> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/control/members/directory-access/connect-microsoft-entra-id.md). # Connect Microsoft Entra ID Connecting Entra ID lets Lleverage read the groups in your tenant so you can map them to Projects. It takes one consent from a Global Administrator and no configuration in Entra. {% hint style="info" %} Directory access must currently be enabled by Lleverage for your organisation before you can configure it. {% endhint %} ## Before you start * Your organisation is on the Enterprise plan and directory access has been enabled by Lleverage. * You are an Organisation Owner in Lleverage. * A Global Administrator of your Entra tenant is available to complete the consent. They do not need a Lleverage account. If IT holds that role, you hand them a link. ## What Lleverage asks for The consent grants two application permissions to an application called **Lleverage Directory**: | Permission | What it lets Lleverage do | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `GroupMember.Read.All` | List groups and read the members of the groups you map, including nested groups | | `User.Read.All` | Read the profile of members in mapped groups: display name, email address, user principal name, whether the account is enabled, and whether they are a guest | Both permissions are read-only. Lleverage has no permission to write to your directory and cannot read mail, files, calendars, chats or sign-in logs. It reads members only for the groups you map, plus one directory-wide read for an Everyone grant if you create one. ## 1. Generate the consent link 1. Sign in to Lleverage as an Organisation Owner. 2. Go to **Organisation Settings → Directory**. 3. Under **Microsoft Entra ID**, select **Connect Entra ID**. 4. Copy the admin consent link from the field that appears. The link is valid for 15 minutes and works once. If it expires before the administrator opens it, generate a new one; nothing needs undoing. {% hint style="info" %} Send the link straight to the administrator who will complete it. Anyone who opens it is taken to Microsoft's consent screen, but only a Global Administrator of your tenant can accept, and Microsoft refuses anyone else. {% endhint %} ## 2. Grant consent in Microsoft The administrator opens the link, signs in to Microsoft, and sees the consent screen for Lleverage Directory listing the two permissions above. Accepting returns them to Lleverage with a confirmation page. They can close it; the connection is live in your organisation. Back on the Directory page you see the tenant's name, the granted permissions, and the first sync in **Sync activity** within a minute. If the administrator declines, the Directory page records the attempt with the reason Microsoft gave, and you can generate a fresh link when they are ready. ## 3. Choose how the sync behaves Everything under **Sync behaviour** has a default and can be changed at any time. | Setting | Default | What it does | | -------------------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------- | | Sync every | 15 minutes | How often Lleverage reads changes from the directory. 5 to 60 minutes. A full re-read of every mapped group happens weekly regardless. | | Create accounts before first sign-in | On | A mapped member without a Lleverage account gets one straight away, so their access is ready the first time they sign in | | Create accounts for unverified email domains | Off | Also create accounts for members whose email domain your organisation has not verified, such as guests from another tenant | | Remove access when someone leaves a group | On | Leaving a mapped group removes the role it gave. Off keeps the role and lists the person for you to review. | | Sign out disabled accounts | On | When Entra disables an account, end their Lleverage sessions in this organisation as well as removing access | | Sign out suspended members | Off | Also end sessions when an owner suspends a directory member in a group | | Everyone includes guests | Off | Whether an Everyone grant covers guests from other tenants | | Sync digests | On | Owners get one email per 15 minutes summarising access changes. Failure alerts are always sent. | | Welcome new accounts by email | Off | Email people the sync created an account for, once they hold Project access | | Alias domains | none | Pairs of directory domain and Lleverage domain for matching, such as `contoso.onmicrosoft.com` to `contoso.com` | Select **Sync now** at any point to run a sync immediately instead of waiting for the interval. ## Several Lleverage organisations on one tenant One Entra tenant can serve any number of Lleverage organisations. Each organisation completes its own consent link and keeps its own mappings and settings. If the tenant has already consented to Lleverage Directory for another organisation, the administrator sees the same permissions again; accepting changes nothing in the tenant. ## When consent is removed If an administrator removes Lleverage Directory from **Enterprise applications** in Entra, the next sync fails, the Directory page shows the error, and every Organisation Owner is emailed. Access that the directory granted stays as it was at the last successful sync until you disconnect or reconnect. To reconnect, generate a new consent link. To stop using directory access, see [Security notes](/administer-and-govern/control/members/directory-access/security-notes.md#disconnecting). ## Next step See [Grant access with directory groups](/administer-and-govern/control/members/directory-access/grant-access-with-directory-groups.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.lleverage.ai/administer-and-govern/control/members/directory-access/connect-microsoft-entra-id.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.