Skip to main content
Connect Origin to Microsoft Entra ID (formerly Azure AD) so your users, groups, group memberships, and devices stay in sync with your directory. Once connected, the synced data appears in the Directory Browser in your Origin dashboard, and each endpoint Origin sees is correlated to the person and device it belongs to. There are two ways to connect Entra ID:
  • Automated setup (recommended) — Origin manages the Entra application for you. There’s no app registration to create, no Microsoft Graph permissions to add, and no client secret to generate or rotate. The whole flow takes about two minutes. This is the method below.
  • Manual setup (advanced) — register and manage your own Entra app registration, Graph permissions, and client secret. Use this only if your organization requires full control over the app registration and credential rotation. See Manual setup (advanced) further down this page.

​
Automated setup

Origin now manages the Entra application for you. There is no app registration to create, no Microsoft Graph permissions to add, and no client secret to generate or rotate. You give one-time tenant-wide admin consent to Origin’s verified application, choose what to sync, and you’re done.

​
What you’ll end up with

The same admin consent also enables Microsoft 365 Copilot capture — see that guide to turn it on once the directory is connected.

​
Before you begin

You need:
  1. A Microsoft Entra admin who can grant tenant-wide admin consent — the Global Administrator, Privileged Role Administrator, or Cloud Application Administrator role. This is the only Microsoft-side privilege the flow requires.
  2. An Origin admin account — only Origin admins can create directory integrations.
You do not need:
  • An app registration, a service principal, Graph API permissions, a redirect URI, or a client secret. Origin’s managed application (published and verified as Prelude Research Inc.) handles all of that.

​
Setup steps

1

Open Directory Integrations in Origin

  1. Sign in to the Origin dashboard at dashboard.originhq.com.
  2. Click Admin in the left sidebar, then select Identity.
  3. On the Integrations tab, click Add Integration (or the empty-state prompt if this is your first one).
The Directory Integrations page on the Integrations tab with no integrations configured yet and the Add Integration button in the top right.
2

Start a new Entra integration

The New integration dialog opens.
  1. Display name — a label for this integration, e.g. OriginHQ. This is required and is only used to identify the integration in the list.
  2. Provider — leave this set to Microsoft Entra ID. (Use Change if you need a different provider.)
  3. Note the message: “Origin manages the application registration and signing credentials — there’s nothing to enter.”
  4. Click Connect Microsoft Entra.
The New integration dialog with a display name entered and Microsoft Entra ID selected as the provider.Origin saves the integration and opens Microsoft’s admin-consent page in a new tab.
3

Grant admin consent in Microsoft

In the new tab:
  1. Pick an account — choose (or sign in as) an account that holds one of the admin roles listed in Before you begin.
  2. Microsoft shows a Permissions requested — Review for your organization screen for the Prelude Research Inc. application. The app requests read-only access to:
  3. Click Accept. Consent applies to all users in your organization — no one else is prompted.
If Accept is greyed out or you see a ‘needs admin approval’ message, your account doesn’t hold one of the roles in Before you begin. Have an eligible admin complete this step; everything else is already saved on Origin’s side.
When you click Accept, return to the Origin tab. Origin automatically opens the Sync scope prompt so you can choose what to sync before the first sync runs.
4

Choose what to sync

As soon as consent completes, Origin opens the Sync scope dialog. Choose one of two modes, then click Save — Origin runs the first sync as soon as you save.Sync only selected groups
  • Leave Sync full tenant off, then use Search groups by name and tick the Entra groups you want. Only members of the selected groups — including members of nested groups — are monitored.
  • Everyone outside the selected groups is left out, and anyone previously synced but no longer in scope is removed on the next sync.
The Sync scope dialog with Sync full tenant off, showing the searchable list of Entra groups to select.Sync the whole tenant
  • Turn on Sync full tenant to sync your entire directory. The group list is disabled and the dialog footer reads Whole tenant.
The Sync scope dialog with Sync full tenant turned on and the group list disabled.
If you close this dialog without saving, the integration’s scope stays Not configured and nothing syncs. You can reopen Sync scope from the integration row at any time (see the next step) and change your selection; the change takes effect on the next sync.
5

