Overview Entra ID Connector

The IDHub Entra connector manages accounts, groups, and roles across all available domains within Entra for Business, Education, or other environments, provided the service account configured in the application has sufficient access to those domains.

The Entra connector also:

• Leverages Azure's Change Stream to monitor changes.
• Syncs data with IDHub every 5 minutes to ensure up-to-date information.
• Entra ID connection leverages the most recent Microsoft graph API.
• Entra ID connector provides Out Of the Box functionality that aids in differentiating between Office 365 groups and security groups.

Entra manages accounts, groups, and roles within the Azure organization infrastructure.

tip

Entra is the new name for Azure Active Directory (Azure AD). This guide refers to the connector as 'Entra' except where 'Azure AD' is still utilized, such as in some user interface configurations.

note

For more information about the Connector Health and it's status, Click here

Architecture

The connector's architecture is constructed in accordance with the diagram below. The connector architecture primarily consists of a connector application and a target system component. The native communication with the target system is handled by the target system by leveraging the SPI implementation of the Entra ID Specific connection. This architecture is implemented because it allows for rapid and straightforward connector deployment as well as precise versioning capabilities. Microsoft Graph API is used for provisioning and reconciliation from Microsoft Entra ID.

Features

• Account Management for Users (B2B)
• Account - Group Management
• Microsoft Teams
• Microsoft Entra ID Role Management
• License Plan Management
• Authentication Features
  • OAuth 2.0 Authentications
  • Multi-factor Authentication(MFA) Management
  • Single Sign On (SSO) Management
• Change Stream

Below are the features in details.

Account Management for Users(B2B)

This section describes the supported features of Entra ID Connector for Users management:

Operation	Supported
Create user	Yes
Update user	Yes
Enable/Disable user	Yes
Set Password	Yes
Fetch Account	Yes
Account Reconciliation	Yes
Add/Remove Entitlements for User --> Add/Remove Individual License Plans, Add/Remove Roles, Add/Remove Group Memberships	Yes

note

Federated Users are synchronized with On-Prem Active Directory

Account - Group Management

Our connector pulls all Entra Groups and keep them in IDHub as Entitlement type ‘Group’. We supports many group types and keep them as separate group objects. Each of them has a distinct purpose in Entra ID. They are as follows:

• Microsoft 365 groups (formerly Office 365 groups) - For segregation of internal and external users.
• Distribution Lists (Distribution groups) - For email notifications to specific group.
• Security groups - For Sharepoint site access.
• Mail-enabled security groups - For resource and notification accesses.

Microsoft Teams

Teams are upper layer of Microsoft 365 groups. It provides access to workspace chat, video meetings, file storage and application integrations. These are represented as Entitlement Type - ‘Group’ in IDHub because our connector deals with directory objects.

Following features are supported for Microsoft 365 group.

Operation	Supported
Add/Remove Owner	Yes
Add/Remove Member	Yes

Entra ID Admin Role Management

Microsoft Entra ID roles grants granular permissions to administrators, abiding by the principle of least privilege. The roles in Entra ID controls access to users, groups, and applications. There are 2 type of roles in Entra ID

• Built-in roles - Built-in roles are out of box roles by Entra which provides a fixed set of permissions. This role definition cannot be modified.
• Custom roles - This is for any custom requirements

Following features are supported for Microsoft Entra ID Roles.

Operation	Supported
Provision Member Access to Roles	Yes
Remove Member Access to Roles	Yes
Reconcile Roles	Yes
Reconcile Member Access to Roles	Yes

License Plan Management

For Azure Cloud, Subscriptions are managed by IDHub as well as it pulls Azure Management Objects as well.

• Management Groups
• Subscriptions
• Resource Groups

Thus License Plan (Service Plan) is managed in Entra ID connector as well with Entitlement type as ‘License’.

Operation	Supported
Provision Member to License Plan	Yes
Remove Member from License Plan	Yes
Reconcile License Plans	Yes
Reconcile Members in License Plan	Yes

Authentication Features

IDHub uses Keycloak to use its Authentication features. SAML based Single Sign-On and MFA Setup can be done with your Entra ID instance outside of Connector features.

Change Stream

Connector has a robust reconciliation feature along with change stream function of Entra ID. Some of the reconciliation features are as follows:

Account Reconciliation: This can be performed to bring all existing user data from the target system to IDHub. If the target system has an attribute that stores the timestamp at which an item is created or modified, IDHub performs incremental reconciliation once the first reconciliation operation has been completed to get account information to IDHub more efficiently.

Entitlement Reconciliation: Entitlements like Microsoft Groups, Roles, License Plans can be reconciled on demand as well. It will update all associated user accounts for each entitlement as well as entitlement metadata when reconciled (synced)

info

IDHub uses change stream to pull all account and entitlement related information every 5 minutes to update the IDHub. Make sure to avail stale data function of IDHub to remove user accounts from IDHub is they are no longer present in your Entra ID.

tip

Connector Server is one of the features provided by IDHub. By using one or more connector servers, the connector architecture permits your application to communicate with externally deployed bundles. Therefore if you do not want to execute IDHub java connector bundle in the same VM as the application, in that case you have the ability to run the connector on a different host for better performance.