Identity Services requirements

Identity Bridge uses two Microsoft Entra ID app registrations: one for Linux endpoint authentication and one for Identity Bridge administration and schema extensions. Configure both registrations before you join Linux systems to your Entra ID tenant.

Prerequisites

Confirm that your environment meets these requirements. Each item is described in detail in the sections that follow.

• An active Microsoft Entra ID tenant subscription.
• Root-equivalent permissions on each Linux or Unix host where the Identity Bridge agent is installed.
• Three Microsoft Entra ID administrative roles, assigned to the administrator who configures the integration.
• Two Entra ID app registrations: BeyondTrust - Linux endpoint and BeyondTrust - Identity Bridge.
• Outbound DNS, HTTPS, and NTP traffic allowed from each Linux or Unix host.
• At least one Entra ID security group, with at least one member user account.

Required Microsoft Entra ID administrative roles

The administrator who configures the integration must be assigned the following roles.

Required app registrations and permissions

Create both app registrations in the same Entra ID tenant used by EPM-L and Identity Bridge. The permissions listed below are Microsoft Graph application permissions, not delegated permissions, and require tenant admin consent.

BeyondTrust - Linux endpoint

Linux systems use this app registration to authenticate with Microsoft Entra ID through Device Flow. It is used for all Entra ID storage modes.

Assign these Microsoft Graph application permissions:

• Application.Read.All
• Group.Read.All
• User.Read.All

For this registration, also:

• Enable Device Flow.
• Create a client secret.

BeyondTrust - Identity Bridge

This app registration owns the schema extensions and provides access to the Linux identity attributes on Entra ID users and groups: UID, GID, home directory, login shell, alias, and comment.

Assign these Microsoft Graph application permissions:

• Application.ReadWrite.All
• Group.ReadWrite.All
• User.ReadWrite.All

For this registration, also create a client secret.

Linux endpoints resolve their schema using the SchemaConnectorApplication configuration option, which defaults to the name of this app registration. If you rename the registration, update this option.

Why read/write permissions are required

• User.ReadWrite.All and Group.ReadWrite.All: Identity Bridge provisions and updates Linux identity attributes on Entra ID users and groups. These attributes include UID, GID, home directory, login shell, alias, and comment. Read-only permissions cannot create or update these values.
• Application.ReadWrite.All: Required to create and manage the schema extensions that store the Linux identity attributes, including defining schema extension ownership.

🚧

Important

Do not delete the app registration that owns a schema extension.

If you delete the app registration that owns a schema extension, the extension becomes orphaned. No application can update or delete it, it remains in the directory but cannot be managed through Microsoft Graph, and you cannot reassign ownership to another application.

Network requirements

If a local firewall is enabled on the Linux or Unix host running the Identity Bridge agent, allow the following outbound traffic. The agent does not listen on any inbound ports.

Linux and Unix host prerequisites

• Root-equivalent permissions on each host where the Identity Bridge agent is installed.
• A DNS server configured in /etc/resolv.conf that can resolve the records required to join the host to the Entra ID tenant.
• Outbound DNS, HTTPS, and NTP traffic allowed, as described in Network requirements.

Entra ID groups and users

Entra ID security groups serve two purposes in an Identity Bridge deployment. Understanding the difference helps you plan your group structure before you provision anything.

• Groups for system access: Security groups defined in Entra ID can be used as access control groups. Their purpose is similar to the built-in Windows Remote Desktop Users group: membership determines who is permitted to sign in.
• Groups for authorization: Security groups defined in Entra ID and provisioned with a GID become available to the Linux or Unix operating system. These groups define a user's permissions on the operating system after sign-in. For example, you can reference these groups in /etc/sudoers to allow root elevation.
• Users for authentication: Entra ID users provisioned with UID, GID, home directory, and shell values become available to the Linux or Unix operating system. These users are granted sign-in access to Linux hosts and authenticate using a device code.

Provisioning requirements

Before users sign in to Linux hosts:

1. Create at least one Entra ID security group, and add at least one user to the group.
2. Provision the group with a GID.
3. Provision the user with UID, GID, home directory, and login shell values.
4. Confirm that the user GID matches the GID of a provisioned group that the user belongs to.

ℹ️

For a provisioned Entra ID user to sign in, you must provision both the user and the group with POSIX attributes. The user GID must match the GID of a provisioned group to which the user belongs.