Connect Microsoft Entra ID with client credentials

Learn how to register an app in Microsoft Entra ID or Azure in China and connect it to 1Password SaaS Manager with client credentials.

With 1Password SaaS Manager, you can connect Microsoft Entra ID to see your users, groups, and apps, and to automate onboarding and offboarding in workflows.

SaaS Manager can connect to Microsoft Entra ID with Authorization Code Flow or client credentials. Authorization Code Flow is the default, but each has different benefits:

	Authorization Code Flow	Client credentials
Connection	SaaS Manager connects as the Entra ID account you sign in with.	SaaS Manager connects as an app you register in your tenant.
Setup	You choose the features you want, sign in, and approve the permissions SaaS Manager requests on a consent screen.	You register an app, add API permissions, grant admin consent, and create a client secret in Entra ID.
Permissions	SaaS Manager requests a set of permissions based on the features you choose.	You choose each permission yourself, which gives you more granular control.
Password resets	SaaS Manager can reset a person’s password when you revoke their access, if the account you sign in with can reset passwords in Entra ID.	SaaS Manager can’t reset passwords, because Microsoft doesn’t allow it from an app acting on its own.

Authorization Code Flow is the recommended method for most cases. Use client credentials if:

You’re connecting Azure in China (operated by 21 Vianet).
You want to run mailbox actions.
A restriction in your account means you can’t use Authorization Code Flow.

Tip

If you connect with Authorization Code Flow and only need to run mailbox actions, follow the steps to turn on mailbox actions for Microsoft Entra ID.

To get started, sign in to the Microsoft Entra admin center, or the Azure China portal for Azure in China, and follow the steps below.

Before you begin

Before you begin, consider which features you’ll use. The permissions you add depend on whether you want to provision users, deprovision users, or run mailbox actions. Mailbox actions are workflow steps that change a person’s mailbox, such as setting an out-of-office message or forwarding their email.

To connect SaaS Manager and Entra ID, you’ll also need to have:

A Microsoft Entra ID role that can register apps, such as Application Developer.
The Privileged Role Administrator role to grant admin consent for Microsoft Graph application permissions and assign an Entra ID role to the app. If you don’t have this role, ask someone who does to complete steps 1.4 and 2.

Step 1: Set up the app in Entra ID

1.1: Register the app

Follow Microsoft’s steps to register an application in Entra ID. Fill out the following fields:

Name: Enter a name, such as “SaaS Manager”.
Supported account types: Select the single tenant option.
Redirect URI: Leave this field blank.

1.2: Add Microsoft Graph permissions

Follow Microsoft’s steps to add application permissions to Microsoft Graph. Select Application permissions, then add each scope you need.

Learn more about the required scopes for each feature.

1.3: Add the Exchange permission

Tip

If you don’t use mailbox actions, you can skip this step.

If you use mailbox actions, you’ll also need to add the Exchange permission:

On the API permissions page, select Add a permission.
Select the APIs my organization uses tab, then select Office 365 Exchange Online.
Select Application permissions, expand the Exchange section, and select Exchange.ManageAsApp.
Select Add permissions.

On the API permissions page, select Grant admin consent, then select Yes. Learn more about granting tenant-wide admin consent.

Step 2: Assign an Exchange role to the app

Tip

If you don’t use mailbox actions, you can skip this step.

Mailbox actions need an Exchange role on the app, not on a user account. Follow Microsoft’s steps to assign Microsoft Entra roles. Fill out the following fields:

Role: Select Exchange Recipient Administrator.
Select member(s): Select the enterprise application Entra ID created for your app registration. It has the same name, and its application (client) ID matches the one you’ll enter in SaaS Manager.
Assignment type: If your tenant uses Privileged Identity Management, select Active and enter a justification.

Step 3: Create a client secret

Follow Microsoft’s steps to add a client secret. Fill out the following fields:

Description: Enter a description, such as “SaaS Manager”.
Expires: Choose an expiration.

Important

After you add the secret, copy its Value right away. Entra ID only shows the value for a short time, and if you can’t view or copy it, you’ll need to create a new secret.

Make a note of the expiration date. You’ll need to create a new secret before this one expires.

Step 4: Connect SaaS Manager

Before you connect to SaaS Manager, you’ll need the following from your application in Entra ID:

Client secret value: The value you copied in step 3.
Application (client) ID: On the Overview tab, copy the Application (client) ID.
Directory (tenant) ID: On the Overview tab, copy the Directory (tenant) ID.

To connect with client credentials:

In SaaS Manager, select Integrations, then select Microsoft Entra ID or Azure in China.
Select Connect, then enter the values you collected.
Select Connect again.

The integration runs in the background.

Appendix: API permission scopes

These scopes apply when you connect with client credentials. If you connect with Authorization Code Flow, learn how to turn on mailbox actions for Microsoft Entra ID instead.

Add the scopes that match the features you use:

Core: Add these scopes for every connection.
Deprovisioning: Add these scopes to turn on deprovisioning.
Provisioning: Add the deprovisioning scopes and RoleManagement.ReadWrite.Directory.
Read managed device data: Add DeviceManagementManagedDevices.Read.All.

When you select features in SaaS Manager, it can list permissions that aren’t in the table below, such as Directory.AccessAsUser.All and offline_access. Microsoft only offers these as delegated permissions, which apply when you sign in with an account. You can’t add them to an app, so you don’t need them when you connect with client credentials.

Scope	Required for	Description
`Application.Read.All`	Core	Read applications and service principals.
`RoleManagement.Read.Directory`	Core	Read directory role templates, directory roles, and memberships.
`Synchronization.Read.All`	Core	Read all Microsoft Entra ID SCIM synchronization data. Used to check whether Entra ID is configured to provision and deprovision users for apps.
`Group.Read.All`	Core	Read groups.
`GroupMember.Read.All`	Core	Read the memberships of groups.
`Directory.Read.All`	Core	Required to read OAuth token permissions. The integration works without this scope, but it won't return information about OAuth sign-ins.
`User.Read.All`	Core	Read the full set of profile properties, including managers of users in your organization.
`AuditLog.Read.All`	Core	Read all audit log data.
`DeviceManagementManagedDevices.Read.All`	Read managed device data	Read the properties of devices managed by Microsoft Intune.
`Reports.Read.All`	Core	Read Microsoft 365 usage reports.
`LicenseAssignment.Read.All`	Core	Read license assignments for all users.
`AppRoleAssignment.ReadWrite.All`	Core	Manage user and app role assignments. ReadWrite is the minimum scope required, although SaaS Manager doesn't write app role assignments.
`IdentityProvider.Read.All`	Core	Read all identity providers. Used to return verified domains.
`Organization.Read.All`	Core	Read the organization and related resources. Used to return the tenant ID and name.
`User.ReadWrite.All`	Deprovisioning	Update the profile of everyone in the organization.
`GroupMember.ReadWrite.All`	Deprovisioning	Read and write group memberships.
`UserAuthenticationMethod.ReadWrite.All`	Deprovisioning	Read and write users' authentication methods. Password reset in the "Revoke access" step doesn't work with application permissions. Connect with Authorization Code Flow to use it.
`RoleManagement.ReadWrite.Directory`	Provisioning	Read and write directory RBAC settings.

Learn more

Was this article helpful?

Glad to hear it! If you have anything you'd like to add, feel free to contact us.

Sorry to hear that. Please contact us if you'd like to provide more details.