> For the complete documentation index, see [llms.txt](https://prohelp.assetpanda.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://prohelp.assetpanda.com/integrations-store/user-management/microsoft-entra-id-integration.md).

# Microsoft Entra ID Integration

You can integrate Microsoft Entra ID with Asset Panda Pro to streamline employee and user management. With this integration, you can sync user data from Azure directly into Asset Panda Pro, simplifying the onboarding process and reducing manual data entry. 

You can use the integration in the following ways:

* Import records into the People collection to enable users to check out items in Asset Panda Pro.
* Import records into User Configuration to grant users access to log in to the system.

You can use one or both options based on your needs. This improves efficiency, reduces check-out times, and keeps employee data synchronized, offering a seamless experience between the two platforms.

When importing user logins, you must create a separate Active Directory group for each Asset Panda Pro permission level. Your organization must configure these groups because Asset Panda Pro does not manage external system settings. 

{% hint style="info" %}
In addition to the steps described here, you must contact your Implementation Specialist or the Support Team to activate this integration on your Asset Panda Pro account.
{% endhint %}

## Prerequisites

* Active Asset Panda Prosubscription with Administrative access
* Microsoft Entra ID deployment within your organization with Administrative access 
* Relevant collections and fields in Asset Panda Pro to map the imported data

***

## Microsoft Entra ID tasks <a href="#entra-tasks" id="entra-tasks"></a>

To connect Microsoft Entra ID (formerly Azure AD) with Asset Panda Pro, complete the following tasks in the [Azure Portal](https://portal.azure.com/).

### Register a new application <a href="#register-new-app" id="register-new-app"></a>

1. In the **Azure Portal,** search for **App registrations.**
2. Click **New registration.**
3. Enter a **Name** for the app (for example, `Asset Panda Pro Integration`).
4. Under **Supported account types**, select **Accounts in this organizational directory only (Single tenant)**.
5. Click **Register.**&#x20;

***

### Gather Required IDs <a href="#ids" id="ids"></a>

After the app is registered, copy the following details and paste them into the corresponding fields in Asset Panda Pro:

* **Application (client) ID**: Paste into **Client ID**
* **Object ID**: Paste into **Application Object ID**
* **Directory (tenant) ID**: Paste into **Tenant ID**
* **Client Secret Value**: Paste into **Client Secret**

***

### Create a Client Secret <a href="#client-secret" id="client-secret"></a>

1. Go to **Certificates & secrets.**
2. Click **New client secret.**
3. Add a **Description** and select an **Expiration** period.
4. Click **Add.**
5. Copy the **Client Secret Value** (not the Secret ID) of the newly created client secret and paste it into the **Client Secret** field in Asset Panda Pro.&#x20;

{% hint style="danger" %}
When creating the **Client Secret**, make sure to copy the **Value** immediately after it is generated. This value is only displayed once. If you navigate away or forget to copy it, you will need to generate a new client secret to proceed with the integration.&#x20;
{% endhint %}

***

### Add API permissions <a href="#api-permissions" id="api-permissions"></a>

You must add permissions to allow Asset Panda Pro to read data from Microsoft Entra ID:

#### API Permissions

1. Navigate back to your registered application.
2. Go to **API Permissions.**
3. Confirm that **User.Read** (delegated) is listed.

#### Delegated permissions <a href="#delegated-permissions" id="delegated-permissions"></a>

1. Click **Add a permission.**
2. Select **Microsoft Graph.**
3. Select **Delegated permissions.**
4. Expand **OpenId** and select:\
   \
   `email` \
   `profile` \
   `offline_access` <br>
5. Click **Add permissions.**

#### Application permissions <a href="#app-permissions" id="app-permissions"></a>

1. Click **Add a permission**.
2. Select **Microsoft Graph.**
3. Select **Application permissions.**
4. Expand and add the following:
   * **Application** → `Application.Read.All`&#x20;
   * **Directory** → `Directory.Read.All`&#x20;
   * **Group** → `Group.Read.All`&#x20;
   * **User** → `User.Read.All`&#x20;
   * **GroupMember** → `GroupMember.Read.All`&#x20;
5. Click **Add permissions.**

