Who can use a connection?

Every integration editor includes Available globally in this tenant. It is selected by default, including for existing connections after upgrade. Global availability preserves existing behavior; users still need permission to open the relevant feature, edit or run the task, and perform the provider operation.

Clear the checkbox to restrict a connection to groups. Open a group's Manage membership → Integrations tab and link the connection. A caller must have an active membership in an active linked group. People and API service principals can be user members; a service principal also qualifies through its application's membership when the registered service-principal object ID matches the caller. Application ownership alone does not grant the owner's personal identity access.

Restricted connections with no active linked group are unavailable for use. Disabling a group or removing a membership revokes access through that group. Another active group can still provide access. Tenant administrators can always manage connections and group links; administration does not make a restricted connection available in ordinary task selectors.

Automation and unattended runs

Task selectors and directory lookups show connections available to the caller. Saving a step and starting a run also check access, including requests made through the customer API. Access is checked again before each integration step starts, so a saved task or an approval does not preserve revoked membership.

Interactive runs use the requesting person's or service principal's identity. Unattended runs use the execution identity recorded by the server when the task definition is saved. Before changing an existing connection to group-only, add that identity to a linked group. In Run configuration, choose Use my identity for scheduled runs to establish or replace the saved identity, including for older tasks. Runs without an eligible identity cannot use a restricted connection. Existing global connections continue to work.

Example: team-only TOPdesk and Entra

For certificate DNS integrations, the saved DNS credential's author must retain membership. TOPdesk event and application-request actions use the initiating identity. An event with no eligible identity cannot use a restricted connection. A mailbox used for tenant-wide system notifications must remain global; use a separate restricted mailbox for team automation.

Create a support group, add the support users and API service principal, link the TOPdesk and Entra integrations, and clear global availability on both connections. Eligible authors can select those connections in incident, change, and Entra directory steps. Grant access to the automation task separately. Provider credentials, directory consent, and provider permissions remain configured on the integration.

Service principals that have already registered through the customer API appear in the group member search with a service-principal label. Choosing an agent to execute a task does not replace the requesting user's integration permissions with the agent's group memberships.

For automation started by an event listener, integration access follows the listener's authorized author, matching the identity recorded on the run. Tenant backups preserve the saved scheduled execution identity; its group membership is still checked after restore.

Agent work is checked before integration credentials are sent and again when the agent claims the step. AgentIntegrationAccessDenied (7217) identifies a rejected agent step using the same tenant, actor, task run, and step run identifiers.

Server workers also check the connections in their loaded step before calling a provider. AutomationLoadedIntegrationAccessDenied (7218) reports denial if access changed or the loaded definition differs from the current task.

If a queued step fails after membership changes, review the run's requesting identity and the active group links. Operators can correlate AutomationIntegrationAccessDenied (7211) with the tenant, actor, task run, and step run IDs. EventIntegrationAccessDenied (8665) identifies rejected event actions. These logs contain identifiers, not integration credentials.

Self-service groups and shared connections

Users can create groups and manage their members. They can add or remove applications they also own. With the Integrations feature licensed, group owners can create AWS, Vercel, and GitHub.com integrations without administrator access.

Users can link enabled integrations they created through a group. Editing also requires ownership of a linked group. Administrators manage other providers, GitHub Enterprise Server, machine membership, and changes outside a group owner's permissions.

Allow application owners to create and link integrations applies to the older direct application setup. Group setup does not require this setting. Existing application-created connections keep their editing restrictions.

Groups

Why Integrations Matter

AZExecute is most useful when it can safely bridge cloud resources, on-premises agents, service-management systems, DNS providers, and deployment platforms. Tenant Integrations are the trust and discovery layer for that work.

Available Integration Areas

Cloud and Application Delivery

Agent-Based Enterprise Systems

Service Management and DNS Providers

Entra ID and Power Platform Workload Identities

Entra ID supports the AZExecute broker, a customer-owned broker, or a connected AZExecute agent. The preview Power Platform integration is simpler: use the read-only AZExecute broker or a connected AZExecute agent for read and write operations.

Follow the Entra ID Integration guide for agent selection, automatic or manual permission setup, and checking access.

Agent identity setup

TOPdesk Integration Usage

A TOPdesk integration can be reused across automation tasks, event listeners, and application request workflows. Configure the connection once, validate it, and then select it where a workflow needs to create, update, assign, close, cancel, archive, or classify TOPdesk records.

Agent-Based Integration Pattern

Several integrations intentionally run through an AZExecute agent instead of calling the target system directly from the web application. This is important for internal systems such as Active Directory, Windows DNS, SCOM, and network-restricted tooling.

Recommended Setup Order

Related Documentation