---
title: "Microsoft Entra ID Integration"
slug: "microsoft-entra-id-integration"
updated: 2026-05-20T13:39:32Z
published: 2026-05-20T13:39:32Z
canonical: "support.controlup.com/microsoft-entra-id-integration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID Integration

This article describes how to add a Microsoft Entra ID connection so you can integrate Entra ID with ControlUp. Read [IdP integration overview](/v1/docs/idp-connection-overview) to learn how you can use IdP integrations with ControlUp.

ControlUp supports two methods for authorizing Entra ID connections:
* [OAuth](/v1/docs/microsoft-entra-id-integration#method-1-oauth)
* [Application Registration](/v1/docs/microsoft-entra-id-integration#method-2-application-registration)

## Prerequisite permission
To set up an Entra ID connection, your ControlUp account must have the **Manage Integrations** permission.

## Method 1 - OAuth
1. In ControlUp, go to **Settings > Integrations > Identity Providers** and click the Microsoft Entra ID logo to start adding a new Entra ID integration.
![SetupEntraIntegration.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/SetupEntraIntegration.png){height="" width="750"}


2. Under **Authorization method**, select **OAuth 2.0**.
3. Select the **Purpose** for the connection. This determines how ControlUp uses the connection and the required permissions in Entra ID.
4. Enter a **Name** of your choice. Note that you can't see the connection's configuration after you create it, so you should choose an informative name, especially if you have multiple Entra ID tenants.
5. In the **Instance Name** field, enter your Entra ID tenant name. Read [Microsoft's documentation](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-read-tenant-name#get-your-tenant-name){target=`_blank`} to learn how to get your tenant name.
6. In the **Admin Email** field, enter the email address of the Entra ID user you want to use to perform the OAuth authentication.
7. Click **Add connection**.
8. Click **Authorize** and sign in using the admin email account you entered in step 6. You must accept the requested permissions.
9. Click **Test connection** to test and finalize the connection. **This is a mandatory step**.

## Method 2 - Application registration

### Step 1 - Register an application in Entra ID
1. In Entra ID, go to **App registrations > New registration**.
2. In the **Register an application** form, enter the following details:
    1. Enter a **Name** for the application.
    2. Select the **Supported account types**.
3. Click **Register**.
4. Take note of the following values because you'll need to add them into ControlUp's settings.
    * Application (client) ID
    * Object ID
    * Directory (tenant) ID 
![Entra ID Essential Details](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Entra%20Essential%20Details%281%29.png){height="" width=""}
:::(Warning) (3rd Party Software)
This image is taken from Microsoft and may not reflect the latest changes that may be made to the software over time. However, the settings and values should appear as described.
:::

### Step 2 - Add permissions to the application
1. In Entra ID, go to **API permissions > Add a permission**.

2. Select **Microsoft Graph**.

3. Select **Application permissions**.

4. Add the required permissions based on which ControlUp module uses the connection:
    * For Authentication and authorization, add the following permissions:
        * User.Read.All
        * Group.Read.All
        * Application.ReadWrite.All (required only for [automatic SAML setup](https://support.controlup.com/docs/saml-sso-for-dex#automatically-set-up-saml-sso){target=`_blank`})
        * Policy.ReadWrite.ApplicationConfiguration (required only for [automatic SAML setup](https://support.controlup.com/docs/saml-sso-for-dex#automatically-set-up-saml-sso){target=`_blank`})
    * For Secure DX, add the following permissions:
        * User.Read.All
        *  AuditLog.Read.All

5. After adding the permissions, click **Grant admin consent for Default Directory**.

### Step 3 - Create a client secret
1. In Entra ID, go to **Certificates & secrets > New client secret**.
2. Enter a name and expiration date for the client secret. If the client secret expires and is not replaced with a new one, then ControlUp can't use the connection.
3. Take note of the client secret **Value** because you'll need to add it to ControlUp's settings. You must copy the value and save it somewhere safe now because you won't be able to view it again.
![Client Secret Value](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/ClientSecretValue.png){height="" width=""}

### Step 4 - Set up the connection in ControlUp
1. In ControlUp, go to **Settings > Integrations > Identity Providers** and click the Microsoft Entra ID logo to start adding a new Entra ID connection.
![SetupEntraIntegration.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/SetupEntraIntegration.png){height="" width="750"}

2. Under **Authorization method**, select **Application Registration**.
3. Select the **Purpose** for the connection. This determines how ControlUp uses the connection and the required permissions in Entra ID.
4. Enter a **Name** of your choice. Note that can't see the connection's configuration after you create it, so you should choose an informative name, especially if you have multiple Entra ID tenants.
5. Add the following values you got from [Step 1 - Register an application in Entra ID](/v1/docs/microsoft-entra-id-integration#step-1-register-an-application-in-entra-id):
    * Application (client) ID
    * Object ID
    * Directory (tenant) ID

6. Add the client secret value you got from [Step 3 - Create a client secret](/v1/docs/microsoft-entra-id-integration#step-3-create-a-client-secret).
7. Click **Add connection**.
8. Locate the connection you added in the list and click **Test Connection** to test and finalize the connection. **This is a mandatory step**.