> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Entra ID Connection

> Learn how to configure an Azure Entra ID Connection for Infisical.

Infisical's Azure Entra ID Connection lets you authenticate with Microsoft Entra ID (formerly Azure Active Directory) using Client Secrets.

**Prerequisites:**

* Set up an [Azure](https://portal.azure.com) account with an existing Azure Entra ID tenant.
* Register an App Registration in Azure with the necessary Microsoft Graph API permissions for your use case.

<Accordion title="Required Azure Permissions">
  The permissions required for your Azure Entra ID Connection depend on what you intend to use it for.

  **For SCIM Token Secret Sync:**

  Your App Registration must have the following **Microsoft Graph API Application permissions**:

  * `Application.ReadWrite.All` — Required to read and update synchronization secrets (SCIM tokens) on enterprise application service principals.
  * `Synchronization.ReadWrite.All` — Required to list synchronization jobs on service principals and to write SCIM provisioning tokens.

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/azure-required-permissions.png" alt="Azure Entra ID SCIM Token Sync Permissions" />

  <Note>
    After adding the permission, an admin must **Grant admin consent** for the permission to take effect.
  </Note>

  <Note>If you want to configure automatic client secret rotation for this App Connection, you also need to grant either `Application.ReadWrite.OwnedBy` or `Application.ReadWrite.All` permissions.</Note>
</Accordion>

## Setup Azure Entra ID Connection in Infisical

<Tabs>
  <Tab title="Infisical UI">
    <Steps>
      <Step title="Navigate to App Connections">
        Navigate to the **Organization Settings** page, then select **App Connections**. Click on the **Add Connection** button.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png" alt="App Connections Tab" />
      </Step>

      <Step title="Add Connection">
        Select the **Azure Entra ID** option from the connection options modal.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/select-entra-id-connection.png" alt="Add Azure Entra ID Connection" />
      </Step>

      <Step title="Create Connection">
        Fill in the following fields with the credentials from your Azure App Registration:

        * **Tenant ID**: The Directory (Tenant) ID of your Azure Entra ID tenant.
        * **Client ID**: The Application (Client) ID of your registered application.
        * **Client Secret**: A client secret generated for your registered application.

        Click **Connect** to create the connection.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/create-app-connection.png" alt="Fill in Azure Entra ID Connection Details" />

        <Tip>
          You can optionally enable **Automatic Credential Rotation** for this connection. See the [Automatic Credential Rotation](#automatic-credential-rotation) section below for details.
        </Tip>
      </Step>

      <Step title="Connection Created">
        Your **Azure Entra ID Connection** is now available for use with features such as the Azure Entra ID SCIM Secret Sync.
      </Step>
    </Steps>
  </Tab>

  <Tab title="API">
    To create an Azure Entra ID Connection via API, send a request to the [Create Azure Entra ID Connection](/docs/api-reference/endpoints/app-connections/azure-entra-id/create) endpoint.

    ### Sample request

    ```bash Request theme={"dark"}
    curl    --request POST \
            --url https://app.infisical.com/api/v1/app-connections/azure-entra-id \
            --header 'Content-Type: application/json' \
            --data '{
                "name": "my-azure-entra-id-connection",
                "method": "client-secret",
                "credentials": {
                    "tenantId": "your-tenant-id",
                    "clientId": "your-client-id",
                    "clientSecret": "your-client-secret"
                }
            }'
    ```

    ### Sample response

    ```json Response theme={"dark"}
    {
      "appConnection": {
          "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
          "name": "my-azure-entra-id-connection",
          "description": null,
          "version": 1,
          "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
          "createdAt": "2023-11-07T05:31:56Z",
          "updatedAt": "2023-11-07T05:31:56Z",
          "isPlatformManagedCredentials": false,
          "app": "azure-entra-id",
          "method": "client-secret",
          "credentials": {}
      }
    }
    ```
  </Tab>
</Tabs>

## Automatic Credential Rotation

Infisical can automatically rotate the Client Secret of your Azure application on a recurring schedule. When enabled, Infisical will immediately generate a new Client Secret on connection creation and revoke the original one, ensuring that no external party retains access using the credentials you provided.

<Steps>
  <Step title="Locate the Key ID of your Client Secret">
    Before enabling rotation, you'll need the **Key ID** of the Client Secret you are using to authenticate. Navigate to your App Registration in the Azure Portal, then go to **Certificates & secrets**. Copy the **Secret ID** (Key ID) of the secret you are providing to Infisical.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/credential-rotation-key-id.png" alt="Azure Client Secret Key ID" />
  </Step>

  <Step title="Enable Automatic Credential Rotation">
    When creating or editing your connection, toggle on the **Automatic Credential Rotation** switch.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/credential-rotation-toggle.png" alt="Enable Automatic Credential Rotation" />
  </Step>

  <Step title="Provide the Client Secret Key ID">
    Enter the **Key ID** you copied in the previous step into the **Client Secret Key ID** field. Infisical uses this to revoke your original secret after generating a new one.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/credential-rotation-key-id-field.png" alt="Client Secret Key ID Field" />
  </Step>

  <Step title="Configure the Rotation Schedule">
    Set the **Rotation Interval** (in days) to define how often the credential should be rotated, and set **Rotate At** to the local time of day at which the rotation should occur.

    * **Rotation Interval** - How many days between each rotation.
    * **Rotate At** - The local time of day at which the rotation will be triggered.

          <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/entra-id/credential-rotation-schedule.png" alt="Rotation Schedule" />
  </Step>
</Steps>