Integration Guide: Microsoft Entra

Overview

Microsoft Entra ID is an Identity Provider (IDP) integration. Connecting Entra ID imports Users and their organizational data into Tello IAM, detects existing permissions across the Entra directory, and enables Tello to provision and deprovision access in Entra on behalf of the Administrator. It is the most common first integration in a Tello IAM environment.

This guide covers connecting Microsoft Entra ID, authorizing the integration, and verifying the connection. For general information about managing integrations after they are connected, see Configuring Integrations.

Before connecting

Required authorization

Connecting Microsoft Entra ID requires a Global Administrator account in the target Entra directory. The Global Administrator must be present to complete the authorization flow in Microsoft. If the Administrator does not hold this role, coordinate with the appropriate person before proceeding — the connection cannot be completed without it.

Set user attributes in Entra first

Tello IAM imports user attributes from Entra ID during the initial sync, including Job Title and Department. These attributes populate the corresponding fields on User records in Tello and are used for filtering, Team assignment, and reporting.

Set the Job Title and Department for all Users in Entra ID before connecting the integration. Attributes that are blank at the time of the initial sync will not be populated retroactively — they will import on the next sync only if updated in Entra.

Connect Microsoft Entra ID

1. Navigate to Integrations in the left navigation.
2. Select + Add Integration.
3. Locate Microsoft Entra ID in the catalog. Use the Search integrations… field to filter by name if needed.
4. Select Add next to Microsoft Entra ID.
5. Enter the organization's Entra ID tenant domain in the Entra ID Tenant Domain field. The domain follows the format contoso.onmicrosoft.com or contoso.com.
6. Select Login to Microsoft Entra ID. Tello IAM redirects to Microsoft for authorization.
7. Sign in with a Global Administrator account.
8. Microsoft Entra ID displays a permissions request for the application. Select the option to consent on behalf of your organization and select Accept.
9. After authorization is complete, Microsoft redirects back to Tello IAM. A Connection Established message confirms the connection.
10. Assign a friendly name to the integration if needed, then select Done. Tello IAM begins the initial sync.

Friendly names: Tello IAM assigns a default name to the integration at connection. A friendly name makes it easier to identify in lists and reports — particularly useful if more than one Entra ID tenant is connected. The name can be updated at any time from the IAM Connection panel. See Configuring Integrations for steps.

What Tello IAM imports from Entra ID

Once connected and synced, Tello IAM imports the following data from Microsoft Entra ID:

• Users — every account in the connected directory is discovered and added to Tello IAM as a User record
• Identity data — display name and email address for each User
• Organizational data — Job Title, Department, and other directory attributes configured in Entra
• Detected permissions — existing access the User holds in Entra ID, including group memberships and license assignments, surfaces as detected permissions on the User record

Verify the connection

After the initial sync completes, confirm the following:

• The Entra ID integration displays a status of Active on the Integrations page
• A sync timestamp is present and reflects the completed sync
• Navigate to Users and confirm that User records are present and match the expected headcount from the Entra directory
• User records display the correct identity and organizational data — name, email, Job Title, and Department
• The Access column on User records shows detected permissions from Entra ID

If the integration does not show as Active after the initial sync, select Sync Now from the Integrations page to trigger a manual sync. If the status does not update, review the authorization and confirm that the Global Administrator account used during setup has not had its permissions changed in Entra.

Non-person objects: Entra ID may import Shared Mailboxes, Distribution Lists, and other non-person objects as User records. If these appear in Tello IAM and do not need to be managed, select the User record and select Mute to hide it and suppress all related notifications.

Permissions granted to Tello IAM

During the authorization flow, the Global Administrator grants Tello IAM the permissions it needs to read directory data and manage access in Entra ID on behalf of the organization. These permissions are requested by Tello IAM and displayed on the Microsoft consent screen before the Administrator accepts. Tello IAM does not request permissions beyond what is required to perform the operations the Administrator initiates within the platform.

Reauthorizing the connection

If the Entra ID integration loses authorization — for example, if the Global Administrator account used during setup is removed or its permissions are changed — the integration will display an error on the Integrations page. To reauthorize:

1. Select the Entra ID integration row to open the IAM Connection panel.
2. Select Configure.
3. Follow the authorization steps again with a valid Global Administrator account.

Related articles

• Configuring Integrations — sync schedule, drift detection, managing and removing integrations
• Getting Started Part 2: Connect your IDP & HR Integrations — guided walkthrough for first-time setup