How to use Microsoft Entra ID

Let users sign in to Struct with their Microsoft Entra ID account, and control what access they get from the Entra groups they are in.

Struct PIM can let people sign in with their existing Microsoft Entra ID account, and can decide what they may do in Struct from the Entra groups they are in.

This guide is written for the administrator of the Microsoft Entra ID directory, and for the Struct consultant working alongside them. It assumes you know your own Microsoft tenant, and does not require any prior knowledge about Struct.

What this integration does

Three things it gives you:

Sign-in with a Microsoft account. People reach Struct with the account they already have, rather than a separate Struct password.

Access granted from group membership. You map an Entra group to a set of Struct roles and user groups. Anyone in that group gets them when they sign in.

Access removed the same way. Take someone out of the mapped group in Entra, and Struct removes what that mapping gave them at their next sign-in.

How the integration reads your directory

Struct reads group membership from the sign-in token that Entra issues. It never queries your directory and holds no credentials or API permissions against it. That keeps the integration simple and read-only from your side, and it means a change you make in Entra reaches Struct the next time the user signs in, not immediately.

Microsoft changes the layout of the Entra admin center from time to time. If a menu item is not where this guide says, search for it by name at the top of the portal.

What you need before you start

Three things, and two of them are identifiers you copy out of the Microsoft Entra admin center.

• The Tenant ID of the Entra directory whose users should reach Struct. How to find the IDs in Entra ID shows where to find it.

• The Object ID of each Entra group that should grant access. How to find the IDs in Entra ID shows where to find it.

• A Struct user with permission to manage Entra ID connections, on a subscription that includes Entra ID federation. If the Microsoft Entra ID page is not in your Struct settings, this is why. Contact your account manager.

Nothing else is required from your side.

You do not need to create an app registration, issue a client secret or certificate, or grant admin consent to any permission. Struct asks for no access to your directory beyond what the user's own sign-in already carries.

What this does not do

These are the questions people ask, so they are worth stating plainly.

• It does not create users in Entra, or write anything back to your directory.

• It does not read your directory through Microsoft Graph, so it cannot see group membership until a user signs in.

• It does not manage licences or sign-in policy. MFA, conditional access and password rules stay entirely yours.

• It does not replace invitations unless you turn the membership policy on. Invited users and Entra users can coexist.

In this guide

How to set up an Entra ID connectionHow to find the IDs in Entra IDExample of an Entra ID setupGood to know about Entra IDTroubleshooting Entra ID