [your app] → API permissions → Add permission → Microsoft Graph → Application permissions, add each permission, then Grant admin consent.
Security
Section titled “Security”Access type: Read and scoped write
Demiton reads identity attributes and group memberships to enforce access controls. Writes are strictly scoped to security-group membership (add and remove members, and create groups) and an HR-attribute update for HR-owned profile fields (department, jobTitle, city, employeeType, employeeId, manager). Demiton does not create Entra user accounts and does not write the accountEnabled flag.
What Demiton never writes: Application role assignments, conditional access policies, or any other Entra surface outside of HR attributes and explicitly configured group-management workflows.
Next steps
Section titled “Next steps”- Connecting a System - step-by-step wizard for setting up the connector
- Security Overview - how Demiton uses Entra identity for access control across all connectors
- Business Central - ERP connector that also uses Entra for service principal authentication
- Connect your operation - talk to us about scoping a Connected deployment
Talk to the team
Tell us what you run - your ERP, field, payroll and document systems - and we will show you the registers Demiton would keep current from them, on your data, in a 30-minute call.