Microsoft Entra Connection Setup for Production Assist#

This guide explains how to connect a Microsoft Entra tenant to Production Assist so users from a Microsoft Entra group can be synchronized into Production Assist.

The screenshots in this guide show the Microsoft Entra admin center with an app registration named Production-Assist, API permissions for Microsoft Graph, and a tenant named GTG.

Prerequisites#

Before you start, make sure you have:

1. Access to the Microsoft Entra admin center:

   https://entra.microsoft.com
   

2. An administrator account with permission to grant Microsoft Graph application permissions. For Graph application permissions, use one of these roles:

   • Global Administrator
   • Privileged Role Administrator

3. Access to the Production Assist organization settings where the Entra connection will be saved.

4. A Microsoft Entra group that contains the users who should get access to Production Assist. The group must be named exactly:

   Azure_APP_Production-Assist
   

5. Users in the group should have a usable email address or user principal name.

Overview#

The setup has six parts:

1. Create or open the Production-Assist app registration in Microsoft Entra.
2. Configure web sign-in, the redirect URI, and ID token issuance.
3. Create a client secret for Production Assist.
4. Grant Microsoft Graph application permissions.
5. Create or verify the access group.
6. Add the tenant ID, client ID, and client secret in Production Assist.

Production Assist uses two separate Entra functions:

• User synchronization accesses Microsoft Graph as a background service. This uses Application permissions.
• User sign-in uses OpenID Connect through a Web platform configuration and requires ID token issuance.

1. Open Microsoft Entra Admin Center#

1. Go to:

   https://entra.microsoft.com
   

2. Sign in with an administrator account.

3. In the left sidebar, open:

   Entra ID
   

4. Make sure you are in the correct tenant. In the tenant overview screen, confirm the tenant name and tenant ID.

The tenant overview confirms that you are working in the correct tenant and shows the tenant ID you need later.

2. Create Or Open The App Registration#

If the app registration already exists, open it:

1. In the left sidebar, go to:

   Entra ID > App registrations
   

2. Select:

   All applications
   

3. Search for:

   Production-Assist
   

4. Open the app registration.

If the app registration does not exist, create it:

1. Go to:

   Entra ID > App registrations
   

2. Click:

   New registration
   

3. Use this name:

   Production-Assist
   

4. For supported account types, select:

   Accounts in this organizational directory only
   

5. For the redirect URI, select the Web platform and enter this exact address:

   https://www.production-assist.com/login/azure-redirect
   

6. Click:

   Register
   

3. Configure Web Sign-In And ID Tokens#

When signing in, Production Assist requests an OpenID Connect ID token through the hybrid flow. The app registration must therefore be configured as a web application and allowed to issue ID tokens.

1. In the app registration, open:

   Authentication
   

2. Under Platform configurations, check whether a platform of type Web already exists. If not, select:

   Add a platform > Web
   

3. Under Redirect URIs, enter this exact address:

   https://www.production-assist.com/login/azure-redirect
   

   Make sure to use https, include the full path, and not add a trailing slash.

4. Under Implicit grant and hybrid flows, enable:

   ID tokens (used for implicit and hybrid flows)
   

5. The Access tokens option does not need to be enabled for Production Assist.

6. Click Save.

Alternatively, you can verify the setting in the app manifest. It should look like this:

"web": {
  "redirectUris": [
    "https://www.production-assist.com/login/azure-redirect"
  ],
  "implicitGrantSettings": {
    "enableIdTokenIssuance": true,
    "enableAccessTokenIssuance": false
  }
}

4. Copy The Client ID And Tenant ID#

On the app registration overview page, copy these values:

1. Application (client) ID
2. Directory (tenant) ID

You will enter both values in Production Assist later.

Use the Overview page to verify both IDs before you continue.

5. Create A Client Secret#

1. In the app registration, open:

   Certificates & secrets
   

2. Open:

   Client secrets
   

3. Click:

   New client secret
   

4. Enter a description, for example:

   Production Assist AD Sync
   

5. Choose an expiration period according to your company policy.

6. Click:

   Add
   

7. Copy the secret Value immediately.

Important: copy the secret Value, not the secret ID. Microsoft only shows the secret value once.

You will enter this value in Production Assist as the client secret.

The Certificates & secrets area is where you create and later rotate client secrets.

6. Add Microsoft Graph API Permissions#

1. In the app registration, open:

   API permissions
   

2. Click:

   Add a permission
   

3. Select:

   Microsoft Graph
   

4. Select:

   Application permissions
   

Do not select Delegated permissions. Production Assist runs the sync in the background without a signed-in Microsoft user.

Select Application permissions so the sync can run in the background without a signed-in Microsoft user.

7. Select The Required Permissions#

Production Assist needs permission to find the access group and read its members.

Add these Microsoft Graph Application permissions:

User.Read.All
Group.Read.All
GroupMember.Read.All

Add GroupMember.Read.All#

1. In the permission search field, type:

   group
   

2. Expand:

   GroupMember
   

3. Select:

   GroupMember.Read.All
   

4. Do not select:

   GroupMember.ReadWrite.All
   

Make sure you select GroupMember.Read.All under GroupMember, not GroupMember.ReadWrite.All.

