Please note that claims returned from Azure AD are static; custom or optional claims will not appear in user profiles. If you need to include custom or optional claims in user profiles, use another connection instead.
Register an app with Entra ID
To register your app with Entra ID, see Microsoft's Quickstart: Register an application with the Microsoft identity platform.
During registration, configure the following settings:
Option | Setting |
Supported account types | Note: To allow users from external organizations (like other Azure AD directories) choose the appropriate multitenant option. Multitenant options include the following: Accounts in any organizational directory (Any Azure AD directory - Multitenant). |
Redirect URI | Select a Redirect URI type of Web, and enter the following callback URL: |
During this process, Microsoft generates an Application (client) ID for your application; you can find this on the app's Overview screen. Note down this value.
Create a client secret
To create a client secret, see Microsoft's Quickstart: Configure a client application to access web APIs - Add Credentials to your web application.
Once generated, note down this value.
If you configure an expiring secret, make sure to record the expiration date; you will need to renew the key before that day to avoid a service interruption.
Add permissions
To add permissions, see Microsoft's Quickstart: Configure a client application to access web APIs - Add permissions to access web APIs.
While configuring permissions, consider the following: If you want to enable extended attributes (such as Extended Profile or Security Groups), then you will need to configure the following permissions for the Microsoft Graph API.
Delegated Permissions | Description |
Users > User.Read | So your app can sign in users and read the signed-in users' profiles. |
Directory > Directory.Read.All | So your app can read directory data on the signed-in user's behalf. |
Next Steps
Provide Molequle Support with the following information:
Field | Description |
Microsoft Azure AD Domain | Your Azure AD authorization URL. You can find this on your Azure AD directory's overview page in the Microsoft Azure portal. |
Client ID | Unique identifier for your registered Azure AD application. |
Client Secret | String used to gain access to your registered Azure AD application. |
Extended Attributes (optional) | Get extended attributes in Molequle for the signed-in user that your app can access. |
Sync user profile attributes at each login (optional) | When enabled, Molequle automatically syncs user profile data with each user login, thereby ensuring that changes made in the connection source are automatically updated in Molequle. |