Skip to main content

Configure Connection

Microsoft Entra ID guide

Use the Configuration Wizard to connect NIM to Microsoft Entra ID with the required app registration, permissions, and certificate authentication.

The Configuration Wizard is the recommended way to configure this integration. It connects to Microsoft Entra ID and creates the required app registration with the correct permissions and certificate authentication.

  1. In NIM, go to Systems > Overview.

  2. Select Add, choose Azure AD as the system type, enter a system name, and save it.

  3. In the Configured Systems pane, select Configure for the new system.

  4. Select Start in the Configuration Wizard and follow the prompts to sign in and authorize the connection.

  5. When the wizard completes, select Test Connection. A success message confirms that NIM can connect to Entra ID.

What the wizard configures

The Configuration Wizard creates the Entra ID app registration, applies the required Microsoft Graph permissions, and configures certificate authentication. Use the manual method below only when your organization requires the app registration to be created or managed outside NIM.

Manual configuration​

Use this method when the Configuration Wizard cannot be used or when your organization requires a separately managed Entra ID application.

Create the app registration​

  1. Open the Microsoft Azure portal, then go to Microsoft Entra ID > App registrations.
  2. Select New registration, enter a name such as NIM, and select Register.
  3. On the application’s Overview page, copy the Application (client) ID and Directory (tenant) ID.

Configure certificate authentication​

  1. Generate a certificate using your organization’s approved process. Export both of these formats:

    • .cer — X.509 encoded public certificate
    • .pfx — certificate with its private key

  2. In Entra ID, open the new application’s Certificates & secrets page. Select Upload certificate, upload the .cer file, and select Add.

  3. In NIM, add the .pfx certificate.

  4. Return to the NIM system’s Connection tab, enter the client ID and tenant ID, then select the uploaded certificate.

Add Microsoft Graph application permissions​

In Entra ID, open API permissions > Add a permission > Microsoft Graph > Application permissions. Select the following permissions, then select Add permissions.

Permission areaRequired application permissions
Administrative unitsAdministrativeUnit.Read.All, AdministrativeUnit.ReadWrite.All
DevicesBitlocker.Read.All, Device.Read.All, Device.ReadWrite.All
DirectoryDirectory.Read.All, Directory.ReadWrite.All
GroupsGroup.Read.All, Group.ReadWrite.All
Identity protectionIdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, IdentityRiskyUser.ReadWrite.All
Organization and reportsOrganization.Read.All, Reports.Read.All
TeamsTeam.Read.All, Team.ReadBasic.All, TeamSettings.ReadWrite.All
Users and authentication methodsUser.Read.All, User.ReadWrite.All, UserAuthenticationMethod.Read.All, UserAuthenticationMethod.ReadWrite.All
Grant tenant-wide admin consent

After adding the permissions, select Grant admin consent for <your organization> and confirm the action. The connection will not have access to the selected application permissions until consent is granted.

Validate the manual connection​

  1. Save the NIM system configuration.
  2. Select Test Connection.
  3. If the test fails, verify the client ID, tenant ID, selected certificate, and the granted Microsoft Graph permissions.