Add User.Read.All#

1. In the permission search field, type:

   user
   

2. Expand:

   User
   

3. Select:

   User.Read.All
   

Add Group.Read.All#

1. In the permission search field, type:

   group
   

2. Expand:

   Group
   

3. Select:

   Group.Read.All
   

4. After selecting all three permissions, click:

   Add permissions
   

After adding the permissions, they appear in the configured permissions table.

If your app registration already shows a default delegated permission such as User.Read, you can leave it in place. Production Assist uses User.Read.All, Group.Read.All, and GroupMember.Read.All as Application permissions for the background sync.

8. Grant Admin Consent#

Adding permissions is not enough. An administrator must grant tenant-wide consent.

1. Stay on:

   API permissions
   

2. Click:

   Grant admin consent for <tenant name>
   

3. Confirm the consent dialog.

4. Check the Status column. The permissions should show admin consent granted for the tenant.

If the button is disabled, your account probably does not have enough administrative rights.

The configured permissions view should show User.Read.All, Group.Read.All, and GroupMember.Read.All under Microsoft Graph and let an administrator grant tenant-wide consent.

9. Create The Production Assist Access Group#

Production Assist looks for a group with this exact display name:

Azure_APP_Production-Assist

To create or verify the group:

1. In Microsoft Entra, go to:

   Entra ID > Groups
   

2. Select:

   All groups
   

3. Search for:

   Azure_APP_Production-Assist
   

4. If the group does not exist, click:

   New group
   

5. Use:

   Group type: Security
   Group name: Azure_APP_Production-Assist
   

6. Add all users who should get access to Production Assist.

7. Save the group.

Important: Production Assist reads direct group members. Avoid relying on nested groups unless the sync implementation has been changed to support them.

10. Configure Production Assist#

In Production Assist, open the organization or tenant settings for the customer that should be connected to Microsoft Entra. In the section Configure an AD Server for authentication, enter these values:

Production Assist field	Value from Microsoft Entra
AD Master Tenant Id	Directory (tenant) ID
AD Master Client Id	Application (client) ID
AD Master Client Secret	Client secret Value

Use Refresh AD preview to check the current result before you click Save configuration.

Save the configuration.

If Production Assist shows a preview, verify that the listed users match the members of:

Azure_APP_Production-Assist

11. Run And Verify The Sync#

After the connection is saved, run the Azure AD sync in Production Assist or wait for the scheduled sync.

The expected result is:

1. Production Assist finds the Microsoft Entra group.
2. Production Assist reads the group members.
3. Production Assist creates users that do not exist yet.
4. Production Assist adds the users to the connected Production Assist tenant.

In the server logs, a successful sync should look similar to:

Fetched <number> users from tenant <tenant-id>
Processed <number> users for tenant <tenant-id>
Updated tenant <production-assist-tenant-id> with <number> users

Troubleshooting#

AADSTS700054: response_type 'id_token' is not enabled#

The app registration is not yet allowed to issue ID tokens for the hybrid flow used by Production Assist.

Check the following:

1. Open Entra ID > App registrations > Production-Assist > Authentication.
2. Make sure a platform of type Web exists.
3. Verify that this exact redirect URI is configured:

   https://www.production-assist.com/login/azure-redirect
   

4. Under Implicit grant and hybrid flows, enable ID tokens (used for implicit and hybrid flows).
5. Click Save and try signing in again.

AADSTS50011: Redirect URI mismatch#

The redirect URI sent by Production Assist does not exactly match the one in the app registration.

Pay particular attention to the scheme, host, path, and any trailing slash. For the production environment, the URI must be exactly:

https://www.production-assist.com/login/azure-redirect

Request failed with status code 403#

The app does not have the required Microsoft Graph application permissions, or admin consent has not been granted.

Check:

1. User.Read.All and Group.Read.All are added as Application permissions.
2. GroupMember.Read.All is added as an Application permission.
3. Admin consent has been granted.
4. The token was refreshed after consent was granted.

Group Not Found#

Production Assist could not find:

Azure_APP_Production-Assist

Check:

1. The group name is exactly correct.
2. The group exists in the same tenant as the app registration.
3. You copied the correct Directory (tenant) ID into Production Assist.

Users Are Not Created#

Check:

1. The users are direct members of Azure_APP_Production-Assist.
2. The users have a usable email address or user principal name.
3. The group is not empty.
4. The sync logs show Fetched users and Processed users.

If the logs show users fetched but zero users processed, the Microsoft Graph response may not contain usable email information for those users.

Invalid Client Secret#

Check:

1. You copied the client secret Value, not the secret ID.
2. The secret has not expired.
3. The secret belongs to the same app registration whose client ID was entered in Production Assist.

Admin Consent Button Is Missing Or Disabled#

Use an account with one of these roles:

Global Administrator
Privileged Role Administrator

Then reload the app registration and try again.

Maintenance#

Client secrets expire. Before the secret expires:

1. Create a new client secret in Microsoft Entra.
2. Update the secret in Production Assist.
3. Run the sync and verify it works.
4. Remove the old secret from Microsoft Entra.

Security Notes#

1. Store the client secret securely.
2. Do not send the secret by email or chat.
3. Grant only the required Microsoft Graph permissions.
4. Remove unused client secrets.
5. Review group membership regularly.