Microsoft Entra settings

Velauth can read the user list from Microsoft Entra to match cloud accounts to on-premises accounts. This page covers the screen where you save that credential. For the Entra side of the setup, see What to turn on.

Who can use it

The Manage Entra credential permission (org.graph_credentials.manage). Only an Org Owner holds it by default, and only an Owner can hand it out. Without it, the Microsoft Entra section is hidden in Settings. Saving or removing also needs two-factor authentication on your account.

Save the credential

1. In Entra, register an app with the Microsoft Graph application permission User.Read.All and grant admin consent. Create a client secret.
2. In Velauth, open Settings, Microsoft Entra (under Organization).
3. Enter the tenant ID and client ID. Both must be GUIDs.
4. Paste the client secret. It must be 8 to 256 characters.
5. Select Verify and save.

Velauth asks Microsoft for a token and tries to read users before it saves anything. If that fails, nothing is saved.

Replace or remove

• Once saved, the card shows Configured with the tenant ID, client ID, when it was created and when it was last replaced. The secret is never shown again.
• To change it, enter the new details and select Replace credential.
• To delete it, select Remove credential and confirm. User views fall back to on-premises accounts only. The app registration in Entra is not touched.

What is recorded

Each save writes graph_credential_set and each removal writes graph_credential_deleted in the organisation’s admin audit. The entry holds the operator, tenant ID and client ID. It never holds the secret.

What it does not do

• It does not write to Entra. The credential is only used to read users.
• It does not show the secret after saving. The secret is stored encrypted on the server.
• It does not remind you when the client secret expires. Note the date yourself.