> For the complete documentation index, see [llms.txt](https://docs.struct.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.struct.com/tutorials/guides/how-to-use-microsoft-entra-id/example-of-an-entra-id-setup.md).

# Example of an Entra ID setup

A worked example of one connection with two mapped groups, and what happens when someone joins or leaves the group in Entra ID.

Contoso wants Struct PIM for its product team only. Two groups already exist in its Entra directory: `PIM-Editors` for the people who maintain product data, and `PIM-Read-Only` for colleagues in sales who need to look things up.

The Entra administrator opens **Identity → Overview**, copies the Tenant ID, then opens **Identity → Groups → All groups** and copies the Object ID of each of the two groups. Both are security groups.

| Entra group     | Group Object ID                        | Struct roles   | Struct user groups |
| --------------- | -------------------------------------- | -------------- | ------------------ |
| `PIM-Editors`   | `3f2e1d0c-9b8a-7654-3210-fedcba987654` | Product editor | Product team       |
| `PIM-Read-Only` | `8a7b6c5d-4e3f-2109-8765-43210fedcba9` | Read only      | —                  |

In Struct, they open **Settings → Integration → Microsoft Entra ID**, choose **Add Entra ID connection**, and fill in one connection:

* **Connection name** — Contoso corporate directory.
* **Tenant ID** — the Tenant ID copied above, or **Use my signed-in account's tenant**.
* **Access scope** — **Everyone in the organisation has access to Struct** is left off, so the connection is **Mapped groups only**.
* **Group mappings** — two rows, one per group, with the roles and user groups from the table.

Because the connection is in **Mapped groups only** mode, there are no **Defaults for unmapped users** to set. Someone in the Contoso directory who is in neither group is not admitted.

## What happens next

A new product specialist joins Contoso. IT adds her to `PIM-Editors` in Entra, and does nothing in Struct. The next time she signs in to Struct with her Microsoft account, she is admitted, and she receives the Product editor role and the Product team user group.

Months later she moves to another department, and IT removes her from `PIM-Editors`. At her next sign-in, Struct removes the role and user group that mapping gave her. Since no other mapping covers her and the connection admits mapped groups only, she no longer has access.

{% hint style="info" %}
Both of those changes land at the user's next sign-in, not at the moment IT changes the group. If access must end immediately, remove the user in Struct as well, or disable the account in Entra.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.struct.com/tutorials/guides/how-to-use-microsoft-entra-id/example-of-an-entra-id-setup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.