Skip to main content

Microsoft Entra ID (Azure Active Directory Integration)

Written by Efrat Barak Zadok

Integrating with Microsoft allows a full data transfer and removes any manual error since the data is synced automatically once a day from Shapes.

Set up an App Registration in Microsoft Entra

  1. In the Microsoft Entra admin center, go to "App registrations"

    Microsoft Entra admin center with App registrations menu item highlighted

  2. In the "App registrations" tab, create a "New registration"

    App registrations tab with New registration button

  3. Fill out the name, leave the rest as default and click "Register"

    App registration form with name field and Register button

  4. Make a note of your Application (client) ID and Directory (tenant) ID - you will need these later when integrating from the Shapes side

    App registration overview page showing Application (client) ID and Directory (tenant) ID

  5. Go to the "Certificates & Secrets" tab

    Certificates and Secrets tab in app registration

  6. Click on "New client secret"

    New client secret button on the Certificates and Secrets tab

  7. Fill out the description and expiration (note the expiration will need to be replaced manually). Click "Add" and make a note of your secret value (also required when integrating from the Shapes side)

    New client secret form with description, expiration, and secret value

  8. Under the "API permissions" tab, click on "Add a permission"

    API permissions tab with Add a permission button

  9. Click on "Application permissions"

    Application permissions option when adding an API permission

  10. Check the boxes called User.Read.All, User.ReadWrite.All and User-Phone.ReadWrite.All, and click on "Add permissions"

    Permission checkboxes for User.Read.All, User.ReadWrite.All and User-Phone.ReadWrite.All
    Confirmation of selected application permissions

  11. Repeat the process for Directory.Read.All and Directory.ReadWrite.All

    Directory.Read.All and Directory.ReadWrite.All permission selection

  12. In the configured permissions, click "Grant admin consent for Shapes"

    Grant admin consent for Shapes button in configured permissions

  13. The status is now changed to granted and you have the permissions!

    Permission status showing Granted

All Super Admins can integrate data from Shapes with Microsoft Azure.

Connect the integration from Shapes

  1. Enter Shapes' account settings -> Integrations -> Microsoft

    Shapes account settings Integrations page with Microsoft option

  2. Click on the "Connect" button

    Connect button for the Microsoft integration in Shapes

  3. Fill out the Directory (tenant) ID, Application (client) ID and Secret Value, and click "Connect"

    Microsoft integration form with Directory ID, Application ID, and Secret Value fields

What data from Shapes is automatically synced to EntraID?

Shapes Field name

EntraID Field name

Email address

userPrincipalName, mailNickname

First name

givenName

Last name

surname

Job

jobTitle

Phone number

mobilePhone

Team

Department

Reports to

manager

First name +last name

displayname

Office

Office

You can contact support@shapes.co to choose which fields you'd like to sync and/or enable any additional filters.

Troubleshooting: Provisioning Fails Silently

Most common provisioning trap: Microsoft Entra requires a usage location to be set on new users before licenses can be assigned. If this isn't configured, provisioning can fail without a visible error — the employee simply never shows up in Entra, with nothing in Shapes flagging why. If a new hire isn't appearing in Entra after being created in Shapes, this is the first thing to check with your Microsoft admin.

Did this answer your question?