***

### Grant Admin Consent <a href="#admin-consent" id="admin-consent"></a>

1. In the **API Permissions** page, click **Grant admin consent for \[Your Directory Name]**. A confirmation message is displayed.
2. Click **Yes.**
3. Ensure the **Status** column shows all permissions as **Granted for admin consent.**

***

## Asset Panda Pro tasks <a href="#ap-tasks" id="ap-tasks"></a>

### Set up the Microsoft Entra ID integration <a href="#setup" id="setup"></a>

1. Log into Asset Panda Pro with an administrator account
2. Navigate to <img src="/files/dLHka5YWbUR3zisHLua6" alt="Settings icon" data-size="line"> **Settings** > **Account Management**.
3. Expand the appropriate account and module.
4. Click **Manage** in the **Integrations** card.
5. Select **Integrations Store**.
6. In the **Microsoft Entra ID** tile, click **Add**. The **Integrations in this module** tab is displayed.
7. In the **Microsoft Entra ID** tile, click **Configure**.
8. Enter the following Azure details:
   * **Client ID**: Azure Application (client) ID
   * **Client Secret**: Azure Client Secret Value
   * **Application Object ID**: Azure Object ID
   * **Tenant ID**: Azure Directory (tenant) ID
9. Click **Test and Save Connection** to verify the authentication.
10. Click **Continue with mapping**.
11. Click **Add Mapping Option**. The Mapping Option view is displayed.
12. Select one of the following mapping options:
    * **To create users with login access:**
      1. Click **Create Asset Panda users from Microsoft Entra ID with login access**.
      2. Enter a name in the **Mapping Name** field.
      3. For **External Entity**, select the entity type (for example, Mobile Devices).
      4. For **Collection**, select a collection (for example, Azure Users).
      5. [Map fields](#mapping-fields) from Microsoft Entra ID to the corresponding Asset Panda Pro fields.<br>
    * **To import users as reference records without login access:**
      1. Click **Create Microsoft Entra ID users as collection records without login access**.
      2. Enter a name in the **Mapping Name** field.
      3. For **Organizational Unit** field, select the relevant unit from Microsoft Entra ID.
      4. For **User Role** field, assign a role.
      5. [Map fields](#mapping-fields) from Microsoft Entra ID to the corresponding Asset Panda Pro fields.<br>
13. To add more fields, click **Add More** and repeat the previous step.
14. Click **Save**.&#x20;

{% hint style="info" %}
You can set up an automation to ensure data stays up to date by syncing records at scheduled intervals.<br>
{% endhint %}

***

### Map fields <a href="#mapping-fields" id="mapping-fields"></a>

In the **Mapping** section, select fields from Microsoft Entra ID and map them to fields in Asset Panda.&#x20;

#### Unique identifiers  <a href="#unique-identifiers" id="unique-identifiers"></a>

Select one of the following fields as your **Unique Identifier** to ensure proper record matching and avoid duplication.&#x20;

<table><thead><tr><th width="189.03125">Field</th><th width="159.83984375">Recommended?</th><th>Why</th></tr></thead><tbody><tr><td><strong>User Principal Name</strong></td><td>Yes</td><td>Typically in <code>user@domain.com</code> format. Globally unique, stable, and used for login. Ideal for most organizations.</td></tr><tr><td><strong>Object ID</strong></td><td>Yes (alternative)</td><td>A static, system-generated GUID that never changes. Best for long-term consistency.</td></tr><tr><td><strong>Email</strong></td><td>Conditional</td><td>Use only if all users have a unique and permanent primary email address. Not ideal in environments with aliases.</td></tr></tbody></table>

#### User de-provisioning & Status handling (Login users only)

Asset Panda Pro does not independently delete users. All de-provisioning actions depend on the user data exposed by Microsoft Entra ID.

If users are created with login access via the Microsoft Entra ID integration, Asset Panda Pro manages user deactivation based on the user’s status in Microsoft Entra ID and the availability of user data through Entra ID APIs.

* **Deactivated users:**\
  If a user is disabled in Microsoft Entra ID (accountEnabled = false), the corresponding Asset Panda login user is automatically deactivated during the next sync.
* **Deleted users:**
  * If a deleted user is still available in the **Deleted Users** list in Microsoft Entra ID, Asset Panda Pro can retrieve the record and **deactivate the user**.
  * If the user is **permanently deleted** and no longer accessible via APIs, Asset Panda Pro cannot retrieve or update that user.

