Azure Entra ID Integration Guide
If your organization uses Microsoft Entra ID for identity management, this integration brings your directory into Openlane so you can run User Access Reviews, verify authentication policies, and maintain a current view of who has access to what.
Key Capabilities
- Directory and Group Sync: Ingests user identities, group memberships, and role assignments from your Entra tenant, giving you the identity baseline you need for access reviews and onboarding/offboarding evidence.
- Authentication Policy Visibility: Surfaces tenant-level authentication configuration so you can verify that multi-factor authentication (MFA) policies and conditional access rules align with your security standards.
- Read-Only Access: Pulls data into Openlane via Microsoft Graph without changing any Entra tenant settings.
Prerequisites
- Permission to create or manage app registrations in Entra.
- Microsoft Graph permissions with admin consent for tenant metadata access.
- Openlane callback URL available for OAuth setup.
Step-by-Step Setup
Step 1: Connect in Openlane
- Navigate to Organization Settings > Integrations and find Azure Entra ID.
- Click Continue to Authorization. You will be redirected to Microsoft to authorize access.
- Sign in and grant the requested permissions.
- After authorization, you are redirected back to Openlane and the connection is saved.
Step 2: Configure Sync Behavior
Optionally configure which data is collected and how records are filtered before ingestion:
Directory Sync
| Setting | Description |
|---|---|
| Primary Directory | Designate this connection as the primary directory source for your organization; the primary directory is the authoritative source that populates the majority of fields on identity holder records |
| Disable Group Sync | When enabled, only users are synced; groups and memberships are skipped |
| Include Guest Users | When enabled, guest users from Azure will also be synced to Openlane |
| Filter Expression | Optional Common Expression Language (CEL) expression evaluated against each record; only records that match are ingested (allows inclusion) |
Filter expression example:
payload.accountEnabled == "true"
CEL expressions have access to the full raw payload for each record via payload.<field>.
Validate Connection
After saving, Openlane runs a health check against Azure Entra ID and displays the result on the Installed tab of the Integrations page. You should see a Healthy badge confirming connectivity. If the badge shows Needs Attention, review the troubleshooting section below.
What Openlane Syncs
Openlane syncs directory users, group memberships, and tenant metadata from your Entra ID environment. This gives you a continuously updated identity baseline you can use for User Access Reviews, onboarding/offboarding verification, and role-based access validation. This is especially useful when an auditor asks for access control evidence.
Disconnect
To remove this integration, navigate to Organization Settings > Integrations and select the Installed tab. Open the menu on the integration card and select Disconnect. This removes stored credentials and stops all collection activity. You can reconnect later by configuring the integration again.
Troubleshooting
- Consent errors: verify admin consent for required Graph permissions.