Microsoft Entra Directory

The Microsoft Entra directory integration syncs your Entra user directory with Incode, enabling employee lookups and claims matching during identity verification sessions. This integration is a prerequisite for Entra-connected use cases that require verifying a user against their directory record, including Self-Serve Portal password and MFA resets, Helpdesk verifications, and claims matching in Entra IAM flows.

This is a directory-only integration. It does not trigger verification sessions. For authentication-layer integrations with Microsoft Entra, see Microsoft Entra External Authentication Method (EAM).

📘

Note

If your Microsoft Entra environment uses federated access through Okta as the identity provider, follow the Okta Directory guide instead.

Prerequisites

• Access to the Integrations page in Dashboard. Contact your Incode representative if you do not see the Integrations page.
• A Microsoft Entra account with the following roles:
  • User Administrator, Groups Administrator, Application Administrator, and App Developer — for App Registration, group, and user setup
  • Global Administrator — to grant the required app permissions

What gets synced

Incode reads user profile data from Microsoft Entra to perform claims matching. Depending on your claims matching policy, some of the following fields may be required for verification to succeed. Ensure these attributes are populated for all users in the groups you intend to sync:

📘

Note

Missing attributes will cause claims matching failures for affected users. Ensure the relevant fields are populated in Entra before triggering a directory sync.

Set up guide

Step 1: Configure the Entra directory integration in Incode

1. Log in to Dashboard.
2. In the left navigation, click Integrations.
3. Click New integration.
4. From the Directory tab, select Microsoft Entra Directory, then click Continue.
5. Enter a Directory name.
6. Enter the User Group ID (Object ID) of the Entra group containing the employees you want to sync. To find this, go to your Microsoft Entra portal → Groups → All groups, and copy the Object ID for the relevant group.
7. Select the permission level for the integration:
   • Read-only — allows directory sync only
   • Read and write — allows directory sync and Self-Serve password and MFA resets
8. Click Save.

Step 2: Grant directory permissions in Microsoft Entra

After saving, you will be redirected to the Microsoft Entra admin consent page to approve the required permissions. A Global Administrator must complete this step.

📘

Note

If permissions are rejected, or the approving user does not have sufficient privileges, the integration will remain in an incomplete state and the setup process must be restarted.

Step 3: Trigger a directory sync

Once permissions are granted, trigger an initial sync to import your users into Incode:

1. In the left navigation, click Integrations.
2. From the Directory tab, locate the integration you just created.
3. On the integration card, click Sync directory.

Depending on the size of your directory, the initial sync may take several minutes.

View synced users

Click Directory information in the left navigation to view all synced users and their enrollment status. Users shown as not enrolled have been synced from Entra but have not yet completed an Incode verification session. To initiate verification for these users, trigger a session through your configured IAM or Helpdesk integration.