View the integration status

When the sync completes, Origin returns you to the Directory Integrations → Integrations tab. The integration row shows:
  • Status — Connected (green).
  • Name — the display name you entered.
  • Provider — Microsoft Entra ID.
  • Scope — Whole tenant, or the groups you selected.
  • Last Sync — the time of the most recent sync.
The Integrations tab showing a Connected Microsoft Entra ID integration with Whole tenant scope and a recent Last Sync time.To change what syncs later, click the Scope value on this row to reopen the Sync scope dialog; the change takes effect on the next sync.
6

Verify in the Directory Browser

From the Directory Integrations page, use the tabs across the top:
  1. Users — should list everyone in scope. Click any user to see their direct groups; click a group to deep-link into it.
  2. Groups — click any group to see its direct user members and sub-groups. Click a member to jump back to that user.
  3. Devices — Intune-managed devices show a hardware serial number; Entra-joined devices that Intune hasn’t seen show the device’s display name. Both resolve an Owner against the synced users.
If you’ve registered endpoints in Origin and their serial numbers or hostnames match, those endpoints light up with the matched directory user under Assigned identity.

​
What gets synced (and what doesn’t)

Synced:
  • Users (active and disabled) — display name, email, UPN, department, job title, manager, last sign-in, account-enabled flag.
  • Groups — display name, description, type, membership, and nesting.
  • Entra-joined / registered devices — display name, OS, OS version, owners.
  • Intune-managed devices — serial number, model, manufacturer, assigned user, compliance state, OS.
Not synced:
  • Mailboxes, OneDrive, calendars, contacts, or any tenant data outside the directory itself.
  • Conditional Access policies or role assignments.
  • Guest accounts (#EXT# UPN suffix) are filtered out at sync time.

​
Managing the integration

  • Re-scope — click the scope column and adjust Sync scope at any time.
  • Enable Copilot capture — the admin consent you granted already covers it; turn it on in Microsoft 365 Copilot capture.
  • Remove — delete the integration from its row’s actions. Syncing stops; data already in Origin follows your tenant’s retention settings. To also revoke access on the Microsoft side, remove the Prelude Research Inc. enterprise application from Entra → Enterprise applications.

​
Troubleshooting

The scope is probably still Not configured — the Sync scope dialog was closed without saving. Click the Scope value on the integration row to reopen it, choose Sync full tenant or select groups, and Save.
You’re likely in selected groups mode. Open Sync scope and confirm the groups you expect are ticked — remember only members of the selected groups (and their nested groups) are synced.
Re-open the integration and confirm admin consent completed for the whole permission set. If consent was only partially granted, remove the integration and re-run the connect and consent steps with an eligible admin.
Your tenant may not use nested groups. In Entra, open a group → Members and look for entries whose Type is Group; if there are none, there’s nothing for Origin to nest.

​
Manual setup (advanced)

Prefer to manage your own Entra app registration, Microsoft Graph permissions, and client secret rotation directly, rather than using Origin’s managed application? Use this method instead of the automated setup above. This method walks through registering an application in your Microsoft Entra ID tenant, granting the permissions Origin needs, and connecting the integration from the Origin dashboard using your own client ID and client secret. The whole flow takes about ten minutes and requires a Microsoft work account with the Global Administrator, Privileged Role Administrator, or Cloud Application Administrator role — anyone who can grant tenant-wide admin consent for an application.

​
What you’ll end up with (manual setup)

Initial sync runs as soon as you finish the last step below. After that, Origin re-syncs every hour, plus an on-demand button in the dashboard.

​
Before you begin (manual setup)

You need:
  1. An Entra admin account with one of the roles listed above.
  2. The Origin dashboard URL for your tenant — the public hostname you sign in to. The redirect URI you’ll register in Entra is https://<your-origin-hostname>/integrations/oauth-callback. For example, if you sign in at https://app.origin.example.com, the redirect URI is https://app.origin.example.com/integrations/oauth-callback.
  3. Your Origin tenant admin role — only Origin admins can create directory integrations.
You do not need a pre-configured service principal. The setup below creates one.
Last sign-in time (last_login in the Directory Browser) is sourced from Entra’s signInActivity resource, which requires an Entra ID P1 or P2 license plus the AuditLog.Read.All Graph permission. On the free tier — or on P1/P2 without AuditLog.Read.All granted — Graph silently omits the field and Origin records the user’s last sign-in as the Unix epoch (1970-01-01). Stale-account detection that relies on this field will be best-effort until both prerequisites are in place. Everything else (users, groups, memberships, devices, owners) is available on the free tier with the permissions in the next step.

