/
Entra ID (formerly Azure AD)

Entra ID (formerly Azure AD)

The Entra ID (formerly Azure AD) connector allows OnLink to connect to your Microsoft Entra tenant and manage users and application provisioning. After the connection is configured, OnLink can create users, deactivate users, and provision apps for users.

Overview

Use the steps below to register an application in Microsoft Entra ID, assign the required Microsoft Graph application permissions, create a client secret, and collect the values needed to complete the OnLink connection.

Prerequisites

  • Access to the Azure portal.

  • Permission to create or manage app registrations in Microsoft Entra ID.

  • An Entra administrator who can grant admin consent for Microsoft Graph application permissions.

Required connection values

Before configuring the OnLink connector, you will need the following values from the app registration:

  1. Directory (tenant) ID

  2. Client ID

  3. Client Secret

Follow the steps below to create these values. For additional Microsoft guidance, see Microsoft Graph authentication documentation.

Step 1: Register an application in Entra ID

  1. Go to the Azure portal and sign in.

  2. In the left navigation, open Microsoft Entra ID.

  3. Select App registrations.

  4. Click New registration.

  5. Enter a clear application name, for example OnLink Connection.

  6. Keep the default supported account type unless your organization requires a different option.

  7. Click Register.

  8. On the application Overview page, copy the Directory (tenant) ID and Application (client) ID. You will use these values when configuring the OnLink connection.

Step 2: Configure Microsoft Graph permissions

After the application registration is created, configure Microsoft Graph application permissions so OnLink can perform the required user and application provisioning actions.

  1. In the app registration, select API permissions from the left navigation.

  2. Click Add a permission.

  3. Select Microsoft Graph.

  4. Choose Application permissions, not delegated permissions.

  5. In Select permissions, search for and select the following permissions:

    • User.Read.All

    • Group.Read.All

    • Organization.Read.All

    • Application.Read.All

    • Directory.Read.All

    • DeviceManagementApps.Read.All — required for Microsoft Intune app management.

    • DeviceManagementManagedDevices.Read.All — required for Microsoft Intune managed device operations.

    • Read permission is sufficient to import data to Assets.

    • Write Permission is required for User and Group if you need to make user and group changes through actions in Workflow.

  6. Click Add permissions.

  1. Click Grant admin consent. If you do not have administrator access, ask an Entra administrator to complete this step.

Step 3: Create a client secret

Create a client secret for the app registration. This value is used by OnLink to authenticate with Microsoft Graph.

  1. In the app registration, select Certificates & secrets from the left navigation.

  2. Click New client secret.

  3. Enter a description that identifies the secret, for example OnLink connection.

  4. Select an expiration period that follows your organization’s security policy.

  5. Click Add.

  6. Immediately copy the client secret Value and store it securely.

The value is only shown once. If you lose it, you must create a new client secret.

Final checklist: values needed for the OnLink connection

Tenant ID: Copy the Directory (tenant) ID from the app registration Overview page.
Client ID: Copy the Application (client) ID from the app registration Overview page. This is the Client ID used in OnLink.
Client Secret: Copy the client secret Value immediately after creating it under Certificates & secrets.
Admin consent granted: Confirm an administrator has granted consent for all required Microsoft Graph application permissions.