> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Entra

> Connect Microsoft Entra directory, applications, grants, policy, audit, and risk context.

Forge uses the Microsoft identity platform client-credentials flow to read
organization-scoped identity and application context from Microsoft Graph.
This connection is distinct from the broader Microsoft Agents integration and
from Intune deployment.

## Connection

Save the tenant ID, application client ID, and client secret in
**Settings → Integrations → Microsoft Entra identity**. The secret is stored as
a Forge-managed secret and is not returned after creation.

Grant these Microsoft Graph application permissions:

```text theme={"system"}
User.Read.All
Group.Read.All
Directory.Read.All
Application.Read.All
DelegatedPermissionGrant.Read.All
AuditLog.Read.All
Policy.Read.All
RoleManagement.Read.Directory
```

Admin consent is required because Forge uses application permissions rather
than a signed-in user's delegated access.

## Collection

| Graph resource                                        | Forge inventory                                                |
| ----------------------------------------------------- | -------------------------------------------------------------- |
| `/users` and `/groups`                                | Users, groups, state, type, department, and directory identity |
| `/servicePrincipals` and `/applications`              | Enterprise apps and app registrations                          |
| `/oauth2PermissionGrants`                             | Delegated OAuth grants                                         |
| `/servicePrincipals/{id}/appRoleAssignedTo`           | User and group app-role assignments                            |
| `/directoryRoles`                                     | Active directory roles                                         |
| `/auditLogs/directoryAudits` and `/auditLogs/signIns` | Administrative and sign-in evidence                            |
| Conditional Access                                    | Policy posture                                                 |
| Identity Protection                                   | Risky-user evidence                                            |
| Entitlement Management                                | Access-package inventory                                       |

Provider IDs are preserved. Users resolve to Forge people by normalized UPN
when a matching directory identity exists; groups resolve by provider ID and
then by safe name matching.

## Setup

1. Create an Entra app registration and grant the application permissions
   above.
2. Grant tenant-wide admin consent.
3. Save tenant ID, client ID, and client secret in Forge.
4. Validate the connection, then run an inventory sync.
5. Compare one user, group, enterprise app, OAuth grant, and app-role
   assignment with Microsoft Graph or the Entra admin center.

## Intune boundary

Intune deployment is a separate permission lane. Its read path uses
`GroupMember.Read.All`, `Device.Read.All`,
`DeviceManagementManagedDevices.Read.All`, and
`DeviceManagementApps.Read.All`; application deployment additionally requires
`DeviceManagementApps.ReadWrite.All`.

See [Device Agent](/integrations/device-agent) for endpoint deployment. Adding
Intune permissions is not required for Entra inventory alone.

## Verification

Forge records unavailable Graph resources as capability-specific errors. A
successful token exchange proves tenant/client credentials, not access to every
collection. `403` on sign-ins, Conditional Access, risky users, or access
packages normally indicates a missing Graph permission, admin role, or tenant
license for that specific resource.