Example of an Entra ID setup
A worked example of one connection with two mapped groups, and what happens when someone joins or leaves the group in Entra ID.
Contoso wants Struct PIM for its product team only. Two groups already exist in its Entra directory: PIM-Editors for the people who maintain product data, and PIM-Read-Only for colleagues in sales who need to look things up.
The Entra administrator opens Identity → Overview, copies the Tenant ID, then opens Identity → Groups → All groups and copies the Object ID of each of the two groups. Both are security groups.
PIM-Editors
3f2e1d0c-9b8a-7654-3210-fedcba987654
Product editor
Product team
PIM-Read-Only
8a7b6c5d-4e3f-2109-8765-43210fedcba9
Read only
—
In Struct, they open Settings → Integration → Microsoft Entra ID, choose Add Entra ID connection, and fill in one connection:
Connection name — Contoso corporate directory.
Tenant ID — the Tenant ID copied above, or Use my signed-in account's tenant.
Access scope — Everyone in the organisation has access to Struct is left off, so the connection is Mapped groups only.
Group mappings — two rows, one per group, with the roles and user groups from the table.
Because the connection is in Mapped groups only mode, there are no Defaults for unmapped users to set. Someone in the Contoso directory who is in neither group is not admitted.
What happens next
A new product specialist joins Contoso. IT adds her to PIM-Editors in Entra, and does nothing in Struct. The next time she signs in to Struct with her Microsoft account, she is admitted, and she receives the Product editor role and the Product team user group.
Months later she moves to another department, and IT removes her from PIM-Editors. At her next sign-in, Struct removes the role and user group that mapping gave her. Since no other mapping covers her and the connection admits mapped groups only, she no longer has access.