Connect a Microsoft Entra staff directory

Create a read-only application

1. Create a tenant-local application registration dedicated to staff directory synchronization.
2. Grant only the Microsoft Graph application permissions needed to read selected users, groups, and profile fields.
3. Grant tenant administrator consent after reviewing the requested permissions.
4. Create a client secret with a defined owner and expiration process.

Scope the import

1. Enter the Directory (tenant) ID, Application (client) ID, and client secret value.
2. Prefer explicit staff security groups over importing the entire directory.
3. Add student, contractor, shared, room, equipment, and service-account groups to exclusions.
4. Add approved email domains and select which directory fields remain locked.
5. Save the protected draft and review the expected population before scheduling.

Provider reference

• Microsoft Graph list users ↗
• Microsoft Graph list group members ↗