Skip to main content
Forge uses the Microsoft identity platform client-credentials flow to read organization-scoped identity and application context from Microsoft Graph. This connection is distinct from the broader Microsoft Agents integration and from Intune deployment.

​
Connection

Save the tenant ID, application client ID, and client secret in Settings → Integrations → Microsoft Entra identity. The secret is stored as a Forge-managed secret and is not returned after creation. Grant these Microsoft Graph application permissions:
Admin consent is required because Forge uses application permissions rather than a signed-in user’s delegated access.

​
Collection

Provider IDs are preserved. Users resolve to Forge people by normalized UPN when a matching directory identity exists; groups resolve by provider ID and then by safe name matching.

​
Setup

  1. Create an Entra app registration and grant the application permissions above.
  2. Grant tenant-wide admin consent.
  3. Save tenant ID, client ID, and client secret in Forge.
  4. Validate the connection, then run an inventory sync.
  5. Compare one user, group, enterprise app, OAuth grant, and app-role assignment with Microsoft Graph or the Entra admin center.

​
Intune boundary

Intune deployment is a separate permission lane. Its read path uses GroupMember.Read.All, Device.Read.All, DeviceManagementManagedDevices.Read.All, and DeviceManagementApps.Read.All; application deployment additionally requires DeviceManagementApps.ReadWrite.All. See Device Agent for endpoint deployment. Adding Intune permissions is not required for Entra inventory alone.

​
Verification

Forge records unavailable Graph resources as capability-specific errors. A successful token exchange proves tenant/client credentials, not access to every collection. 403 on sign-ins, Conditional Access, risky users, or access packages normally indicates a missing Graph permission, admin role, or tenant license for that specific resource.