> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Entra ID connection

> Learn how to configure an Azure Entra ID Connection for Infisical.

Infisical's Azure Entra ID Connection lets you authenticate with Microsoft Entra ID (formerly Azure Active Directory) using Client Secrets.

**Prerequisites:**

* Set up an [Azure](https://portal.azure.com) account with an existing Azure Entra ID tenant.
* Register an App Registration in Azure with the necessary Microsoft Graph API permissions for your use case.

> [accordion] Required Azure Permissions
>
> The permissions required for your Azure Entra ID Connection depend on what you intend to use it for.
>
> **For SCIM Token Secret Sync:**
>
> Your App Registration must have the following **Microsoft Graph API Application permissions**:
>
> * `Application.ReadWrite.All` — Required to read and update synchronization secrets (SCIM tokens) on enterprise application service principals.
>
> * `Synchronization.ReadWrite.All` — Required to list synchronization jobs on service principals and to write SCIM provisioning tokens.
>
>   ![Azure Entra ID SCIM Token Sync Permissions](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/azure-required-permissions.png)
>
> > [!NOTE]
> >
> > After adding the permission, an admin must **Grant admin consent** for the permission to take effect.
>
> > [!NOTE]
> >
> > If you want to configure automatic client secret rotation for this App Connection, you also need to grant either `Application.ReadWrite.OwnedBy` or `Application.ReadWrite.All` permissions.

## Setup Azure Entra ID connection in Infisical

> [tab] Infisical UI
>
> **1. Navigate to App Connections**
>
> Go to **Integrations** in your organization, then select **App Connections** and select **Add Connection**.
>
> ![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)
>
> **2. Add Connection**
>
> Select the **Azure Entra ID** option from the connection options modal.
>
> ![Add Azure Entra ID Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/select-entra-id-connection.png)
>
> **3. Create Connection**
>
> Fill in the following fields with the credentials from your Azure App Registration:
>
> * **Tenant ID**: The Directory (Tenant) ID of your Azure Entra ID tenant.
> * **Client ID**: The Application (Client) ID of your registered application.
> * **Client Secret**: A client secret generated for your registered application.
>
> Click **Connect** to create the connection.
>
> ![Fill in Azure Entra ID Connection Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/create-app-connection.png)
>
> > [!TIP]
> >
> > You can optionally enable **Automatic Credential Rotation** for this connection. See the [Automatic Credential Rotation](#automatic-credential-rotation) section below for details.
>
> **4. Connection Created**
>
> Your **Azure Entra ID Connection** is now available for use with features such as the Azure Entra ID SCIM Secret Sync.

> [tab] API
>
> To create an Azure Entra ID Connection via API, send a request to the [Create Azure Entra ID Connection](https://infisical.com/docs/api-reference/endpoints/app-connections/azure-entra-id/create.md) endpoint.
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl    --request POST \
>         --url https://app.infisical.com/api/v1/app-connections/azure-entra-id \
>         --header 'Content-Type: application/json' \
>         --data '{
>             "name": "my-azure-entra-id-connection",
>             "method": "client-secret",
>             "credentials": {
>                 "tenantId": "your-tenant-id",
>                 "clientId": "your-client-id",
>                 "clientSecret": "your-client-secret"
>             }
>         }'
> ```
>
> ### Sample response
>
> ```json Response theme={"dark"}
> {
>   "appConnection": {
>       "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
>       "name": "my-azure-entra-id-connection",
>       "description": null,
>       "version": 1,
>       "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
>       "createdAt": "2023-11-07T05:31:56Z",
>       "updatedAt": "2023-11-07T05:31:56Z",
>       "isPlatformManagedCredentials": false,
>       "app": "azure-entra-id",
>       "method": "client-secret",
>       "credentials": {}
>   }
> }
> ```

## Automatic credential rotation

Infisical can automatically rotate the Client Secret of your Azure application on a recurring schedule. When enabled, Infisical will immediately generate a new Client Secret on connection creation and revoke the original one, ensuring that no external party retains access using the credentials you provided.

**1. Locate the Key ID of your Client Secret**

Before enabling rotation, you'll need the **Key ID** of the Client Secret you're using to authenticate. Navigate to your App Registration in the Azure Portal, then go to **Certificates & secrets**. Copy the **Secret ID** (Key ID) of the secret you're providing to Infisical.

![Azure Client Secret Key ID](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/credential-rotation-key-id.png)

**2. Enable Automatic Credential Rotation**

When creating or editing your connection, toggle on the **Automatic Credential Rotation** switch.

![Enable Automatic Credential Rotation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/credential-rotation-toggle.png)

**3. Provide the Client Secret Key ID**

Enter the **Key ID** you copied in the previous step into the **Client Secret Key ID** field. Infisical uses this to revoke your original secret after generating a new one.

![Client Secret Key ID Field](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/credential-rotation-key-id-field.png)

**4. Configure the Rotation Schedule**

Set the **Rotation Interval** (in days) to define how often the credential should be rotated, and set **Rotate At** to the local time of day at which the rotation should occur.

* **Rotation Interval** - How many days between each rotation.
* **Rotate At** - The local time of day at which the rotation will be triggered.

  ![Rotation Schedule](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/credential-rotation-schedule.png)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.