Entra ID Integration
Connect your Microsoft Entra directory to user and group lookups and automation task steps. Choose how AZExecute accesses your directory, grant the permissions your workflows need, and check access before use.
Open Admin Settings → Integrations → Entra ID to configure access.
Choose how to connect
| Option | Read access | Write access |
|---|---|---|
| AZExecute Broker | User and group lookups and read operations | Not supported |
| Agent identity | Available with the required permissions | Available with the required permissions |
| Customer Broker | Determined by your application's permissions | Determined by your application's permissions |
With Agent identity, the agent you select performs Entra lookups and Entra task steps using its managed identity. You control that identity's directory permissions. Keep the selected agent connected whenever people use directory lookups or workflows run.
Set up your agent
Use an AZExecute agent in your tenant with a working managed identity, a live connection, and network access to Microsoft Graph. Sign in to AZExecute with permission to manage tenant integrations.
1. Open the Entra ID integration and choose Agent identity.
2. Search the AZExecute agent field and select the machine you want to use. Confirm it is connected; use Refresh if needed.
3. Leave User-assigned managed identity client ID blank to use the host's system-assigned identity. On an Azure VM, you may instead enter the client ID of a user-assigned identity already available to that VM.
4. Save the integration, then choose Automatic or Manual permission setup below. If permissions are already assigned, go straight to Check.
Automatic permission setup
The Automatic tab has two separate actions:
1. Authorize setup adds the delegated permission AppRoleAssignment.ReadWrite.All to the AZExecute enterprise application in your tenant. This allows AZExecute to grant permissions on your behalf. It does not assign permissions to your agent.
2. Grant permissions to agent assigns the actual Microsoft Graph application permissions to the selected agent's managed identity. Review the target identity and permissions, then confirm the grant.
Use an administrator with an active role that can grant Microsoft Graph application permissions, such as Privileged Role Administrator. If your organization uses PIM, select Open PIM, activate the role in Azure, return to AZExecute, and retry the grant.
A successful authorization means you can proceed to the grant action; it does not mean the agent is ready. You do not need a successful read check before granting missing permissions. After the grant, press Check.
Manual permission setup
AZExecute setup authorization is optional. Permissions assigned by your administrators or existing tooling are accepted too.
1. Open the Manual tab. Where identity selection is needed, search managed identities by name or client ID and select the identity belonging to your chosen agent. You can also paste its object ID from Entra.
2. Review the PowerShell shown on the page. It is populated with your tenant and identity details. Choose Copy PowerShell and run it using an administrator account authorized to grant the permissions.
3. Complete any sign-in and consent requested by Microsoft Graph PowerShell. This is separate from authorizing AZExecute setup. The script adds missing permissions and keeps existing grants.
4. Return to AZExecute and press Check when the agent is connected.
If directory search is unavailable, use the object-ID field. Manually assigning permissions does not require the agent to be online, but checking access and running Entra operations do.
Permissions and check results
The setup helper offers User.Read.All, Group.Read.All, User.ReadWrite.All, Group.ReadWrite.All, GroupMember.ReadWrite.All, and User.EnableDisableAccount.All. These support user and group reads, changes to users and groups, group membership changes, and enabling or disabling user accounts. Review them against your intended workflows; administrators using manual setup can grant only the access they need.
Check verifies the connection and reports available permissions. Read access is tested live. Write permissions are checked without changing directory data. Review each permission chip rather than assuming every operation is available because a read check succeeds.
• Green: access is available; read permissions show Verified after a successful read check.
• Red: a permission is missing or a read check failed. Review the chip detail and the page message.
• Gray: access has not been verified. Connect the agent and run Check.
• Amber / Awaiting token: the grant is recorded, but the agent is not yet using the updated permissions. Wait and check again.
New managed-identity permissions can take up to 24 hours to become effective because Azure caches tokens. An assignment confirmation and a successful access check are separate results.
Some operations on privileged users, role-assignable groups, or non-user group members need additional Microsoft Entra permissions or roles. A permission check is not a guarantee that every target can be changed.
Use the integration
Use Entra Users and Entra Groups custom parameters to let people find directory objects. Configure Entra task steps to read or change those objects. With Agent identity selected, these Entra operations use the agent configured in your integration and the permissions granted to its managed identity.
Try the intended operation with an appropriate test object before relying on it in production. Review execution history after task runs, and run Check again after changing the selected agent, managed identity, or permissions.
If something is not ready
• Agent offline: restore its live connection and refresh the agent list. Lookups and executions need the selected agent to be available.
• Authorization completed, but permissions missing: return to Automatic and select Grant permissions to agent, or finish manual assignment.
• Insufficient privileges: verify the administrator's active role, use Open PIM if needed, and retry.
• Writes unavailable: confirm you are using Agent identity or Customer Broker and that its write permissions are effective. The AZExecute Broker supports reads only.