How to find the IDs in Entra ID

Where to copy the Tenant ID and the group Object IDs in the Microsoft Entra admin center, and how to restrict who may sign in at all.

Struct needs two kinds of identifier from you: one Tenant ID for the connection, and one Object ID for each group you want to map. Both are copied from the Microsoft Entra admin center.

Identifiers, directory names and user details in the screenshots throughout this guide are examples. Real values have been replaced or blurred.

Tenant ID

1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com.

2. Go to Identity → Overview.

3. On the Overview tab, find Tenant ID and copy it.

It is a GUID, in the form 00000000-0000-0000-0000-000000000000. It can be found in the Microsoft Entra admin center under Identity → Overview, as Tenant ID.

The directory Overview page, with Tenant ID outlined. Use the copy icon at the right of the field, then paste the value into Tenant ID on the Struct connection form.

If you are configuring Struct for the directory you are signed in to, you can skip this step. Ticking Use my signed-in account's tenant in Struct fills the Tenant ID in from the Microsoft account you are signed in with. It is the quickest route, and it avoids a mistyped GUID.

Group Object ID

1. In the Entra admin center, go to Identity → Groups → All groups.

2. Find and open the group that should grant access.

3. On the group's Overview, copy the Object ID.

Repeat for each group you want to map. It is worth copying them into a scratch list, with the Struct role each one should map to written next to it, before you start in Struct. The configuration in Struct then takes only a couple of minutes.

Groups → All groups. Find the group you want to map and open it. The Group type column on the right must read Security.

The group's Overview. Copy the Object ID with the icon at the right of the field, and paste it into the mapping in Struct. Confirm that Type reads Security while you are on this page.

Two things cause most of the confusion at this step.

Security groups only. Struct receives security groups only. A Microsoft 365 group or a distribution list will not appear in the sign-in token, so a mapping against one will never match, and it will fail silently rather than with an error. Check the group type before you copy the ID.

Nested groups count. If a user is a member of group B, and group B is a member of mapped group A, that user matches the mapping for A. Membership is resolved through nesting, so you can map one parent group rather than every child.

Restricting who may sign in at all (optional)

This is not a required step, and the integration works without it. Use it when you want Entra itself to refuse a sign-in, rather than letting anyone in the directory reach Struct and be turned away there.

1. Go to Identity → Applications → Enterprise applications.

2. Open Struct PIM.

3. Under Properties, set Assignment required to Yes.

4. Under Users and groups, assign the users or groups permitted to sign in.

Enterprise applications → Struct PIM → Properties. Switch Assignment required? from No to Yes, then save.

Enterprise applications → Struct PIM → Users and groups. Use Add user/group to assign each user or group that is permitted to sign in. With assignment required, anyone not on this list is refused by Entra.

Two gates, not one

It is easy to conflate this with Struct's own access rules, so it is worth separating them.

Gate	Set where	What it decides
Assignment required	Entra, on the Struct PIM enterprise application	Who Entra will issue a token to at all. Anyone else never reaches Struct.
Connection access scope and mappings	Struct	What the people who do arrive may do once they are there.

They are two different gates, and you can use either or both. A user must pass the first to be seen by the second.