Skip to main content
This guide walks you through registering an application in your Microsoft Entra ID (formerly Azure AD) tenant, granting the permissions Origin needs, and connecting the integration from the Origin dashboard. After the first sync, your users, groups, group memberships, devices (both Entra-joined and Intune-managed), and device-to-user assignments are available in Origin’s Directory Browser. The whole flow takes about ten minutes and requires a Microsoft work account with the Global Administrator, Privileged Role Administrator, or Cloud Application Administrator role — anyone who can grant tenant-wide admin consent for an application.

​
What You’ll End Up With

Initial sync runs as soon as you finish step 7. After that, Origin re-syncs every hour, plus an on-demand button in the dashboard.

​
Before You Begin

You need:
  1. An Entra admin account with one of the roles listed above.
  2. The Origin dashboard URL for your tenant — the public hostname you sign in to. The redirect URI you’ll register in Entra is https://<your-origin-hostname>/integrations/oauth-callback. For example, if you sign in at https://app.origin.example.com, the redirect URI is https://app.origin.example.com/integrations/oauth-callback.
  3. Your Origin tenant admin role — only Origin Admins can create directory integrations.
You do not need a pre-configured service principal. The setup below creates one.
Last sign-in time (last_login in the Directory Browser) is sourced from Entra’s signInActivity resource, which requires an Entra ID P1 or P2 license plus the AuditLog.Read.All Graph permission. On the free tier — or on P1/P2 without AuditLog.Read.All granted — Graph silently omits the field and Origin records the user’s last sign-in as the Unix epoch (1970-01-01). Stale-account detection that relies on this field will be best-effort until both prerequisites are in place. Everything else (users, groups, memberships, devices, owners) is available on the free tier with the permissions in step 2 below.

​
Setup Steps

1

Register the Application in Entra

Sign in to the Microsoft Entra admin center with your admin account, then:
  1. Navigate to Identity → Applications → App registrations → New registration.
  2. Fill in the registration form:
    • Name — something a future admin will recognize, e.g. Origin Directory Sync.
    • Supported account types — select Accounts in this organizational directory only (Single tenant).
    • Redirect URI — select Web and enter https://dashboard.originhq.com/integrations/oauth-callback. The hostname must match exactly (scheme, host, port, and path). Origin rejects callbacks whose redirect URI doesn’t match what was stamped into the OAuth state.
  3. Click Register.
You’ll land on the new app’s Overview page. Note down two values — you’ll need them in step 5:
  • Application (client) ID
  • Directory (tenant) ID
Keep the tab open.
2

Grant Microsoft Graph API Permissions

Origin uses application permissions (also called app-only or client_credentials), not delegated permissions, so the sync continues to run when no user is signed in.
  1. In the same app registration, click API permissions → Add a permission → Microsoft Graph → Application permissions.
  2. Add all six permissions in the table below. You can search by name; tick the checkbox and click Add permissions between groups if it’s easier.
  1. After all six are listed, click Grant admin consent for <your tenant> at the top of the table. You’ll be prompted to confirm — accept. Each row should now show a green check under Status.
If you see “Not granted for <tenant>” with a yellow warning after clicking Grant, your account doesn’t have one of the admin roles listed in the prerequisites. Either get the role assignment or hand this step to someone who has it — only the consent step is gated on it.
3

Confirm the Redirect URI

Step 1 already added the redirect URI, but it’s worth verifying — a typo here is the single most common reason the connect-to-Origin step fails.
  1. Go to Authentication → under Web → Redirect URIs.
  2. Confirm https://dashboard.originhq.com/integrations/oauth-callback is listed exactly as typed.
  3. Leave everything else on this page at its default. Origin does not need the implicit grant flow, ID tokens, or any extra “Front-channel logout” URI.
  4. Click Save if you changed anything.
4

Create a Client Secret

The secret is what the Origin backend presents to Microsoft to acquire Graph tokens after admin consent completes. It’s stored on Origin’s side encrypted under your tenant’s KMS-managed data key — Origin admins never see it in plaintext after entry.
  1. Go to Certificates & secrets → Client secrets → New client secret.
  2. Description — something descriptive, e.g. origin-directory-sync-2026-q2.
  3. Expires — pick the longest window your security policy allows. Origin will warn you in the dashboard 14 days before the secret expires (the integration’s status flips from Connected to At risk) so you can rotate before sync stops.
  4. Click Add.
The secret value is shown once under the Value column. Copy it to your clipboard immediately — once you navigate away, the column shows only the last few characters and you’ll need to create a new secret to recover. The Secret ID column is not the secret; you don’t need it.
5

