Overview
Torii integrates with Microsoft Entra ID and syncs users, licenses, usage, and external apps.
- You can connect multiple Microsoft Entra ID accounts to Torii.
- You can constantly stay updated with application information from our Integrations Page >> Integration Capabilities button >> Integration Capabilities table.
This article covers connecting Microsoft Entra ID using an App Registration (app-only authentication) — You provide a Tenant ID, Application (Client) ID, and Client Secret. Authentication is performed using the application’s credentials (client credentials flow), so no interactive admin sign-in is required during setup or sync.
Prefer to connect with an administrator user instead? See Microsoft Entra ID (Admin user) Integration.
Requirements
To connect this integration, we require the following:
Accounts & Permissions
- An administrator who can register an application in Microsoft Entra ID and grant tenant-wide admin consent.
- (Optional — for Exchange and runbook actions) An Azure Automation account configured with the Torii runbook, with a Reader role on that Automation account granted to the app registration's service principal.
Scopes
Grant the following Microsoft Graph application permissions (with admin consent).
For data sync (required):
- User.Read.All - to read users.
- Directory.Read.All - to read groups, directory roles, and license (SKU) data.
- AuditLog.Read.All - to read sign-in logs for usage and last-activity data.
For workflow actions (only if you plan to run user/group actions):
- User.ReadWrite.All - to create, update, and delete users, assign/remove managers, change user type, and revoke sign-in sessions.
- Group.ReadWrite.All - to add and remove users from groups.
- User.EnableDisableAccount.All - to enable and disable user accounts.
Required keys
- Tenant ID (Directory ID)
- Application (Client) ID
- Client Secret
- (Optional — required only for Exchange and runbook actions) Webhook URL, Credential Name, Subscription ID, Resource Group Name, and Automation Account Name.
How to Generate the Required Values
Step 1: Register an application
- In the Microsoft Entra admin center, go to Entra ID > App registrations > New registration.
- Enter a name (for example, "Torii") and select Register.
- On the application's Overview page, copy the Directory (tenant) ID and the Application (client) ID.
Step 2: Create a client secret
- Open Certificates & secrets > New client secret.
- Add a description and select the longest available expiry (recommended, so the connection needs re-credentialing less often), then select Add.
- Copy the secret Value immediately.
Important
The client secret Value is shown only once, right after creation. Copy it before leaving the page; you cannot retrieve it later.
Step 3: Grant Microsoft Graph application permissions
- Open API permissions > Add a permission > Microsoft Graph > Application permissions.
- Add the permissions listed under Requirements > Scopes above — the read permissions for data sync, plus the write permissions if you plan to run workflow actions.
- Select Grant admin consent and confirm.
Step 4: Enable Exchange and runbook actions (optional)
- Set up an Azure Automation account with the Torii runbook by following the Setup PowerShell Actions for Torii guide.
- In the Azure portal, open the Automation account, go to Access control (IAM) > Add > Add role assignment.
- Select the Reader role, then assign it to your app registration (service principal).
How to Connect the Integration
- Go to the Integrations page in Torii.
- Search for Microsoft Entra ID and click Connect.
- Select the App registration connection method.
- Enter the Tenant ID, Application (Client) ID, and Client Secret.
- To use workflow actions, choose the read/write permission option.
- For Exchange and runbook actions, also enter the Automation Account fields: Webhook URL, Credential Name, Subscription ID, Resource Group Name, and Automation Account Name.
- Click Connect.
Additional Notes
- Supported workflow actions with this method (connect as read/write and grant the write permissions above): create / update / delete user, enable / disable account, assign / remove manager, change user type, revoke sign-in sessions, and add / remove users from groups. With the Automation Account details and Reader role configured, the Exchange and runbook actions are also supported: add / remove users from distribution groups, add / remove users from mail-enabled security groups, and convert a mailbox to shared.
- Password reset is not available with the app-registration method — use the Admin user (OAuth) method instead. Enabling or disabling administrator accounts also requires the Admin user method (enabling/disabling regular accounts works app-only).
For any further questions, please contact Torii Support.