Skip to content
Roster Roster Roster Docs

Microsoft Entra ID Connector

The Entra connector reads Microsoft Entra users, groups, and group membership through Microsoft Graph.

Provider Path

Section titled “Provider Path”
Microsoft Graph v1.0

Typical resources:

/users
/groups
/groups/{id}/members

Roster uses Microsoft Graph live when an admin searches Entra users or groups from the Platform participant picker. When the admin adds a selected user or group to a participant, Roster caches that selected record in directory_records and directory_record_sources. When the selected record is a group, Roster also caches direct membership edges throughout its readable nested hierarchy. Resolve includes users in subgroups up to 10 levels below the attached root by default (root level 0; configurable through ROSTER_DIRECTORY_GROUP_MAX_DEPTH), with shared groups and cycles handled without duplicate membership paths. Scheduled refresh discovers subgroup changes for existing associations without requiring reattachment.

Only group types that permit nesting can provide subgroup relationships; Microsoft 365 groups do not support nesting. Hidden membership requires the appropriate additional read permission. Graph’s maximum page size of 999 is a pagination limit, not a nesting-depth limit. See group expansion limits.

MCP and REST directory-record search uses only Roster’s cached/materialized directory records. It does not call Microsoft Graph live.

Production Requirements

Section titled “Production Requirements”
  • Microsoft Entra tenant
  • app registration approved for directory reads
  • client secret stored in the runtime environment or secret manager
  • refresh schedule for user, group, and membership data
  • stable external IDs from Graph records

Use least-privilege Microsoft Graph permissions that allow Roster to read the users, groups, and memberships needed for participant resolution.

For the current client-secret implementation, grant Microsoft Graph application permissions:

User.Read.All
Group.Read.All
GroupMember.Read.All

Then grant admin consent for the tenant.

Secret Kinds

Section titled “Secret Kinds”

Supported secret kind:

client_secret

Store the secret value outside Roster, then reference it from the connector:

env:ENTRA_CLIENT_SECRET

Normalized Data

Section titled “Normalized Data”

The connector normalizes Entra records into Roster directory users and groups:

queryUsers(query)
getUser(externalId)
queryGroups(query)
getGroup(externalId)
getGroupMembers(externalId, query)

Live search supports prefix matching on display name, email or user principal name, mail nickname, and exact external ID.

Use participant membership to map Entra users or groups to Roster participants.