Import your Entra ID users and groups

Astrolabe reads the users and the groups of your Microsoft Entra ID with an app registration and adds them to the catalog.

You set it up once, as an administrator.

The collection itself was not checked with an app registration that is allowed to read the directory. This step was not checked on a live instance.

Before you start

You need an app registration in Microsoft Entra ID, with:

• the application permissions User.Read.All and GroupMember.Read.All, with admin consent;
• a client secret.

Keep three values: its Directory (tenant) ID and its Application (client) ID, both on its Overview page, and the Value of the client secret (Certificates & secrets).

🔧 Configure the Microsoft Graph provider

1. In the left sidebar, at the bottom, click Administration.

2. Under PLATFORM, click Catalog. The Providers tab opens.

3. On the Microsoft Graph card, click Configure.

4. Fill in the form. Each ? next to a label explains the field.

   Field	What to enter
   Target URL	Leave https://graph.microsoft.com/v1.0, unless you use a national cloud
   Authority URL	Leave https://login.microsoftonline.com, unless you use a national cloud
   Tenant ID	The Directory (tenant) ID
   Client ID	The Application (client) ID
   Client Secret	The Value of the client secret

5. Click Install. A window says Reloading configuration, then the page comes back.

Fill the three values before you click Install

Tenant ID, Client ID and Client Secret are needed for the provider to start.

🔍 Import only some users and groups

The same form has two optional sections. Leave them empty to import everything.

Field	What it does	Example
UserGroupMember › User Group Member Filter	Only the users who are members of the groups matching this OData filter	displayName eq 'Engineering'
UserGroupMember › User Group Member Search	The same, as a search expression	"displayName:Engineering"
Group › Group Filter	Only the groups matching this OData filter	securityEnabled eq true
Group › Group Search	Only the groups matching this search	"displayName:team"
Group › Group Expand	Extra group properties to fetch	member
Group › Group Select Fields	The group properties to read: click Add Group Select Fields, one per entry	id, displayName, description

▶️ Run the collection now

You don't want to wait for the next run?

1. On Administration › Catalog, find the Catalog collection table.

2. On the Microsoft Graph · default row, click Run the Microsoft Graph collection now in the Actions column.

3. Reload the page. State says how it went and Detail says why when it failed.

Your users and groups are then in Catalog.

✅ That's it!

Next: Common problems.