> For the complete documentation index, see [llms.txt](https://docs.struct.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.struct.com/tutorials/guides/how-to-use-microsoft-entra-id.md). # How to use Microsoft Entra ID Let users sign in to Struct with their Microsoft Entra ID account, and control what access they get from the Entra groups they are in. Struct PIM can let people sign in with their existing Microsoft Entra ID account, and can decide what they may do in Struct from the Entra groups they are in. This guide is written for the administrator of the Microsoft Entra ID directory, and for the Struct consultant working alongside them. It assumes you know your own Microsoft tenant, and does not require any prior knowledge about Struct. ## What this integration does Three things it gives you: **Sign-in with a Microsoft account.** People reach Struct with the account they already have, rather than a separate Struct password. **Access granted from group membership.** You map an Entra group to a set of Struct roles and user groups. Anyone in that group gets them when they sign in. **Access removed the same way.** Take someone out of the mapped group in Entra, and Struct removes what that mapping gave them at their next sign-in. ### How the integration reads your directory Struct reads group membership from the sign-in token that Entra issues. It never queries your directory and holds no credentials or API permissions against it. That keeps the integration simple and read-only from your side, and it means a change you make in Entra reaches Struct **the next time the user signs in**, not immediately. {% hint style="info" %} Microsoft changes the layout of the Entra admin center from time to time. If a menu item is not where this guide says, search for it by name at the top of the portal. {% endhint %} ## What you need before you start Three things, and two of them are identifiers you copy out of the Microsoft Entra admin center. * The **Tenant ID** of the Entra directory whose users should reach Struct. [How to find the IDs in Entra ID](/tutorials/guides/how-to-use-microsoft-entra-id/how-to-find-the-ids-in-entra-id.md#tenant-id) shows where to find it. * The **Object ID** of each Entra group that should grant access. [How to find the IDs in Entra ID](/tutorials/guides/how-to-use-microsoft-entra-id/how-to-find-the-ids-in-entra-id.md#group-object-id) shows where to find it. * A Struct user with permission to manage Entra ID connections, on a subscription that includes Entra ID federation. If the **Microsoft Entra ID** page is not in your Struct settings, this is why. Contact your account manager. Nothing else is required from your side. {% hint style="info" %} You do not need to create an app registration, issue a client secret or certificate, or grant admin consent to any permission. Struct asks for no access to your directory beyond what the user's own sign-in already carries. {% endhint %} ## What this does not do These are the questions people ask, so they are worth stating plainly. * It does not create users in Entra, or write anything back to your directory. * It does not read your directory through Microsoft Graph, so it cannot see group membership until a user signs in. * It does not manage licences or sign-in policy. MFA, conditional access and password rules stay entirely yours. * It does not replace invitations unless you turn the membership policy on. Invited users and Entra users can coexist. ## In this guide {% content-ref url="/pages/7iKfIq3WezXBFHNqrQNp" %} [How to set up an Entra ID connection](/tutorials/guides/how-to-use-microsoft-entra-id/how-to-set-up-an-entra-id-connection.md) {% endcontent-ref %} {% content-ref url="/pages/5cxpj4orbx5llDkIg6kk" %} [How to find the IDs in Entra ID](/tutorials/guides/how-to-use-microsoft-entra-id/how-to-find-the-ids-in-entra-id.md) {% endcontent-ref %} {% content-ref url="/pages/D31EUeLZFsMd5AaAPjxo" %} [Example of an Entra ID setup](/tutorials/guides/how-to-use-microsoft-entra-id/example-of-an-entra-id-setup.md) {% endcontent-ref %} {% content-ref url="/pages/51Qg3Et70tDjJ6Xu4rs1" %} [Good to know about Entra ID](/tutorials/guides/how-to-use-microsoft-entra-id/good-to-know-about-entra-id.md) {% endcontent-ref %} {% content-ref url="/pages/CYAXFlzVg1pjo9tIdF2P" %} [Troubleshooting Entra ID](/tutorials/guides/how-to-use-microsoft-entra-id/troubleshooting-entra-id.md) {% endcontent-ref %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.struct.com/tutorials/guides/how-to-use-microsoft-entra-id.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.