# Entra ID integration for workflows

To integrate the Microsoft Graph API with the Nexthink platform, you need to establish two points of integration. One point of integration is required to bring UPN to the data model user table. Another integration point is required to handle the API credentials.

{% hint style="warning" %}
Note that permissions for connector actions are outside the scope of this page.

Refer to the corresponding API endpoint documentation for more information on each connector action and required permissions.
{% endhint %}

### Entra ID integration <a href="#entraidintegrationforworkflows-entraidintegration" id="entraidintegrationforworkflows-entraidintegration"></a>

The workflow utilizes the Universal Principal Name (UPN) from Entra ID integration. This is necessary to populate the UPN into the Nexthink data model, where it is mapped to the `user.ad.name` field. For more information on setting up the Nexthink connector to Entra ID, refer to the [Connector for Microsoft Azure Active Directory](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/inbound-connectors/connector-for-microsoft-entra-id-azure-ad).

The result of this integration should be that the user UPN is populated in the Nexthink user table. This user UPN is then utilized in the workflow when making Graph API calls. The following screenshots provide an example of an Entra ID connector setup and demonstrate that, when correctly set up, the users table populates with user names.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-fb6cd0d2b3f97aa48cad3ff3d4b85649a0b89482%2Fimage-20230920-160818.png?alt=media" alt=""><figcaption><p>Credentials setup example</p></figcaption></figure>

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-5a66af74f4b839a78a60570a459cdf0d59ecbc58%2Fimage-20230920-160905.png?alt=media" alt=""><figcaption><p>Field mappings example</p></figcaption></figure>

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-ca7a6f58dd9e8671f7df8e47a2fc3135290a4bca%2Fimage-20230920-160628.png?alt=media" alt=""><figcaption><p>User names are populated in users table</p></figcaption></figure>

### Graph API connector integration <a href="#entraidintegrationforworkflows-graphapiconnectorintegration" id="entraidintegrationforworkflows-graphapiconnectorintegration"></a>

Configuring connector credentials is essential for enabling API calls. Refer to the detailed information on the [Connector credentials ](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/outbound-connectors/connector-credentials)documentation page. Each Service/API thinklet has a dropdown field for credentials that needs to be filled out. When the workflow is installed or copied from the Library, this field will be blank, as it is a local setup of each environment and is not included in the Library. It’s crucial to add API read/write permissions in the Entra ID application registration setup.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-ffce47127022c885bd0bcbe51f9306f1f0cc815f%2Fimage-20230920-161542.png?alt=media" alt=""><figcaption><p>Example of credentials configurations</p></figcaption></figure>

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-602308b44819d47cc56187af61d118ca432b70e1%2Fimage-20230920-161407.png?alt=media" alt=""><figcaption><p>Thinklet with credentials field maintained</p></figcaption></figure>

Application ID in Entra application is maintained as Client ID in credential setup.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-ab70100ea4b853a4bedbcfc5c73a2273934b6273%2Fimage-20230920-162423.png?alt=media" alt=""><figcaption><p>Application ID in Entra application is maintained as Client ID in credential setup</p></figcaption></figure>

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-af337a25ceb81f447596aa5b1657c8c01037c45c%2Fimage-20230920-163149.png?alt=media" alt=""><figcaption><p>Tenant ID is used as part of the Access token URL</p></figcaption></figure>

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-34546e23704b904c8d3960ce86c87596a44705dc%2Fimage.png?alt=media" alt=""><figcaption><p>Client secret needs to be copied from App registrations, Certificates &#x26; secrets</p></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/library-packs/faq/entra-id-integration-for-workflows.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.