ConductorOne provides identity governance and just-in-time provisioning for Entra ID. Integrate your Entra ID instance with ConductorOne to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.
The Entra ID connector supports automatic account provisioning and deprovisioning.When a new account is created by ConductorOne, the account’s password will be sent to a vault.*Due to limitations of the Microsoft Graph API, the connector cannot provision Mail Enabled Security groups or Distribution groups.
In Entra admin center, navigate to App registrations.
2
Click + New registration.
3
Give the application a name, such as “ConductorOne”, and select the supported account type relevant to your Entra installation. You do not need to set a redirect URL.
4
Click Register.
5
The new app is created. Carefully copy and save the Application (client) ID and the Directory (tenant) ID shown on the application summary page.
6
Next, we’ll generate a client secret for this app. Click Certificates & secrets.
7
Click + New client secret.
8
Give the client secret a description and set its expiration.
9
Click Add.
10
The client secret is generated. Carefully copy and save the Secret Value.
To deprovision users who have a privileged role assigned to them, the app requires, in addition to the stated permissions, a privileged role such as Global Administrator or Privileged Authentication Administrator.
4
Navigate to Identity > Applications > Enterprise applications > All applications.
5
Locate your new ConductorOne app.
If the app doesn’t appear in the list right away, wait a minute and click Refresh.
On the app’s page, click Permissions on the left side.
6
Click Grant admin consent for ….
That’s it! Next, move on to the connector configuration instructions.
To set up the connector to support provisioning members to exchange groups, which are distribution lists and mailed security groups, follow these steps:
Note:ovisioning users as owners of exchange groups is not supported; users can only be added as members.
1
In the Microsoft Entra Admin Center, navigate to App registrations and click the name of the app you created for this connector.
2
In the application dashboard, click API permissions > Add a permission.
3
Select APIs my organization uses. Search for and select “Office 365 Exchange Online” (the application ID is 00000002-0000-0ff1-ce00-000000000000).
4
Click on Application permissions. Search for and select “Exchange” and enable the Exchange.ManageAsApp permission.
5
Click Add permissions.
6
When prompted to grant admin consent, click Yes.
7
Next, grant global permissions. Navigate to Admin Center > Roles & admins.
8
Search for and select “Exchange Administrator”, then click Add assignments.
9
Click No member selected, then find the application used for this connector on the Enterprise applicationstab and click Select.
10
Click Next.
11
On the Settings tab, select **Active as the Assignment type.
12
Check Permanently assigned and add a justification, such as:Required to allow the ConductorOne connector to grant and revoke memberships for managed distribution lists and mail-enabled security groups, both managed by Exchange.
13
Click Assign.
That’s it! Your connector is now ready to allow the provisioning of users as members in exchange groups.
The Connector Administrator or Super Administrator role in ConductorOne
Access to the set of Entra ID credentials generated by following the instructions above
Cloud-hosted
OAuth
Self-hosted
Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.
1
In ConductorOne, navigate to Admin > Connectors and click Add connector.
2
Search for Entra ID and click Add.
3
Choose how to set up the new Entra ID connector:
Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app
4
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.
5
Click Next.
6
Find the Settings area of the page and click Edit.
7
Select Client secret.
8
Paste the tenant ID into the Entra tenant ID field.
9
Paste the client ID into the Entra client ID field.
10
Paste the client secret into the Entra client secret field.
11
Optional. Check the box if you want to Skip syncing Active Directory Server groups.
12
Optional If you connect to a Microsoft Graph API domain other than graph.microsoft.com, specify your domain in the Microsoft Graph domain field.
13
Optional. To capture Entra usage data, click to enable Fetch user sign-in activity.The usage data feature requires a Microsoft Entra ID P1 or P2 license. Usage data collection is not supported on Microsoft Entra ID Free licenses.
14
Optional. Click to opt into Schedule SCIM provisioning, which forces an Entra SCIM sync when a new entitlement is provisioned for a user in ConductorOne.
15
Optional. Click to Disable resource changed event feed. These logs are enabled by default.Make sure to disable this feed if the List directoryAudits API endpoint is not supported in your location.
16
Click Save.
17
The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.
That’s it! Your Entra ID connector is now pulling access data into ConductorOne.
Follow these instructions to set up a built-in, no-code connector hosted by ConductorOne using OAuth.
In ConductorOne, navigate to Admin > Connectors and click Add connector.
2
Search for Entra ID and click Add.
3
Choose how to set up the new Entra ID connector:
Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app
4
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.
5
Click Next.
6
Find the Settings area of the page and click Edit.
7
Select OAuth.
8
Specify the ID of the Entra tenant you’re integrating in the Entra tenant ID field.
9
Optional. Check the box if you want to Skip syncing Active Directory Server groups.
10
Optional If you connect to a Microsoft Graph API domain other than graph.microsoft.com, specify your domain in the Microsoft Graph domain field.
11
Optional. To capture Entra usage data, click to enable Fetch user sign-in activity.The usage data feature requires a Microsoft Entra ID P1 or P2 license. Usage data collection is not supported on Microsoft Entra ID Free licenses.
12
Optional. Click to opt into Schedule SCIM provisioning, which forces an Entra SCIM sync when a new entitlement is provisioned for a user in ConductorOne.
13
Click Login with OAuth.
14
Log in and authorize ConductorOne with your Entra ID instance.In order for the integration to work properly, you must consent to all permissions:
In the Entra ID control panel, go to Enterprise Applications.
2
Click the ConductorOne Integration app (not to be confused with the ConductorOne SSO app, which is used to log into ConductorOne, not to synchronize your data).If the ConductorOne Integration app doesn’t appear in the list of apps right away, wait a minute and click Refresh.
3
On the ConductorOne Integration page, click Permissions on the left side.
Follow these instructions to use the Entra ID connector, hosted and run in your own environment. Contact ConductorOne’s support team to download the latest version of the connector and get detailed setup instructions.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.
In ConductorOne, navigate to Connectors > Add connector.
2
Search for Baton and click Add.
3
Choose how to set up the new Entra ID connector:
Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app
4
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.
5
Click Next.
6
In the Settings area of the page, click Edit.
7
Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.
# baton-microsoft-entra-secrets.yamlapiVersion: v1kind: Secretmetadata: name: baton-microsoft-entra-secretstype: OpaquestringData: # ConductorOne credentials BATON_CLIENT_ID: <ConductorOne client ID> BATON_CLIENT_SECRET: <ConductorOne client secret> # Entra ID credentials BATON_ENTRA_CLIENT_ID: <Entra ID application (client) ID> BATON_ENTRA_CLIENT_SECRET: <Entra ID client secret> BATON_ENTRA_TENANT_ID: <Entra ID directory (tenant) ID> # Optional: include if you want ConductorOne to provision access using this connector BATON_PROVISIONING: true # Optional: include if you want to skip syncing Active Directory Server groups BATON_SKIP_AD_GROUPS: true # Optional: include if you want to connect to a domain other than graph.microsoft.com BATON_GRAPH_DOMAIN: <Microsoft Graph API domain> # Optional: include if you want to disable audit logs BATON_ENABLE_AUDIT_LOG_FEED: false
See the connector’s README or run --help to see all available configuration flags and environment variables.
Create a namespace in which to run ConductorOne connectors (if desired), then apply the secret config and deployment config files.
2
Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Entra ID connector to. Entra ID data should be found on the Entitlements and Accounts tabs.
That’s it! Your Entra ID connector is now pulling access data into ConductorOne.
If Entra ID is your company’s identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in ConductorOne for all of your SCIMed software. Before you move on, review the Create applications page for important information about how to set up integrations with the SCIMed apps.
