azure-active-directory v1.0.0A

Immutable. This exact content never changes and is served at /api/v1/blob/2e285ccd44086701.

---
name: azure-active-directory
description: |
  Microsoft Entra integration via Apideck's HRIS unified API — same methods work across every connector in HRIS, switch by changing `serviceId`. Use when the user wants to read or sync employees, departments, payrolls, and time-off records in Microsoft Entra. Routes through Apideck with serviceId "azure-active-directory".
license: Apache-2.0
alwaysApply: false
metadata:
  author: apideck
  version: "1.0.0"
  serviceId: azure-active-directory
  unifiedApis: ["hris"]
  authType: oauth2
  tier: "2"
  verified: true
  status: beta
  difficulty: moderate
  partnershipRequired: false
  sandboxAvailable: false
---

# Microsoft Entra (via Apideck)

Access Microsoft Entra through Apideck's **HRIS** unified API — one of 58 HRIS connectors that share the same method surface. Code you write here ports to BambooHR, Workday, Deel and 54 other HRIS connectors by changing a single `serviceId` string. Apideck handles auth, pagination, rate limiting, and retries so you don't write per-tenant Microsoft Entra plumbing.

> **Beta connector.** Microsoft Entra is currently in beta on Apideck. Expect partial resource coverage and occasional mapping gaps. Always verify coverage (see below) and fall back to the Proxy API for unsupported operations.

## Quick facts

- **Apideck serviceId:** `azure-active-directory`
- **Unified API:** HRIS
- **Auth type:** oauth2
- **Status:** beta
- **Gotchas:** [page](https://developers.apideck.com/apis/hris/azure-active-directory/gotchas)
- **Homepage:** https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis

## At a glance

- **Implementation difficulty:** moderate — Self-Service OAuth App + Approval Required
- **Vendor partnership required:** no ([Microsoft Entra admin center](https://learn.microsoft.com/en-us/entra/identity-platform/publisher-verification-overview)) — A multi-tenant app may need Microsoft publisher verification: free, but it requires a Partner Center account, not just a Microsoft sign-in.
- **Apideck-managed credentials:** not available — You register your own Microsoft Entra app, so the consent screen carries your own branding and verified publisher.
- **Account type required:** A Microsoft work or school account in the tenant being connected, on any Microsoft Entra ID tier.
- **Consumer access level:** A Microsoft administrator, or a user in a tenant where an administrator has already consented to the directory scopes.
- **Sandbox:** not available — Create a free Microsoft Entra tenant and populate it with test users and groups.
- **Costs:** No separate charge: Microsoft Entra ID is included in every Microsoft 365 and Azure tenant, and Microsoft Graph has no per-call fee.
- **Rate limits:** Microsoft Graph throttles dynamically by resource and tenant size rather than by a fixed quota, under a ceiling of 130,000 requests per 10 seconds per tenant.
- **Authentication:** Authorization Code flow via the Microsoft identity platform, reading directory data through Microsoft Graph.
- **Webhooks:** Virtual webhooks (Apideck polls for employee created and updated events only, no terminated event)

**Important to know:**

- The Graph scopes this connector requests require administrator approval in the consumer's tenant, so design your onboarding around an administrator completing or pre-approving the authorisation. An ordinary employee cannot connect on their own.
- Microsoft Entra ID is a directory, not an HR system. Field coverage depends on what each organisation maintains in its user profiles, HR data such as compensation does not exist there, and the connector is read-only, so Entra cannot be your write target for people records.
- Microsoft renamed the product from Azure Active Directory to Microsoft Entra ID in 2023, but Apideck's service id remains azure-active-directory: that is the value you use in API paths and see in the Apideck Dashboard.

> Facts synced from Apideck's connector metadata API — `GET /connector/connectors/azure-active-directory` (`overview` field) is the live, authoritative version.

