Microsoft 365
connectors.

What this connector is for

The Graph connector lets Luxapps retrieve the list of authorised users directly from your Entra ID directory, instead of entering them manually in Luxapps. When you create, modify or disable an account on the Microsoft 365 side, Luxapps reflects the change at the next synchronisation.

Concretely, Luxapps reads:

• One Entra ID group that you designate — only its members have access to Luxapps.
• The essential attributes of those members: email, last name, first name.

Reading is done with application permissions (service-mode reads, without a user being signed in), restricted to the User.Read.All and Group.Read.All scopes. No write access on the Microsoft 365 side.

What we need from you

Four items to send us at the end of the procedure, by email to your Luxapps contact:

1. ①
   Tenant ID

   The identifier of your Entra ID tenant (GUID format).

2. ②
   Application ID

   The identifier of the App registration you will have created for Luxapps.

3. ③
   Client Secret Value

   The application secret generated in Azure. Shown only once — copy it at the moment of creation.

4. ④
   Group ID

   The identifier of the Entra ID group that contains the authorised users.

Step 1 — Retrieve the Tenant ID

1. Sign in to the Azure portal: https://portal.azure.com.
2. In the search bar, type Tenant properties and open the matching entry.
3. Copy the value of the Tenant ID field. This is your first deliverable.

If you have already configured the SSO connector (previous tab), you already have this value — you can reuse it.

Step 2 — Create the App registration

Unlike SSO, which uses an Enterprise Application, the Graph connector uses an App registration. These are two distinct Azure objects.

1. In the search bar, type App registrations.
2. Click New registration.
3. Fill in the name (for example Luxapps Graph Sync).
4. For the Supported account types field, choose "Accounts in this organizational directory only (Single tenant)". Leave the Redirect URI empty.
5. Click Register.
6. Once the application is registered, copy the Application (client) ID shown in Overview. This is your second deliverable.

Step 3 — Generate a Client Secret

1. In the left-hand menu of the App registration, open Certificates & secrets.
2. Under the Client secrets tab, click New client secret.
3. Give it a description (for example Luxapps Graph Sync) and choose a 24-month expiry.
4. Click Add.
5. Immediately copy the value of the Value field — it will never be shown again once you leave the screen. This is your third deliverable.

Step 4 — Grant the Microsoft Graph permissions

1. In the left-hand menu, open API permissions.
2. Click Add a permission, select Microsoft Graph, then Application permissions (not Delegated permissions).
3. Search for and tick the two permissions below, then confirm with Add permissions:

4. Back on the API permissions screen, click Grant admin consent for <your tenant>. Both permissions must show the Granted status.

Step 5 — Create the authorised-users group

Luxapps does not read your entire directory — only the members of a group that you designate. This gives you fine-grained control over who can access the platform.

1. In the search bar, type Groups.
2. Click New group.
3. Group type: Security. Name: your choice (for example Luxapps Users).
4. Create the group, then copy its Object ID from the Overview screen. This is your fourth deliverable.
5. Add to the group every user who should have access to Luxapps.

Before sending it all to us — checklist

For each user in the group, make sure these three Entra ID attributes are filled in and not empty:

• Email (the mail or userPrincipalName field).
• Last name (the surname field).
• First name (the givenName field).

A user with no email, no last name or no first name will be skipped by the synchronisation until the missing attribute is filled in.

Lifecycle & best practices

• Secret rotation. Renew the Client Secret before it expires (24 months). Create the new secret, send it to us, then delete the old one after switching over.
• Synchronisation frequency. By default, Luxapps re-reads the group and the profiles every hour. A custom cadence can be set up on request.
• Auditing. Every synchronisation operation is logged on the Luxapps side — you can review the log and export the history on request.
• Immediate deactivation. Removing a user from the Entra ID group disables their Luxapps access at the next synchronisation. For immediate revocation, also disable the account on the Microsoft 365 side (SSO will reject the sign-in instantly).

If you run into trouble

If a step does not go as described (Grant admin consent unavailable due to missing rights, different Azure labels, a 401/403 error in the Luxapps logs), contact your Luxapps contact with a screenshot of the error. We take over via video call if needed.