Identity
Microsoft 365 / Entra ID
Sync users and groups inbound from Entra ID via Microsoft Graph. Outbound provisioning/deprovisioning is a declared capability for platform-driven lifecycle events. Data residency follows the tenant's own Entra ID region configuration.
BidirectionalData residency: HYBRID
Request a demoWhat it does
- Inbound sync: users and groups pulled from Microsoft Graph (Entra ID stays the system of record for profile attributes)
- user.created / user.updated / user.deleted map to the platform's identity_user record
- group.updated maps to identity_group (membership changes)
- Outbound provisioning/deprovisioning of Entra ID accounts, declared for platform-driven lifecycle events (e.g. offboarding)
- The health check refuses to report healthy without a tenant ID, client ID, and a stored client secret — no false-green on missing credentials
Data residency
Microsoft 365 data spans regions per the tenant's own Entra ID configuration, which can include non-EU regions — declared hybrid rather than assumed EU.
Event mappings
| External event | Maps to | What happens |
|---|---|---|
| user.created | identity_user | New user provisioned in Entra ID |
| user.updated | identity_user | User profile or attributes changed in Entra ID |
| user.deleted | identity_user | User deactivated or deleted in Entra ID |
| group.updated | identity_group | Group membership changed in Entra ID |
What you configure
- Entra tenant ID
- App (client) ID
- Client secret (stored in the secrets vault, never in config)
OAuth scopes requested
- User.Read.All
- Group.Read.All
- Directory.Read.All
Setup overview
Connect via OAuth consent (User.Read.All, Group.Read.All, Directory.Read.All) and store the app's client secret. The health probe reports degraded until the tenant ID, client ID, and secret are all present.
Related features
See TENSOR running on your own estate.
30 minutes, screen-shared, no slides. Bring the process you are least sure we handle and we will start there.