> For the complete documentation index, see [llms.txt](https://docs.siit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.siit.io/guides/integrations/integrations-iam/microsoft-entra-id-integration.md).
# Connect Microsoft Entra ID
Connect Microsoft Entra ID to sync employees and groups, and Microsoft Entra Actions to sync applications and run actions; SSO app discovery needs P1 or P2
Siit has two Microsoft Entra integrations in the **IDP** section of the Integration library. They do different jobs, and you can connect both.
| Integration | What it does |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Microsoft Entra ID** | Syncs employees, groups and office locations, for onboarding and offboarding. |
| **Microsoft Entra Actions** | Syncs your Enterprise Applications, finds app users from SSO sign-ins, and runs Entra actions from requests, workflows and the IT Agent. |
{% hint style="warning" %}
To see your Entra applications in **Context → Applications**, connect **Microsoft Entra Actions**. Microsoft Entra ID alone doesn't sync applications.
{% endhint %}
### Connect Microsoft Entra ID (employees and groups)
1. In Siit, go to **Settings → Workspace → Integration library**.
2. In the IDP section, find **Microsoft Entra ID** and click **Connect**.
3. Confirm you're an Entra admin. If you aren't, copy the link shown and send it to your admin. The email you use must be the same in Siit and in Entra.
4. Enter your Microsoft Tenant ID.
Here's where to find it in Entra:
5. Review the permissions and click **Next** to finish.
### Connect Microsoft Entra Actions (applications and actions)
You'll need an Entra **Global Administrator** to grant admin consent.
1. In **Settings → Workspace → Integration library**, find **Microsoft Entra Actions** in the IDP section and click **Connect**.
2. In the modal, pick:
* the **Additional scopes** for the actions you want to use,
* the **Roles for which Microsoft Entra actions are enabled**,
* whether to turn on **Sync custom applications** (see below).
3. Click **Configure**. Microsoft opens.
4. Sign in with a Global Administrator account and grant admin consent.
5. Back in Siit, check the imported data and click **Finish setup**.
To see every action and the permission it needs, read [Use Microsoft Entra ID actions](/guides/integrations/integrations-iam/use-microsoft-entra-id-actions-in-siit.md).
### Sync your own applications too
By default, Siit imports the Enterprise Applications it recognizes from its catalog. Turn on **Sync custom applications** in the Microsoft Entra Actions modal to also import your tenant's own applications and third-party apps missing from the catalog.
The first sync after you turn it on takes longer, around half an hour, because Siit reads 30 days of sign-ins for each new app.
### Enable app discovery from SSO sign-ins
By default, Siit lists the users assigned to each Entra application. To also list the users who reach an application through SSO without being assigned to it, let Siit read your sign-in logs. This needs a **Microsoft Entra ID P1 or P2** licence on your tenant.
1. In **Settings → Workspace → Integration library**, reconnect **Microsoft Entra Actions**.
2. In **Additional scopes**, select **AuditLog.Read.All**.
3. Grant admin consent in Microsoft.
4. Open any app in Siit and check the **Active Users** tab. Users found from sign-in activity appear alongside assigned users, with **Microsoft Entra Actions** in the **Sources** column.
### Frequently asked questions
**Which integration do I need?**
Connect **Microsoft Entra ID** to bring in your employees and groups. Connect **Microsoft Entra Actions** to see your applications and run actions like suspending a user or adding them to a group. Most companies connect both.
**I connected Microsoft Entra ID, but my applications don't show up. Why?**
Applications come from **Microsoft Entra Actions**, not from Microsoft Entra ID. Connect Microsoft Entra Actions, and turn on **Sync custom applications** if you also want your tenant's own apps.
**Why does someone appear on an app's Active Users list when I never assigned them to it?**
They signed in to that app through Entra SSO. Siit treats a successful SSO sign-in as evidence of use, so the person is listed as a user of the app even without a direct or group assignment.
**Do users discovered this way stay on the list forever?**
No. A membership that comes only from sign-in activity expires once the person stops signing in. If they also hold an assignment or a Siit App Access grant, they stay listed through that source instead.
**I enabled app discovery but no extra users appeared. What is wrong?**
Check three things. Microsoft Entra Actions must be connected. Your tenant needs a Microsoft Entra ID P1 or P2 licence, because Microsoft does not expose application sign-in logs on the free tier. And **AuditLog.Read.All** must be granted on Microsoft Entra Actions.
**Does removing someone from an app in Siit sign them out of the app?**
No. The Active Users list reflects access as your connected systems report it. To remove access, run the matching action in Siit or in Entra ID.
**Does this work with Okta, Google Workspace, or JumpCloud?**
Sign-in based app discovery is available for Microsoft Entra ID only.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.siit.io/guides/integrations/integrations-iam/microsoft-entra-id-integration.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
