Capabilities

Available hosting methods

Choose the hosting method that best suits your needs:

Gather Entra ID credentials

Each setup method requires you to pass in credentials generated in Entra ID. Gather these credentials before you move on.

If you prefer to set up a cloud-hosted Entra ID connector using OAuth, skip ahead to the instructions in [link]

A user with the Global Administrator permission in Entra ID must perform this task.

Create a new Entra application

1. In Entra admin center, navigate to App registrations.

2. Click + New registration.

3. Give the application a name, such as “ConductorOne,” and select the supported account type relevant to your Entra installation. You do not need to set a redirect URL.

4. Click Register.

5. The new app is created. Carefully copy and save the Application (client) ID and the Directory (tenant) ID shown on the application summary page.

6. Next, we’ll generate a client secret for this app. Click Certificates & secrets.

7. Click + New client secret.

8. Give the client secret a description and set its expiration.

9. Click Add.

10. The client secret is generated. Carefully copy and save the Secret ID.

Give the new Entra app API permissions

1. Click API permissions.

2. Click + Add permissions > Microsoft Graph.

3. Click Application permissions. Select each permission in the relevant set below:

   To sync access data:

   Application.Read.All
   AppRoleAssignment.ReadWrite.All
   AuditLog.Read.All
   Directory.Read.All
   Group.Read.All
   GroupMember.Read.All
   MailboxSettings.Read
   RoleAssignmentSchedule.Read.Directory
   RoleEligibilitySchedule.Read.Directory
   RoleManagement.Read.All
   RoleManagement.Read.Directory
   RoleManagementAlert.Read.Directory
   RoleManagementPolicy.Read.AzureADGroup
   RoleManagementPolicy.Read.Directory
   ServicePrincipalEndpoint.Read.All
   User.Read.All
   User.ReadBasic.All
   

   To sync access data and provision access:

   Application.ReadWrite.All
   AppRoleAssignment.ReadWrite.All
   AuditLog.Read.All
   Directory.ReadWrite.All
   Group.ReadWrite.All
   GroupMember.ReadWrite.All
   MailboxSettings.ReadWrite
   RoleAssignmentSchedule.Read.Directory
   RoleEligibilitySchedule.Read.Directory
   RoleManagement.Read.All
   RoleManagement.Read.Directory
   RoleManagementAlert.Read.Directory
   RoleManagementPolicy.Read.AzureADGroup
   RoleManagementPolicy.Read.Directory
   ServicePrincipalEndpoint.ReadWrite.All
   User.ReadWrite.All
   User.ReadBasic.All
   

That’s it! Next, move on to the instructions for your chosen setup method.

Set up an Entra ID cloud-hosted connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne
• Access to the set of Entra ID credentials generated by following the instructions above

1. In ConductorOne, click Connectors > Add connector.

2. Search for Entra ID and click Add.

3. Choose how to set up the new Entra ID connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Select Client secret.

8. Paste the tenant ID you saved in Step 1 into the Entra tenant ID field.

9. Paste the client ID you generated in Step 1 into the Entra client ID field.

10. Paste the client secret you generated in Step 1 into the Entra client ID field.

11. Optional. Check the box if you want to Skip syncing Active Directory Server groups.

12. Click Save.

13. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Entra ID connector is now pulling access data into ConductorOne.

Set up an Entra ID cloud-hosted connector using OAuth

A user with the Connector Administrator or Super Administrator role in ConductorOne and the Global Administrator permission in Entra ID must perform this task.

Step 1: Log in with OAuth

1. In ConductorOne, click Connectors > Add connector.

2. Search for Entra ID and click Add.

3. Choose how to set up the new Entra ID connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Select OAuth.

8. Optional. If necessary, specify the ID of the Entra tenant you’re integrating in the Entra tenant ID field. (It’s most common to leave this blank.)

9. Optional. Check the box if you want to Skip syncing Active Directory Server groups.

10. Click Login with OAuth.

11. Log in and authorize ConductorOne with your Entra ID instance.

    In order for the integration to work properly, you must consent to all permissions:

    

Step 2: Grant permissions to the ConductorOne app

1. In the Entra ID control panel, go to Enterprise Applications.

   

2. Click the ConductorOne Integration app (not to be confused with the ConductorOne SSO app, which is used to log into ConductorOne, not to synchronize your data).

   If the ConductorOne Integration app doesn’t appear in the list of apps right away, wait a minute and click Refresh.

3. On the ConductorOne Integration page, click Permissions on the left side.

   

4. Click Grant admin consent for … on the ConductorOne Integration app permissions page.

   

Step 3: Complete the integration

1. Return to the Entra ID connector setup page in ConductorOne.

2. Click Login with OAuth a second time to complete the process and authorize ConductorOne to obtain an access token with the permissions you’ve just granted.

That’s it! Your Entra ID connector is now pulling access data into ConductorOne.

Set up an Entra ID cloud-hosted connector using Terraform

As an alternative to the cloud-hosted setup process described above, you can use Terraform to configure the integration between Entra ID and ConductorOne.

See the ConductorOne Entra ID integration resource page in the ConductorOne Terraform registry for example usage and the full list of required and optional parameters.

Set up an Entra ID self-hosted connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne
• Access to the set of Entra ID credentials generated by following the instructions above

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.

Why use Kubernetes? Kubernetes provides automated deployment, scaling, and management of your connectors. It ensures high availability and reliable operation of your connector services.

Step 1: Configure the Entra ID connector

1. In ConductorOne, navigate to Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Entra ID connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Entra ID connector deployment:

Secrets configuration

# baton-microsoft-entra-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-microsoft-entra-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Entra ID credentials
  BATON_ENTRA_CLIENT_ID: <Entra ID application (client) ID>
  BATON_ENTRA_CLIENT_SECRET: <Entra ID client secret>
  BATON_ENTRA_TENANT_ID: <Entra ID directory (tenant) ID>

  # Optional: include if you want ConductorOne to provision access using this connector
  BATON_PROVISIONING: true

  # Optional: include if you want to skip syncing Active Directory Server groups
  BATON_SKIP_AD_GROUPS: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-microsoft-entra.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-microsoft-entra
  labels:
    app: baton-microsoft-entra
spec:
  selector:
    matchLabels:
      app: baton-microsoft-entra
  template:
    metadata:
      labels:
        app: baton-microsoft-entra
        baton: true
        baton-app: microsoft-entra
    spec:
      containers:
      - name: baton-microsoft-entra
        image: ghcr.io/conductorone/baton-microsoft-entra:latest
        args: ["service"]
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: baton-microsoft-entra-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run ConductorOne connectors (if desired):

   kubectl create namespace baton-microsoft-entra
   

2. Apply the secret configuration:

   kubectl -n baton-microsoft-entra apply -f baton-microsoft-entra-secrets.yaml
   

3. Apply the deployment:

   kubectl -n baton-microsoft-entra apply -f baton-microsoft-entra.yaml
   

Step 4: Verify the deployment

1. Check that the deployment is running:

   kubectl -n c1 get pods
   

2. View the connector logs:

   kubectl -n c1 logs -l app=baton-${baton-microsoft-entra}
   

3. Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Entra ID connector to. Entra ID data should be found on the Entitlements and Accounts tabs.

That’s it! Your Entra ID connector is now pulling access data into ConductorOne.

What’s next?

If Entra ID is your company’s identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in ConductorOne for all of your SCIMed software. Before you move on, review the Create applications page for important information about how to set up integrations with the SCIMed apps.