To connect Dex to Microsoft Entra ID (Azure AD) for user and group management, register an Entra app and grant it directory Graph permissions.
Steps
1In the Microsoft Entra admin center, go to Entra ID → App registrations → New registration; name it, choose "Single tenant", and Register.
2Copy the Application (client) ID and Directory (tenant) ID from the Overview page.
3Under Certificates & secrets → Client secrets, create a New client secret and copy its Value immediately.
4Under API permissions → Add a permission → Microsoft Graph → Application permissions, add User.Read.All (or User.ReadWrite.All for changes), Group.Read.All (or Group.ReadWrite.All), and Directory.Read.All.
5Click "Grant admin consent for <tenant>" and confirm the green checkmarks.
Paste into Dex
The connection form in the Dex app store asks for these values:
