Connect & Integrate Microsoft 365

Introduction

This guide covers using YeshID's Microsoft 365 integration to connect your Microsoft 365 and Entra ID tenant.

Once connected, YeshID imports:

• Users

• Groups

• Group memberships

• Entra ID directory roles

YeshID can also manage:

• User create, update, deactivate, and delete

• Group membership changes

• Directory role assignments

Steps

1. Sign in to YeshID as an admin Open the Microsoft 365 integration setup in YeshID.

2. Start the Microsoft 365 connection flow YeshID uses its managed Microsoft OAuth application for this integration, so you do not need to create your own Azure app registration.

3. Sign in with a Microsoft 365 admin account Use a Microsoft 365 admin account for the consent flow. For the smoothest initial setup, use a Global Administrator account.

4. Review and approve the requested Microsoft Graph permissions YeshID requests these delegated Microsoft Graph scopes:

   • offline_access

   • user.readwrite.all

   • group.read.all

   • groupmember.readwrite.all

   • delegatedpermissiongrant.readwrite.all

   • application.read.all

   • userauthenticationmethod.readwrite.all

   • user-passwordprofile.readwrite.all

   • user.revokesessions.all

   • organization.read.all

   • rolemanagement.read.directory

   • customsecattributeassignment.read.all

   • rolemanagement.readwrite.directory

5. Complete the OAuth consent flow Once consent is granted, YeshID stores the connection and can use it for sync and provisioning actions.

6. Optionally set a Default domain If you plan to create Microsoft 365 users from short account names such as alice, set Default domain in YeshID.

YeshID uses this when the account name is not already a full user principal name such as alice@contoso.com.

7. Save the integration If YeshID shows any remaining configuration fields, save the integration once the OAuth connection is complete.

8. Run a sync Start a sync in YeshID.

YeshID will import Microsoft 365 users, groups, group memberships, and Entra ID directory role assignments that are accessible to the connected admin.

FAQ

Do I need to create my own Azure app registration?

No.

This integration currently uses the YeshID-managed Microsoft OAuth application.

What does YeshID import from Microsoft 365?

YeshID imports:

• Users

• Groups

• Group memberships

• Entra ID directory roles assigned to users

What can YeshID manage after setup?

YeshID can manage:

• User create, update, deactivate, and delete

• Group membership changes

• Entra ID directory role assignments

When do I need to set Default domain?

Set Default domain if you want YeshID to create users from account names that are not already full Microsoft 365 user principal names.

For example:

• account name alice

• default domain contoso.com

• created UPN alice@contoso.com

If the account name is already a full UPN, YeshID uses that value directly.

Why are directory roles missing or failing to sync?

Usually this means one of these is true:

• The connection was authorized before the role-management scope was added

• The OAuth grant was not reauthorized after a scope change

• The connected admin account does not have enough Microsoft Graph or Entra administrative privileges

If needed, reconnect and reauthorize the integration.

Why are group or user actions failing even though OAuth succeeded?

OAuth success only means Microsoft accepted the consent flow.

Provisioning actions can still fail if the connected admin account does not have enough Microsoft 365 or Entra privileges for the target operation.

Do I need a Global Administrator forever?

Not necessarily.

A Global Administrator is the safest choice for initial setup and troubleshooting. If your organization uses a narrower delegated admin model, you can test whether a lower-privilege admin role is sufficient for the specific YeshID actions you want to use.