> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Entra ID OAuth 2.0 (Tenant) connector profile – StackOne setup guide > Set up the OAuth 2.0 (Tenant) connector profile for Microsoft Entra ID in StackOne. One-time admin setup required before your users can link Microsoft Entra ID accounts via Hub. You must have at least Application Developer permissions in your Azure account to register applications in Microsoft Entra ID. A Global Administrator must grant admin consent for the required directory permissions.
Select Actions to adjust the guide
Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.
Action
Scope(s)
Loading actions...
Dynamic Guide URL
Scopes Selected

          

            
Separator

Register Your Application in Microsoft Entra ID

To connect Microsoft Entra ID with StackOne, you need to register an application in Microsoft Entra ID to obtain OAuth 2.0 credentials.

Sign in to the Microsoft Entra admin center as at least an Application Developer. If you have access to multiple tenants, click the Settings (gear) icon in the top-right corner, then select the desired tenant from the list under Directory + subscription.

From the left sidebar, go to App registrations and click on New registration.

  • Enter a meaningful Name for your app (e.g., StackOne Entra ID Integration).
  • Under Supported account types, select Accounts in this organizational directory only for single-tenant access.
  • Select Register to create the app registration.

After registration, you'll be directed to the application's Overview page. Copy the Application (client) ID and Directory (tenant) ID values and store them securely for use later.

Configure Redirect URI

Set up the OAuth 2.0 callback URL to enable authentication flow between StackOne and Microsoft Entra ID.

From your app's Overview page, select Authentication from the left menu under Manage.

Under Redirect URI configuration, click Add Redirect URI, select Web, enter the StackOne OAuth callback URL, and click Configure.

  • Redirect URI: `https://api.stackone.com/connect/oauth2/microsoftentraid/callback`

Configure API Permissions

Grant your application the necessary Microsoft Graph API permissions.

From the left menu under Manage, select API permissions.
Enables actions: Add App Role Assignment To Service Principal, Add Directory Role Member, Add Group Member, Assign App Role To User, Create Application, Create Conditional Access Policy, Create Country Named Location, Create Domain, Create Group, Create IP Named Location, Create OAuth2 Permission Grant, Create Service Principal, Create User, Delete Application, Delete Conditional Access Policy, Delete Device, Delete Domain, Delete Group, Delete Named Location, Delete OAuth2 Permission Grant, Delete Service Principal, Delete User, Get Application, Get Conditional Access Policy, Get Device, Get Directory Role, Get Domain, Get Group, Get Named Location, Get OAuth2 Permission Grant, Get Organization, Get Service Principal, Get User, List Applications, List Conditional Access Policies, List Device Group Memberships, List Device Registered Owners, List Device Registered Users, List Devices, List Directory Role Members, List Directory Roles, List Domain Service Configuration Records, List Domain Verification DNS Records, List Domains, List Group Members, List Groups, List Named Locations, List OAuth2 Permission Grants, List Organizations, List Role Templates, List Service Principal App Role Assignments, List Service Principals, List User App Role Assignments, List Users, Remove App Role Assignment From Service Principal, Remove App Role From User, Remove Directory Role Member, Remove Group Member, Update Application, Update Conditional Access Policy, Update Device, Update Group, Update OAuth2 Permission Grant, Update Organization, Update Service Principal, Update User, Verify Domain

Click Add a permission, select Microsoft Graph, then select Delegated permissions. This auth option uses an interactive OAuth 2.0 flow on behalf of a signed-in user and only supports delegated permissions. Enable the required scopes and click Add permissions to save.

Click Grant admin consent for \[tenant name] and select Yes. A Global Administrator is required to grant consent for directory-level permissions.

Generate Client Secret

Create a client secret that will be used to authenticate your application with Microsoft Entra ID.

From the left menu under Manage, select Certificates & secrets.

Under the Client secrets tab, click New client secret.

  • Add a Description (e.g., StackOne Entra ID Integration Secret).
  • Select an appropriate expiration period.
  • Click Add.

Immediately copy the Value of the newly created client secret and store it securely. This value will only be shown once and cannot be retrieved again.
## Creating the StackOne Connector Profile To create the Connector Profile in StackOne for Microsoft Entra ID: Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)
  • Click + Connector Profile
  • Search for and select Microsoft Entra ID
  • Select Type as OAuth 2.0 (Tenant)
  • Fill out the fields using details retrieved from your provider:
    • Client ID
    • Client Secret
    • Tenant ID
    • Scopes (Optional)
  • (Optional) Select Actions to be enabled for this Connector Profile
  • Click Create profile
 Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Microsoft Entra ID.