​
Manual setup steps

1

Register the Application in Entra

Sign in to the Microsoft Entra admin center with your admin account, then:
  1. Navigate to Identity → Applications → App registrations → New registration.
  2. Fill in the registration form:
    • Name — something a future admin will recognize, e.g. Origin Directory Sync.
    • Supported account types — select Accounts in this organizational directory only (Single tenant).
    • Redirect URI — select Web and enter https://dashboard.originhq.com/integrations/oauth-callback. The hostname must match exactly (scheme, host, port, and path). Origin rejects callbacks whose redirect URI doesn’t match what was stamped into the OAuth state.
  3. Click Register.
You’ll land on the new app’s Overview page. Note down two values — you’ll need them later:
  • Application (client) ID
  • Directory (tenant) ID
Keep the tab open.
2

Grant Microsoft Graph API Permissions

Origin uses application permissions (also called app-only or client_credentials), not delegated permissions, so the sync continues to run when no user is signed in.
  1. In the same app registration, click API permissions → Add a permission → Microsoft Graph → Application permissions.
  2. Add all six permissions in the table below. You can search by name; tick the checkbox and click Add permissions between groups if it’s easier.
  1. After all six are listed, click Grant admin consent for <your tenant> at the top of the table. You’ll be prompted to confirm — accept. Each row should now show a green check under Status.
If you see “Not granted for <tenant>” with a yellow warning after clicking Grant, your account doesn’t have one of the admin roles listed in the prerequisites. Either get the role assignment or hand this step to someone who has it — only the consent step is gated on it.
3

Confirm the Redirect URI

The previous step already added the redirect URI, but it’s worth verifying — a typo here is the single most common reason the connect-to-Origin step fails.
  1. Go to Authentication → under Web → Redirect URIs.
  2. Confirm https://dashboard.originhq.com/integrations/oauth-callback is listed exactly as typed.
  3. Leave everything else on this page at its default. Origin does not need the implicit grant flow, ID tokens, or any extra “Front-channel logout” URI.
  4. Click Save if you changed anything.
4

Create a Client Secret

The secret is what the Origin backend presents to Microsoft to acquire Graph tokens after admin consent completes. It’s stored on Origin’s side encrypted under your tenant’s KMS-managed data key — Origin admins never see it in plaintext after entry.
  1. Go to Certificates & secrets → Client secrets → New client secret.
  2. Description — something descriptive, e.g. origin-directory-sync-2026-q2.
  3. Expires — pick the longest window your security policy allows. Origin will warn you in the dashboard 14 days before the secret expires (the integration’s status flips from Connected to At risk) so you can rotate before sync stops.
  4. Click Add.
The secret value is shown once under the Value column. Copy it to your clipboard immediately — once you navigate away, the column shows only the last few characters and you’ll need to create a new secret to recover. The Secret ID column is not the secret; you don’t need it.
5

Connect from the Origin Dashboard

  1. Sign in to your Origin dashboard at https://dashboard.originhq.com/.
  2. Go to Directory Integration in the left sidebar → + Add Integration (or click Add your first integration if this is the first one).
  3. Select Entra ID (Microsoft Entra ID).
  4. Fill in the connection form:
    • Display Name — anything; this is just a label in the integrations list.
    • Tenant ID — paste the Directory (tenant) ID from the app registration step.
    • Client ID — paste the Application (client) ID from the app registration step.
    • Client Secret — paste the Value you copied when creating the client secret.
  5. Click Connect with Entra ID.
You’ll be redirected to Microsoft to grant admin consent. Pick the admin account you used in the earlier steps (or sign in if prompted), review the permission list — it should match the six you added earlier — and click Accept.When you land back at the Origin dashboard, the integration row shows status Connected. If it shows No credentials stored for this integration instead, the secret didn’t make it through. Delete the row, return to the client secret step to create a fresh secret, and re-run this step.
6