#### &#x20;**Microsoft Entra ID fields**

<table><thead><tr><th width="186.91015625">Field Name</th><th>Description</th></tr></thead><tbody><tr><td><strong>Account enabled</strong></td><td>Indicates whether the user account is active. Used to filter out deactivated or suspended users.</td></tr><tr><td><strong>Age group</strong></td><td>Specifies the user's age classification (for example, minor, adult). Used in compliance or filtering scenarios.</td></tr><tr><td><strong>Business phone</strong></td><td>User’s business contact number. Useful for directories or asset assignment contact fields.</td></tr><tr><td><strong>City</strong></td><td>City listed in the user's profile. Can be used for location-based mapping.</td></tr><tr><td><strong>Company name</strong></td><td>Organization name associated with the user. Often used for tenant-level reporting.</td></tr><tr><td><strong>Country or region</strong></td><td>Geographic country/region the user is assigned to.</td></tr><tr><td><strong>Department</strong></td><td>Department to which the user belongs (for example, HR, Finance). Useful for role-based mapping.</td></tr><tr><td><strong>Display name</strong></td><td>Full name displayed in the directory (for example, Jane Doe). Helpful for readable labels.</td></tr><tr><td><strong>Email</strong></td><td>User's primary email address. May be used for contact or login to ensure uniqueness.</td></tr><tr><td><strong>Employee hire date</strong></td><td>User’s official date of hire. Can help with lifecycle tracking.</td></tr><tr><td><strong>Employee ID</strong></td><td>Internal or external employee identifier. Useful if used consistently across systems.</td></tr><tr><td><strong>Employee org data</strong></td><td>Organization-specific metadata (for example, cost center, division). Customizable use.</td></tr><tr><td><strong>Employee type</strong></td><td>Indicates employment type (for example, contractor, full-time).</td></tr><tr><td><strong>External user state</strong></td><td>Status of external (guest) users, such as invited or accepted.</td></tr><tr><td><strong>External user state change date time</strong></td><td>Date/time of the last state change for external users.</td></tr><tr><td><strong>Fax number</strong></td><td>Deprecated in most environments. Rarely used.</td></tr><tr><td><strong>First name</strong></td><td>User’s given name. Can be mapped to standard profile fields.</td></tr><tr><td><strong>Integration Status</strong></td><td>Automatically created and managed by Asset Panda Pro during sync. No manual mapping needed.</td></tr><tr><td><strong>Job title</strong></td><td>User's role or position (for example, IT Administrator).</td></tr><tr><td><strong>Last name</strong></td><td>User’s surname or family name.</td></tr><tr><td><strong>Mail nickname</strong></td><td>User alias used in email routing (for example, jdoe).</td></tr><tr><td><strong>Mobile phone</strong></td><td>User’s mobile contact number.</td></tr><tr><td><strong>Object ID</strong></td><td>Unique system-generated ID for each Entra user. Great for strict identity matching.</td></tr><tr><td><strong>Office location</strong></td><td>User’s office or desk location.</td></tr><tr><td><strong>Other emails</strong></td><td>Secondary or alternate email addresses. Not recommended for mapping unique identifiers.</td></tr><tr><td><strong>Preferred language</strong></td><td>Default language preference for the user.</td></tr><tr><td><strong>State or province</strong></td><td>State/province portion of the user's address.</td></tr><tr><td><strong>Street address</strong></td><td>User’s street-level address info.</td></tr><tr><td><strong>Usage location</strong></td><td>Country where the service is being used. Often used for licensing.</td></tr><tr><td><strong>User principal name</strong></td><td>Primary login name (for example, <code>john.doe@domain.com</code>). Highly recommended as the unique identifier.</td></tr><tr><td><strong>User type</strong></td><td>Defines whether the user is internal (<code>Member</code>) or external (<code>Guest</code>).</td></tr><tr><td><strong>ZIP or postal code</strong></td><td>Postal/ZIP code from the user’s address.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://prohelp.assetpanda.com/integrations-store/user-management/microsoft-entra-id-integration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.