Connect Microsoft Entra ID

Connecting Entra ID lets Lleverage read the groups in your tenant so you can map them to Projects. It takes one consent from a Global Administrator and no configuration in Entra.

Directory access must currently be enabled by Lleverage for your organisation before you can configure it.

Before you start

• Your organisation is on the Enterprise plan and directory access has been enabled by Lleverage.

• You are an Organisation Owner in Lleverage.

• A Global Administrator of your Entra tenant is available to complete the consent. They do not need a Lleverage account. If IT holds that role, you hand them a link.

What Lleverage asks for

The consent grants two application permissions to an application called Lleverage Directory:

Permission	What it lets Lleverage do
GroupMember.Read.All	List groups and read the members of the groups you map, including nested groups
User.Read.All	Read the profile of members in mapped groups: display name, email address, user principal name, whether the account is enabled, and whether they are a guest

Both permissions are read-only. Lleverage has no permission to write to your directory and cannot read mail, files, calendars, chats or sign-in logs. It reads members only for the groups you map, plus one directory-wide read for an Everyone grant if you create one.

1. Generate the consent link

1. Sign in to Lleverage as an Organisation Owner.

2. Go to Organisation Settings → Directory.

3. Under Microsoft Entra ID, select Connect Entra ID.

4. Copy the admin consent link from the field that appears.

The link is valid for 15 minutes and works once. If it expires before the administrator opens it, generate a new one; nothing needs undoing.

Send the link straight to the administrator who will complete it. Anyone who opens it is taken to Microsoft's consent screen, but only a Global Administrator of your tenant can accept, and Microsoft refuses anyone else.

2. Grant consent in Microsoft

The administrator opens the link, signs in to Microsoft, and sees the consent screen for Lleverage Directory listing the two permissions above. Accepting returns them to Lleverage with a confirmation page. They can close it; the connection is live in your organisation.

Back on the Directory page you see the tenant's name, the granted permissions, and the first sync in Sync activity within a minute.

If the administrator declines, the Directory page records the attempt with the reason Microsoft gave, and you can generate a fresh link when they are ready.

3. Choose how the sync behaves

Everything under Sync behaviour has a default and can be changed at any time.

Setting	Default	What it does
Sync every	15 minutes	How often Lleverage reads changes from the directory. 5 to 60 minutes. A full re-read of every mapped group happens weekly regardless.
Create accounts before first sign-in	On	A mapped member without a Lleverage account gets one straight away, so their access is ready the first time they sign in
Create accounts for unverified email domains	Off	Also create accounts for members whose email domain your organisation has not verified, such as guests from another tenant
Remove access when someone leaves a group	On	Leaving a mapped group removes the role it gave. Off keeps the role and lists the person for you to review.
Sign out disabled accounts	On	When Entra disables an account, end their Lleverage sessions in this organisation as well as removing access
Sign out suspended members	Off	Also end sessions when an owner suspends a directory member in a group
Everyone includes guests	Off	Whether an Everyone grant covers guests from other tenants
Sync digests	On	Owners get one email per 15 minutes summarising access changes. Failure alerts are always sent.
Welcome new accounts by email	Off	Email people the sync created an account for, once they hold Project access
Alias domains	none	Pairs of directory domain and Lleverage domain for matching, such as contoso.onmicrosoft.com to contoso.com

Select Sync now at any point to run a sync immediately instead of waiting for the interval.

Several Lleverage organisations on one tenant

One Entra tenant can serve any number of Lleverage organisations. Each organisation completes its own consent link and keeps its own mappings and settings. If the tenant has already consented to Lleverage Directory for another organisation, the administrator sees the same permissions again; accepting changes nothing in the tenant.

When consent is removed

If an administrator removes Lleverage Directory from Enterprise applications in Entra, the next sync fails, the Directory page shows the error, and every Organisation Owner is emailed. Access that the directory granted stays as it was at the last successful sync until you disconnect or reconnect. To reconnect, generate a new consent link.

To stop using directory access, see Security notes.

Next step

See Grant access with directory groups.