--- updatedAt: 2026-07-16T20:39:52.000Z --- # Microsoft 365 | Entitle ## Overview Microsoft 365 is a product family of productivity software, collaboration, and cloud-based services owned by Microsoft. It encompasses online services such as Outlook, OneDrive, Microsoft Teams, programs formerly marketed under the name Microsoft Office, and enterprise products and services associated with these products. Entitle can manage **Admin roles** in Microsoft 365. This page will provide you with instructions on how to integrate Entitle and Microsoft 365. ## General guidelines > ℹ️ > > In case you have already integrated Azure AD with Entitle using [this guide,](entitle-integration-azuread) you can use the same Entra application configuration and continue to the [Set Up in Entitle section](#creating-the-integration-in-entitle). **To integrate your Microsoft 365 with Entitle, you will need to:** * Create an application on Entra ID, and extract Client and tenant IDs. * Create a secret, and extract its value. * Provide Entitle with adequate permissions for the application. ## Set up Microsoft 365 Directory to work with Entitle ### Stage 1: Create an application 1. Go to the [Microsoft Azure portal](https://portal.azure.com/#home). 2. Click on **Microsoft Entra ID**. ![Microsoft Entra ID tile on the Azure services page.](https://files.readme.io/aa4819f-image.png) 3. Click on the **App registrations** tab in the left-side menu. [block:image]{"images":[{"image":["https://files.readme.io/1ff4980-image.png",null,""],"align":"center","sizing":"150px","border":true}]}[/block] 4. Then, click on **New registration**. [block:image]{"images":[{"image":["https://files.readme.io/2057ac8-image.png",null,""],"align":"center","sizing":"600px","border":true}]}[/block] 5. Give your app a **Name** and leave the rest as is. Then, click on **Register**. [block:image] { "images": [ { "image": [ "https://files.readme.io/696ccb3-image.png", null, "" ], "align": "center", "sizing": "400px", "border": true } ] } [/block] 6. Keep your **Application (client) ID** and **Directory (tenant) ID** for later. Then, click on **Add a certificate or secret** on the right side. Currently, this integration supports only certificates and secrets, not federated credentials. [block:image] { "images": [ { "image": [ "https://files.readme.io/9d7bdfa-image.png", null, "" ], "align": "center", "sizing": "800px", "border": true } ] } [/block] 7. Click on **New client secret**. [block:image] { "images": [ { "image": [ "https://files.readme.io/2fb6a9c-image.png", null, "" ], "align": "center", "sizing": "400px", "border": true } ] } [/block] 8. In the pop-up window, choose a **Description** that you will remember and an expiration time of your choice. Keep in mind that you will have to create a new secret and hence a new integration when it expires. Once done, click **Add**. [block:image] { "images": [ { "image": [ "https://files.readme.io/e880d55-image.png", null, "" ], "align": "center", "sizing": "300px", "border": true } ] } [/block] 9. Click on the **copy** icon to copy your new Client Secret **Value** and keep it for later. [block:image] { "images": [ { "image": [ "https://files.readme.io/bd907a5-image.png", null, "" ], "align": "center", "sizing": "400px", "border": true } ] } [/block] ### Stage 2: Assign permissions to Graph API 1. Go to **API permissions**. [block:image] { "images": [ { "image": [ "https://files.readme.io/bae3a9e-image.png", null, "" ], "align": "center", "sizing": "200px", "border": true } ] } [/block] 2. Remove the existing permission by clicking on the **"..."** on the right, choose **remove all permissions**, and finally click on the blue **Yes, remove** button. [block:image] { "images": [ { "image": [ "https://files.readme.io/273d9b8-image.png", null, "" ], "align": "center", "sizing": "400px", "border": true } ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/246af4a-Untitled_49.png", "Untitled (49).png", 478 ], "align": "center", "sizing": "200px", "border": true } ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/70a7bff-image.png", null, "" ], "align": "center", "sizing": "400px", "border": true } ] } [/block] 3. Now, click on **Add a Permission**. [block:image] { "images": [ { "image": [ "https://files.readme.io/be440cf-image.png", null, "" ], "align": "center", "sizing": "450px", "border": true } ] } [/block] 4. Then pick **Microsoft Graph**. [block:image] { "images": [ { "image": [ "https://files.readme.io/3395056-image.png", null, "" ], "align": "center", "sizing": "350px", "border": true } ] } [/block] 5. Choose **Application permissions**. [block:image] { "images": [ { "image": [ "https://files.readme.io/b6ada0e-image.png", null, "" ], "align": "center", "sizing": "450px", "border": true } ] } [/block] 6. Using the search bar that appears, find the following permissions and select them: ```json RoleManagement.ReadWrite.Directory, User.ReadWrite.All ``` > ✅ Example [block:image]{"images":[{"image":["https://files.readme.io/cf74222-Untitled_53.png","Untitled (53).png",1479],"align":"center","sizing":"400px","border":true}]}[/block] 7. When you are done selecting all six permissions, click on **Add permissions** at the bottom of the screen. [block:image] { "images": [ { "image": [ "https://files.readme.io/8b59683-image.png", null, "" ], "align": "center", "sizing": "200px", "border": true } ] } [/block] 8. Your screen should now look the same as the following image. Then, click on **Grant admin consent for Default Directory**, and then click **Yes**. [block:image] { "images": [ { "image": [ "https://files.readme.io/568f0b9-image.png", null, "" ], "align": "center", "sizing": "600px", "border": true } ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/f18c4fb-image.png", null, "" ], "align": "center", "sizing": "600px", "border": true } ] } [/block] ## Creating the integration in Entitle 1. Log in to Entitle and go to the **Integrations** page. 2. After clicking the **Add Integration** button, type **Microsoft 365 Admin Center** in the **Application** field. 3. Don’t forget to set the **Save on** field with your configuration, i.e. your own hosted agent or Entitle’s cloud. [block:image] { "images": [ { "image": [ "https://files.readme.io/73391e5-image.png", null, "" ], "align": "center", "sizing": "400px", "border": true } ] } [/block] 4. In the Connection JSON, `client_id`, `secret`, and `tenant`, paste the values of the **Client ID, Client Secret,** and the **Directory (tenant) ID** from the previous stages. > ✅ Example connection JSON > > ```json > { > "client_id": "The value of Application (client) ID", > "secret": "The value of Client Secret", > "tenant": "The value of Directory (tenant) ID" > } > ``` 5. Click **Save**. > ℹ️ > > Should you need to allowlist this integration, these are the IP addresses from which Entitle's service reaches the integration: > > * Entitle EU (Cloud deployment) > * 34.243.199.171 > * 54.216.133.226 > * Entitle US (Pathfinder deployment) > * 52.45.229.219 > * 54.88.235.213 > * 3.224.15.134 > * Entitle CA (Pathfinder deployment) > * 35.182.218.208 > * 15.156.179.153 > ✅ What's next? > > Make sure your setup is complete by [testing your integration](test-your-integration).