Entra ID

Overview

The Entra ID connector creates Microsoft Graph change notification subscriptions on users and groups, so Tessel learns about changes without scanning the directory. Each notification is resolved into a typed event with the changed properties, and it appears in the trace of the run it started.

Teams use it to set up mailboxes and Teams access when HR adds a hire in Workday, to disable accounts and revoke sessions when someone leaves, and to send risky users to a security review in Microsoft Teams.

Supported tenants

• Microsoft Entra ID Free, P1 and P2

• Commercial and GCC tenants, single or multi-tenant apps

• Risky user triggers require Entra ID P2

How change notifications work

Tessel subscribes to /users and /groups and validates the endpoint with Graph's token handshake. Notifications carry a resource ID, which Tessel reads back through Graph to build the full event. Subscriptions expire, so Tessel renews them a day before they lapse.

POST https://graph.microsoft.com/v1.0/subscriptions
{
  "changeType": "created,updated,deleted",
  "resource": "/users",
  "notificationUrl": "https://us-1.hooks.tessel.dev/entra",
  "expirationDateTime": "2026-11-01T00:00:00Z",
  "clientState": "<per-workspace secret>"
}

POST https://graph.microsoft.com/v1.0/subscriptions
{
  "changeType": "created,updated,deleted",
  "resource": "/users",
  "notificationUrl": "https://us-1.hooks.tessel.dev/entra",
  "expirationDateTime": "2026-11-01T00:00:00Z",
  "clientState": "<per-workspace secret>"
}

POST https://graph.microsoft.com/v1.0/subscriptions
{
  "changeType": "created,updated,deleted",
  "resource": "/users",
  "notificationUrl": "https://us-1.hooks.tessel.dev/entra",
  "expirationDateTime": "2026-11-01T00:00:00Z",
  "clientState": "<per-workspace secret>"
}

Throttling

Graph throttles per app and tenant. Tessel reads Retry-After on 429 responses, backs off and retries. Writes carry the same request ID on retry, so a user is never created twice.

Permissions needed

Register an app in Entra ID with application permissions and grant admin consent. Read permissions cover lookups and triggers. Write permissions are only needed for the create, group and disable actions.

• User.Read.All and GroupMember.Read.All for triggers

• User.ReadWrite.All and GroupMember.ReadWrite.All for writes

• IdentityRiskyUser.Read.All for the risky user trigger