Trigger Your First Sync

Origin runs a periodic background sync, but you don’t need to wait. Click Sync in the row’s Actions column. The status flips to Syncing, then back to Connected with a populated Last Sync timestamp.A typical first sync takes a few seconds for small tenants and a couple of minutes for tenants with tens of thousands of users.If the sync turns the row red and shows an error, see the Troubleshooting section below.
7

Verify in the Directory Browser

  1. Go to Directory Integration → Directory Browser tab.
  2. The Users tab should list everyone Origin pulled.
  3. Click any user. The detail panel shows their direct groups under a Groups subsection — click any group to deep-link into that group’s detail.
  4. Go to the Groups tab → click any group. The detail panel shows direct user members and direct sub-groups (if your tenant uses nested groups). Click any member to jump back to that user.
  5. Check the Devices tab — Intune-managed devices show their serial number; Entra-joined devices that Intune hasn’t seen show a blank serial and the device’s displayName. Both share an Owner column resolved against synced users.
If you’ve registered endpoints in Origin and the device serial numbers match, you’ll see those endpoint rows light up with the matched directory user under an Assigned identity column.

​
What gets synced (manual setup)

Synced — full list:
  • Users (active and disabled) — display name, email, UPN, department, job title, office, manager, last sign-in (best-effort — see Before you begin (manual setup)), account-enabled flag.
  • Groups — display name, description, type (security / distribution / Microsoft 365), member count, direct memberships, direct sub-groups.
  • Entra-joined devices — display name, OS, OS version, registered owners.
  • Intune-managed devices — hardware serial number, model, manufacturer, assigned UPN, compliance state, OS, OS version.
Not synced:
  • Photos, contacts, mailbox metadata, OneDrive, calendars, or any tenant data outside the directory itself.
  • Conditional Access policies, role assignments, or audit logs.
  • Service principals or managed identities.
  • Personal-access guest accounts (#EXT# UPN suffix) — these are filtered out at sync time so they don’t appear as “users” in the Directory Browser.

​
Troubleshooting (manual setup)

Either the tenant ID, client ID, or redirect URI is wrong. Double-check that:
  • The redirect URI in Entra exactly matches https://dashboard.originhq.com/integrations/oauth-callback.
  • The tenant ID and client ID in the dashboard form match the Directory (tenant) ID and Application (client) ID on the app’s Overview page — not the Object ID, which is a different value.
The stored secret is rejected by Microsoft’s token endpoint. Common causes:
  • The secret expired. Check Certificates & secrets in Entra; if the Expires column is in the past, generate a new secret and use the integration’s Edit action to update it.
  • The secret was revoked. Same fix as above.
  • The application was deleted from Entra. Re-register the application from the first step.
If only devices land and users/groups are empty, your app registration is probably missing the User.Read.All and Group.Read.All application permissions, or admin consent wasn’t granted for them. Return to the Graph permissions step, confirm both rows have green checks under Status, and trigger the sync again.
Your tenant may not actually use nested groups — many small tenants don’t. To confirm, navigate to one of your groups in Entra → Members and look for entries with the Type column set to Group. If there are none, there are no sub-groups for Origin to surface.

​
Rotating the Client Secret

Origin shows a yellow At risk badge on the integration when the secret is within 14 days of expiry. To rotate without dropping sync:
  1. Generate a new client secret in Entra. Don’t delete the old one yet.
  2. In the Origin dashboard, click Edit on the integration row, paste the new Value into the Client Secret field, and save.
  3. Trigger a manual sync. If it succeeds, the new secret is live.
  4. Delete the old secret from Entra.

​
Removing the Integration

To stop syncing without revoking access in Entra:
  1. Go to Directory Integration → click Delete in the row’s Actions column. Origin tears down its end and tombstones the directory data (eligible for hard-delete after the retention window in your tenant settings, default 90 days).
  2. Optionally revoke admin consent from your tenant: in Entra, go to Identity → Applications → Enterprise applications → pick your Origin Directory Sync app → Permissions → Review permissions → This application has more permissions than I want it to have. This revokes the granted permissions but leaves the app registration in place so you can re-grant later.
  3. To fully remove the app, delete it from App registrations in Entra.