Azure Entra ID Connection

Learn how to configure an Azure Entra ID Connection for Infisical.

Infisical’s Azure Entra ID Connection lets you authenticate with Microsoft Entra ID (formerly Azure Active Directory) using Client Secrets.

Prerequisites:

• Set up an Azure account with an existing Azure Entra ID tenant.
• Register an App Registration in Azure with the necessary Microsoft Graph API permissions for your use case.

Required Azure Permissions

The permissions required for your Azure Entra ID Connection depend on what you intend to use it for.

For SCIM Token Secret Sync:

Your App Registration must have the following Microsoft Graph API Application permissions:

• Application.ReadWrite.All — Required to read and update synchronization secrets (SCIM tokens) on enterprise application service principals.

• Synchronization.ReadWrite.All — Required to list synchronization jobs on service principals and to write SCIM provisioning tokens.

  

After adding the permission, an admin must Grant admin consent for the permission to take effect.

If you want to configure automatic client secret rotation for this App Connection, you also need to grant either Application.ReadWrite.OwnedBy or Application.ReadWrite.All permissions.

Setup Azure Entra ID Connection in Infisical

Infisical UI

1. Navigate to App Connections

   Navigate to the Organization Settings page, then select App Connections. Click on the Add Connection button.

   
2. Add Connection

   Select the Azure Entra ID option from the connection options modal.

   
3. Create Connection

   Fill in the following fields with the credentials from your Azure App Registration:

   • Tenant ID: The Directory (Tenant) ID of your Azure Entra ID tenant.
   • Client ID: The Application (Client) ID of your registered application.
   • Client Secret: A client secret generated for your registered application.

   Click Connect to create the connection.

   

   You can optionally enable Automatic Credential Rotation for this connection. See the Automatic Credential Rotation section below for details.

4. Connection Created

   Your Azure Entra ID Connection is now available for use with features such as the Azure Entra ID SCIM Secret Sync.

API

To create an Azure Entra ID Connection via API, send a request to the Create Azure Entra ID Connection endpoint.

Sample request

Request

curl    --request POST \
        --url https://app.infisical.com/api/v1/app-connections/azure-entra-id \
        --header 'Content-Type: application/json' \
        --data '{
            "name": "my-azure-entra-id-connection",
            "method": "client-secret",
            "credentials": {
                "tenantId": "your-tenant-id",
                "clientId": "your-client-id",
                "clientSecret": "your-client-secret"
            }
        }'

Sample response

Response

{
  "appConnection": {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "my-azure-entra-id-connection",
      "description": null,
      "version": 1,
      "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
      "createdAt": "2023-11-07T05:31:56Z",
      "updatedAt": "2023-11-07T05:31:56Z",
      "isPlatformManagedCredentials": false,
      "app": "azure-entra-id",
      "method": "client-secret",
      "credentials": {}
  }
}

Automatic Credential Rotation

Infisical can automatically rotate the Client Secret of your Azure application on a recurring schedule. When enabled, Infisical will immediately generate a new Client Secret on connection creation and revoke the original one, ensuring that no external party retains access using the credentials you provided.

1. Locate the Key ID of your Client Secret

   Before enabling rotation, you’ll need the Key ID of the Client Secret you are using to authenticate. Navigate to your App Registration in the Azure Portal, then go to Certificates & secrets. Copy the Secret ID (Key ID) of the secret you are providing to Infisical.

   
2. Enable Automatic Credential Rotation

   When creating or editing your connection, toggle on the Automatic Credential Rotation switch.

   
3. Provide the Client Secret Key ID

   Enter the Key ID you copied in the previous step into the Client Secret Key ID field. Infisical uses this to revoke your original secret after generating a new one.

   
4. Configure the Rotation Schedule

   Set the Rotation Interval (in days) to define how often the credential should be rotated, and set Rotate At to the local time of day at which the rotation should occur.

   • Rotation Interval - How many days between each rotation.

   • Rotate At - The local time of day at which the rotation will be triggered.