Connecting Microsoft Entra ID (Azure AD)

Overview

The Microsoft Entra ID (formerly Azure Active Directory) integration lets Liceo automatically discover your organization's users, Microsoft 365 license subscriptions, and SSO-connected third-party applications. Once connected, Liceo will reflect your real seat counts and user assignments — no manual data entry required.

The integration uses the Microsoft Graph API with read-only permissions. Liceo never writes data back to your Azure tenant.

Prerequisites

• An active Microsoft 365 or Azure subscription.
• An Azure account with the Application Administrator (or higher) role in your Azure AD tenant.
• A Liceo account with the Admin role. Only admins can configure integrations.
• The Liceo callback URL: https://liceo.io/api/auth/entra/callback

Step 1 — Create an App Registration

An App Registration tells Azure which external application (Liceo) is allowed to read your directory data.

1. 1
   Sign in to the Azure Portal (portal.azure.com).
2. 2
   In the top search bar type App registrations and click the service that appears under Services.
3. 3
   Click + New registration in the top-left corner.
4. 4
   Fill in the registration form:

   • Name: Enter a recognisable name such as Liceo Integration.
   • Supported account types: Select "Accounts in this organizational directory only (Single tenant)".
   • Redirect URI: Leave this blank for now — you will add it in Step 5.
5. 5
   Click Register. Azure will create the app and take you to its Overview page.

Step 2 — Copy your Tenant ID & Client ID

On the Overview page of your newly created app registration, you will see two key identifiers:

1. 1
   On the Overview page, locate Application (client) ID and click the copy icon next to it. Paste this value into a text file — you will need it shortly.
2. 2
   Similarly, copy the Directory (tenant) ID and save it.

Step 3 — Create a Client Secret

A client secret is a password that allows Liceo to authenticate as your registered application. It is shown only once — copy it immediately.

1. 1
   In the left sidebar of your app registration, click Certificates & secrets.
2. 2
   Under the Client secrets tab, click + New client secret.
3. 3
   Enter a description (e.g., Liceo sync key) and choose an expiry period. We recommend 24 months — you will need to rotate this secret in Liceo before it expires.
4. 4
   Click Add.
5. 5
   Azure displays the secret value in the Value column. Copy it now — it will be hidden as soon as you navigate away.

Step 4 — Configure API Permissions

Liceo needs read-only access to your Microsoft Graph directory. You must grant the following Application permissions (not Delegated).

1. 1
   In the left sidebar click API permissions.
2. 2
   Click + Add a permission, then select Microsoft Graph.
3. 3
   Select Application permissions (not Delegated permissions).
4. 4
   Search for and tick each of the four permissions in the table above: User.Read.All, Directory.Read.All, Organization.Read.All, and Reports.Read.All.
5. 5
   Click Add permissions.
6. 6
   Click Grant admin consent for [Your Organization] and confirm. The status column for each permission should change to a green tick labelled "Granted for [Org]".

Step 5 — Add the Redirect URI

The Redirect URI tells Azure where to send the OAuth authorization code after a user approves the connection. It must match exactly what Liceo expects — any mismatch causes the AADSTS50011 error.

1. 1
   In the left sidebar click Authentication.
2. 2
   Under Platform configurations, click + Add a platform.
3. 3
   Select Web.
4. 4
   In the Redirect URIs field enter exactly:

   https://liceo.io/api/auth/entra/callback
5. 5
   Click Configure.

Step 6 — Enter Credentials in Liceo

1. 1
   In Liceo, navigate to Settings → Integrations (or click Integrations in the left sidebar).
2. 2
   Find the Microsoft Entra ID card and click Connect.
3. 3
   Enter the three values you copied earlier:

   • Tenant ID — the Directory (tenant) ID from Step 2
   • Client ID — the Application (client) ID from Step 2
   • Client Secret — the secret value (not the ID) from Step 3
4. 4
   Click Authorize with Microsoft. You will be redirected to a Microsoft login page. Sign in with a Global Administrator or Application Administrator account.
5. 5
   After authorization, you will be returned to the Liceo Integrations page with a green "Connected" badge.
6. 6
   Click Sync Now to run the first data sync. Liceo will import your Microsoft 365 license subscriptions, user assignments, and SSO-connected applications. Synced users appear in the User Directory with a blue "Synced" status badge.

Troubleshooting