> ## Documentation Index > Fetch the complete documentation index at: https://docs.parable.work/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Entra ID > Sync users and groups from Microsoft Entra ID (Azure AD) Sync users and groups from Microsoft Entra ID (Azure AD). Create an Azure AD app registration to connect Parable to Microsoft 365 using OAuth 2.0 client credentials. This enables secure, automated access without user sign-in. ## Data streams This Provider Plugin defines 0 data streams. | Stream | Description | Sync | | ------ | ------------------------------------------------- | ---- | | — | No customer-selectable data streams are declared. | — | ### App registration #### What You'll Need | Credential | What it is | | ----------------- | -------------------------- | | **Tenant ID** | Azure AD tenant identifier | | **Client ID** | Application (client) ID | | **Client Secret** | Generated client secret | > **Info:** **Setup access in Azure.** These steps require **Administrator**, or a colleague with equivalent permissions who can create credentials for you. > > If that is not you, ask your Azure administrator. * **Global Administrator** or **Application Administrator** role in Azure AD * Permission to grant admin consent for API permissions #### Step 1: Access Azure Portal 1. Navigate to Azure Portal 2. Go to **Azure Active Directory** → **App registrations** 3. Click **New registration** #### Step 2: Register Application | Field | Value | | ----------------------- | ----------------------------------------------- | | Name | `Parable Integration` | | Supported account types | Accounts in this organizational directory only | | Redirect URI | Leave blank (not needed for client credentials) | Click **Register** #### Step 3: Note Application Details From the **Overview** page, copy: * **Application (client) ID** * **Directory (tenant) ID** #### Step 4: Create Client Secret 1. Go to **Certificates & secrets** 2. Click **New client secret** 3. Add description: `Parable Integration Secret` 4. Select expiration (recommend: 24 months) 5. Click **Add** > **Warning:** Copy the secret **Value** immediately - it won't be shown again! #### Step 5: Configure API Permissions 1. Go to **API permissions** 2. Click **Add a permission** → **Microsoft Graph** 3. Select **Application permissions** 4. Add these permissions: | Permission | Purpose | | ------------------------- | ---------------------------------------------------------------------------- | | `User.Read.All` | Read all user profiles | | `Directory.Read.All` | Read directory data (also covers org metadata and channel list when present) | | `Team.ReadBasic.All` | Read Microsoft Teams details | | `Channel.ReadBasic.All` | List Teams channels (required if Directory.Read.All is not granted) | | `ChannelMessage.Read.All` | Read Teams channel messages via the Teams export API | | `ChannelMember.Read.All` | Read Teams channel membership | | `AuditLog.Read.All` | Read sign-in and directory audit logs | | `AuditLogsQuery.Read.All` | Read Microsoft Purview audit log queries | | `Mail.Read` | Read mail (if needed) | | `Calendars.Read` | Read calendars (if needed) | > **Warning:** `ChannelMessage.Read.All` is a protected Teams export permission. Admin > consent alone is not enough: Microsoft must also approve protected-API > access for your app, and your tenant needs Teams message export > eligibility. See Microsoft's > [Export content with the Microsoft Teams export APIs](https://learn.microsoft.com/en-us/microsoftteams/export-teams-content) > guide. Until that is in place, leave the Parable `channel_messages` tap > disabled (it ships opt-in). #### Step 6: Grant Admin Consent 1. Click **Grant admin consent for \[Your Org]** 2. Confirm the consent dialog > **Info:** All permissions should show a green checkmark indicating consent was granted. > Channel / message taps that ship disabled stay off until you enable them > in Parable after consent and protected-API approval succeed. #### Step 7: Enter values in the form 1. **Tenant ID**, **Client ID**, and **Client Secret**: Paste the Directory (tenant) ID, Application (client) ID, and client secret value. 2. Click **Save & test connection**. By default, Microsoft Graph application permissions can cover every user in the directory. Use Microsoft's [mailbox access guidance](https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access) when your organization needs to restrict the app to an approved population. ```bash Get Access Token theme={null} curl -X POST "https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "client_id={CLIENT_ID}" \ -d "client_secret={CLIENT_SECRET}" \ -d "scope=https://graph.microsoft.com/.default" \ -d "grant_type=client_credentials" ``` ```bash Test API Access theme={null} curl -H "Authorization: Bearer {ACCESS_TOKEN}" \ "https://graph.microsoft.com/v1.0/users?\$top=5" ``` > **Success:** **Success!** If you received a `200 OK` response with valid data, your credentials are configured correctly. You can now configure this Provider in Parable. > **Tip:** Enter **Tenant ID**, **Client ID**, and **Client Secret** in the Provider form, then click **Save & test connection**. ### App registration | Permission | Data Accessed | | ------------------------- | --------------------------------------------------------------------------------------------------------------------- | | `User.Read.All` | User profiles, managers, photos | | `Directory.Read.All` | Groups, org hierarchy, devices; sufficient for listing channels when granted | | `Team.ReadBasic.All` | Microsoft Teams names, settings, and membership counts | | `Channel.ReadBasic.All` | Channel list (standard / private / shared) when Directory.Read.All is not used | | `ChannelMessage.Read.All` | Channel message content via Teams export APIs (protected API; Global cloud only - not US Gov L4/L5 or China 21Vianet) | | `ChannelMember.Read.All` | Teams channel member lists | | `AuditLog.Read.All` | Sign-in logs, directory audits | | `AuditLogsQuery.Read.All` | Purview audit log records (SharePoint/OneDrive file operations) | | `Mail.Read` | Email metadata and content | | `Calendars.Read` | Calendar events and availability | > **Info:** Channel message export covers public and private channels. Shared-channel > coverage follows Microsoft Graph's getAllMessages behavior and may omit > some shared-channel traffic. 1:1 and group chats are not included in this > Provider version. > **Tip:** **Rate Limits:** Microsoft Graph enforces rate limits of **10,000 requests per 10 minutes per app; throttling returns 429 with Retry-After header**. > > Parable handles rate limiting automatically with exponential backoff, but initial syncs of large datasets may take longer due to these limits. This Provider Plugin does not declare any data streams. | Error | Meaning | Solution | | --------------- | --------------------- | --------------------------------------------- | | `AADSTS700016` | App not found | Verify Client ID and Tenant ID | | `AADSTS7000215` | Invalid client secret | Regenerate client secret | | `AADSTS65001` | Consent not granted | Grant admin consent for permissions | | `403 Forbidden` | Missing permission | Add required API permission and grant consent | #### Common Issues #### "Insufficient privileges to complete the operation" Ensure admin consent was granted for all required permissions. Check **API permissions** in the app registration. #### Token expires quickly Access tokens are valid for \~1 hour. Implement proper token refresh using the client credentials flow. **[Microsoft Graph API](https://docs.microsoft.com/en-us/graph/overview)** - Official Graph API documentation **[App Registration](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)** - Azure AD app registration guide