Connect from the Origin Dashboard

  1. Sign in to your Origin dashboard at https://dashboard.originhq.com/.
  2. Go to Directory Integration in the left sidebar → + Add Integration (or click Add your first integration if this is the first one).
  3. Select Entra ID (Microsoft Entra ID).
  4. Fill in the connection form:
    • Display Name — anything; this is just a label in the integrations list.
    • Tenant ID — paste the Directory (tenant) ID from step 1.
    • Client ID — paste the Application (client) ID from step 1.
    • Client Secret — paste the Value you copied in step 4.
  5. Click Connect with Entra ID.
You’ll be redirected to Microsoft to grant admin consent. Pick the admin account you used in steps 1–4 (or sign in if prompted), review the permission list — it should match the six you added in step 2 — and click Accept.When you land back at the Origin dashboard, the integration row shows status Connected. If it shows No credentials stored for this integration instead, the secret didn’t make it through. Delete the row, return to step 4 to create a fresh secret, and re-run this step.
6

Trigger Your First Sync

Origin runs a periodic background sync, but you don’t need to wait. Click Sync in the row’s Actions column. The status flips to Syncing, then back to Connected with a populated Last Sync timestamp.A typical first sync takes a few seconds for small tenants and a couple of minutes for tenants with tens of thousands of users.If the sync turns the row red and shows an error, see the Troubleshooting section below.
7

Verify in the Directory Browser

  1. Go to Directory Integration → Directory Browser tab.
  2. The Users tab should list everyone Origin pulled.
  3. Click any user. The detail panel shows their direct groups under a Groups subsection — click any group to deep-link into that group’s detail.
  4. Go to the Groups tab → click any group. The detail panel shows direct user members and direct sub-groups (if your tenant uses nested groups). Click any member to jump back to that user.
  5. Check the Devices tab — Intune-managed devices show their serial number; Entra-joined devices that Intune hasn’t seen show a blank serial and the device’s displayName. Both share an Owner column resolved against synced users.
If you’ve registered endpoints in Origin and the device serial numbers match, you’ll see those endpoint rows light up with the matched directory user under an Assigned identity column.

​
What Gets Synced (and What Doesn’t)

Synced — full list:
  • Users (active and disabled) — display name, email, UPN, department, job title, office, manager, last sign-in (best-effort — see Before You Begin), account-enabled flag.
  • Groups — display name, description, type (security / distribution / Microsoft 365), member count, direct memberships, direct sub-groups.
  • Entra-joined devices — display name, OS, OS version, registered owners.
  • Intune-managed devices — hardware serial number, model, manufacturer, assigned UPN, compliance state, OS, OS version.
Not synced:
  • Photos, contacts, mailbox metadata, OneDrive, calendars, or any tenant data outside the directory itself.
  • Conditional Access policies, role assignments, or audit logs.
  • Service principals or managed identities.
  • Personal-access guest accounts (#EXT# UPN suffix) — these are filtered out at sync time so they don’t appear as “users” in the directory browser.

​
Troubleshooting

Either the tenant ID, client ID, or redirect URI is wrong. Double-check that:
  • The redirect URI in Entra exactly matches https://dashboard.originhq.com/integrations/oauth-callback.
  • The tenant ID and client ID in the dashboard form match the Directory (tenant) ID and Application (client) ID on the app’s Overview page — not the Object ID, which is a different value.
The stored secret is rejected by Microsoft’s token endpoint. Common causes:
  • The secret expired. Check Certificates & secrets in Entra; if the Expires column is in the past, generate a new secret (step 4) and use the integration’s Edit action to update it.
  • The secret was revoked. Same fix as above.
  • The application was deleted from Entra. Re-register from step 1.
If only devices land and users/groups are empty, your app registration is probably missing the User.Read.All and Group.Read.All application permissions, or admin consent wasn’t granted for them. Return to step 2, confirm both rows have green checks under Status, and trigger the sync again.
Your tenant may not actually use nested groups — many small tenants don’t. To confirm, navigate to one of your groups in Entra → Members and look for entries with the Type column set to Group. If there are none, there are no sub-groups for Origin to surface.

​
Rotating the Client Secret

Origin shows a yellow At risk badge on the integration when the secret is within 14 days of expiry. To rotate without dropping sync:
  1. Generate a new client secret in Entra (step 4). Don’t delete the old one yet.
  2. In the Origin dashboard, click Edit on the integration row, paste the new Value into the Client Secret field, and save.
  3. Trigger a manual sync (step 6). If it succeeds, the new secret is live.
  4. Delete the old secret from Entra.

​
Removing the Integration

To stop syncing without revoking access in Entra:
  1. Go to Directory Integration → click Delete in the row’s Actions column. Origin tears down its end and tombstones the directory data (eligible for hard-delete after the retention window in your tenant settings, default 90 days).
  2. Optionally revoke admin consent from your tenant: in Entra, go to Identity → Applications → Enterprise applications → pick your Origin Directory Sync app → Permissions → Review permissions → This application has more permissions than I want it to have. This revokes the granted permissions but leaves the app registration in place so you can re-grant later.
  3. To fully remove the app, delete it from App registrations in Entra.