## When to use this skill

Activate this skill when the user explicitly wants to work with **Microsoft Entra** — for example, "sync employees in Microsoft Entra" or "list time-off requests in Microsoft Entra". This skill teaches the agent:

1. Which Apideck unified API covers Microsoft Entra (HRIS)
2. The correct `serviceId` to pass on every call (`azure-active-directory`)
3. Microsoft Entra-specific auth and coverage caveats

For the full method surface (parameters, pagination, filtering), use your language SDK skill:

- [`apideck-node`](../../skills/apideck-node/), [`apideck-python`](../../skills/apideck-python/), [`apideck-dotnet`](../../skills/apideck-dotnet/), [`apideck-java`](../../skills/apideck-java/), [`apideck-go`](../../skills/apideck-go/), [`apideck-php`](../../skills/apideck-php/), or [`apideck-rest`](../../skills/apideck-rest/)

For the raw OpenAPI spec:

- **HRIS:** [https://specs.apideck.com/hris.yml](https://specs.apideck.com/hris.yml) · [API Explorer](https://developers.apideck.com/api-explorer?id=hris)

## Minimal example (TypeScript)

```typescript
import { Apideck } from "@apideck/unify";

const apideck = new Apideck({
  apiKey: process.env.APIDECK_API_KEY,
  appId: process.env.APIDECK_APP_ID,
  consumerId: "your-consumer-id",
});

// List employees in Microsoft Entra
const { data } = await apideck.hris.employees.list({
  serviceId: "azure-active-directory",
});
```

## Portable across 58 HRIS connectors

The Apideck **HRIS** unified API exposes the same methods for every connector in its catalog. Switching from Microsoft Entra to another HRIS connector is a one-string change — no rewrite, no new SDK.

```typescript
// Today — Microsoft Entra
await apideck.hris.employees.list({ serviceId: "azure-active-directory" });

// Tomorrow — same code, different connector
await apideck.hris.employees.list({ serviceId: "bamboohr" });
await apideck.hris.employees.list({ serviceId: "workday" });
```

This is the compounding advantage of using Apideck over integrating Microsoft Entra directly: code against the unified HRIS API once, gain access to every connector in it. New connectors Apideck adds become available to your app without code changes.

## Authentication

- **Type:** OAuth 2.0
- **Managed by:** Apideck Vault — Apideck handles the full OAuth dance (authorization code flow, token exchange, refresh). Never ask the user for API keys or tokens directly.
- **User setup:** Users authorize via the Vault modal. Connection state progresses `available → added → authorized → callable`.
- **Token refresh:** automatic. Expired tokens are refreshed transparently on the next API call.

See [`apideck-best-practices`](../../skills/apideck-best-practices/) for Vault setup, connection lifecycle, and handling re-auth flows.

## Verifying coverage

Not every HRIS operation is supported by every connector. Always verify before assuming a method works:

```bash
curl 'https://unify.apideck.com/connector/connectors/azure-active-directory' \
  -H "Authorization: Bearer ${APIDECK_API_KEY}" \
  -H "x-apideck-app-id: ${APIDECK_APP_ID}"
```

See [`apideck-connector-coverage`](../../skills/apideck-connector-coverage/) for patterns around `UnsupportedOperationError` and connector-specific fallbacks.

## Escape hatch: Proxy API

When an endpoint isn't covered by the HRIS unified API, use Apideck's Proxy to call Microsoft Entra directly — Apideck injects auth headers and handles token refresh. Set `x-apideck-downstream-url` to the target endpoint on Microsoft Entra's own API:

```bash
curl 'https://unify.apideck.com/proxy' \
  -H "Authorization: Bearer ${APIDECK_API_KEY}" \
  -H "x-apideck-app-id: ${APIDECK_APP_ID}" \
  -H "x-apideck-consumer-id: ${CONSUMER_ID}" \
  -H "x-apideck-service-id: azure-active-directory" \
  -H "x-apideck-downstream-url: <target endpoint on Microsoft Entra>" \
  -H "x-apideck-downstream-method: GET"
```

See [Microsoft Entra's API docs](#) for available endpoints.

## Sibling connectors

Other **HRIS** connectors that share this unified API surface (same method signatures, just change `serviceId`):

[`bamboohr`](../bamboohr/), [`workday`](../workday/), [`deel`](../deel/) *(beta)*, [`hibob`](../hibob/), [`personio`](../personio/), [`adp-ihcm`](../adp-ihcm/) *(beta)*, [`adp-workforce-now`](../adp-workforce-now/) *(beta)*, [`paychex`](../paychex/) *(beta)*, and 49 more.

## See also

- [HRIS OpenAPI spec](https://specs.apideck.com/hris.yml) · [API Explorer](https://developers.apideck.com/api-explorer?id=hris)
- [`apideck-connector-coverage`](../../skills/apideck-connector-coverage/) — programmatic coverage checks
- [`apideck-best-practices`](../../skills/apideck-best-practices/) — architecture, Vault, pagination, error handling
- [`apideck-node`](../../skills/apideck-node/) — TypeScript / Node SDK patterns