> For the complete documentation index, see [llms.txt](https://docs.struct.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.struct.com/tutorials/guides/how-to-use-microsoft-entra-id/how-to-find-the-ids-in-entra-id.md). # How to find the IDs in Entra ID Where to copy the Tenant ID and the group Object IDs in the Microsoft Entra admin center, and how to restrict who may sign in at all. Struct needs two kinds of identifier from you: one Tenant ID for the connection, and one Object ID for each group you want to map. Both are copied from the Microsoft Entra admin center. {% hint style="info" %} Identifiers, directory names and user details in the screenshots throughout this guide are examples. Real values have been replaced or blurred. {% endhint %} ## Tenant ID 1. Sign in to the Microsoft Entra admin center at . 2. Go to **Identity → Overview**. 3. On the **Overview** tab, find **Tenant ID** and copy it. It is a GUID, in the form `00000000-0000-0000-0000-000000000000`. It can be found in the Microsoft Entra admin center under Identity → Overview, as Tenant ID.

The directory Overview page, with Tenant ID outlined. Use the copy icon at the right of the field, then paste the value into Tenant ID on the Struct connection form.

{% hint style="info" %} If you are configuring Struct for the directory you are signed in to, you can skip this step. Ticking **Use my signed-in account's tenant** in Struct fills the Tenant ID in from the Microsoft account you are signed in with. It is the quickest route, and it avoids a mistyped GUID. {% endhint %} ## Group Object ID 1. In the Entra admin center, go to **Identity → Groups → All groups**. 2. Find and open the group that should grant access. 3. On the group's **Overview**, copy the **Object ID**. Repeat for each group you want to map. It is worth copying them into a scratch list, with the Struct role each one should map to written next to it, before you start in Struct. The configuration in Struct then takes only a couple of minutes.

Groups → All groups. Find the group you want to map and open it. The Group type column on the right must read Security.

The group's Overview. Copy the Object ID with the icon at the right of the field, and paste it into the mapping in Struct. Confirm that Type reads Security while you are on this page.

Two things cause most of the confusion at this step. {% hint style="danger" %} **Security groups only.** Struct receives security groups only. A Microsoft 365 group or a distribution list will not appear in the sign-in token, so a mapping against one will never match, and it will fail silently rather than with an error. Check the group type before you copy the ID. {% endhint %} {% hint style="info" %} **Nested groups count.** If a user is a member of group B, and group B is a member of mapped group A, that user matches the mapping for A. Membership is resolved through nesting, so you can map one parent group rather than every child. {% endhint %} ## Restricting who may sign in at all (optional) This is not a required step, and the integration works without it. Use it when you want Entra itself to refuse a sign-in, rather than letting anyone in the directory reach Struct and be turned away there. 1. Go to **Identity → Applications → Enterprise applications**. 2. Open **Struct PIM**. 3. Under **Properties**, set **Assignment required** to **Yes**. 4. Under **Users and groups**, assign the users or groups permitted to sign in.

Enterprise applications → Struct PIM → Properties. Switch Assignment required? from No to Yes, then save.

Enterprise applications → Struct PIM → Users and groups. Use Add user/group to assign each user or group that is permitted to sign in. With assignment required, anyone not on this list is refused by Entra.

### Two gates, not one It is easy to conflate this with Struct's own access rules, so it is worth separating them. | Gate | Set where | What it decides | | ------------------------------------ | ----------------------------------------------- | ------------------------------------------------------------------------- | | Assignment required | Entra, on the Struct PIM enterprise application | Who Entra will issue a token to at all. Anyone else never reaches Struct. | | Connection access scope and mappings | Struct | What the people who do arrive may do once they are there. | They are two different gates, and you can use either or both. A user must pass the first to be seen by the second. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.struct.com/tutorials/guides/how-to-use-microsoft-entra-id/how-to-find-the-ids-in-entra-id.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.