Configure Connection
Microsoft Entra ID guide
Use the Configuration Wizard to connect NIM to Microsoft Entra ID with the required app registration, permissions, and certificate authentication.
Before you beginDirect link to Before you begin
Choose the recommended Configuration Wizard, or use the manual setup below when your organization manages app registrations outside NIM. For manual setup, have the following values ready.
| NIM connection value | Source |
|---|---|
| Client ID | The application's Application (client) ID. |
| Tenant ID | The directory's Directory (tenant) ID. |
| Certificate | The certificate with its private key imported into NIM, matching the public certificate uploaded to the Entra application. |
Platform referencesDirect link to Platform references
For Microsoft platform requirements outside NIM, review Microsoft's guidance on registering an application and application permissions with administrator consent. Keep the permissions selected for NIM limited to the operations and data your implementation requires.
Recommended: use the Configuration WizardDirect link to Recommended: use the Configuration Wizard
The Configuration Wizard is the recommended way to configure this integration. It connects to Microsoft Entra ID and creates the required app registration with the correct permissions and certificate authentication.
Add and configure the systemDirect link to Add and configure the system
-
In NIM, go to Systems > Overview.
-
Select Add, choose Azure AD as the system type, enter a system name, and save it.
-
In the Configured Systems pane, select Configure for the new system.
-
Select Start in the Configuration Wizard and follow the prompts to sign in and authorize the connection.
Test the wizard connectionDirect link to Test the wizard connection
-
When the wizard completes, select Test Connection. A success message confirms that NIM can connect to Entra ID.
The Configuration Wizard creates the Entra ID app registration, applies the required Microsoft Graph permissions, and configures certificate authentication. Use the manual method below only when your organization requires the app registration to be created or managed outside NIM.
Manual configurationDirect link to Manual configuration
Use this method when the Configuration Wizard cannot be used or when your organization requires a separately managed Entra ID application.
Create the app registrationDirect link to Create the app registration
- Open the Microsoft Azure portal, then go to Microsoft Entra ID > App registrations.
- Select New registration, enter a name such as
NIM, and select Register. - On the application’s Overview page, copy the Application (client) ID and Directory (tenant) ID.
Configure certificate authenticationDirect link to Configure certificate authentication
-
Generate a certificate using your organization’s approved process. Export both of these formats:
.cer— X.509 encoded public certificate.pfx— certificate with its private key
-
In Entra ID, open the new application’s Certificates & secrets page. Select Upload certificate, upload the
.cerfile, and select Add. -
In NIM, add the
.pfxcertificate. -
Return to the NIM system’s Connection tab, enter the client ID and tenant ID, then select the uploaded certificate.
Add Microsoft Graph application permissionsDirect link to Add Microsoft Graph application permissions
In Entra ID, open API permissions > Add a permission > Microsoft Graph > Application permissions. Select the following permissions, then select Add permissions.
| Permission area | Required application permissions |
|---|---|
| Administrative units | AdministrativeUnit.Read.All, AdministrativeUnit.ReadWrite.All |
| Devices | Bitlocker.Read.All, Device.Read.All, Device.ReadWrite.All |
| Directory | Directory.Read.All, Directory.ReadWrite.All |
| Groups | Group.Read.All, Group.ReadWrite.All |
| Identity protection | IdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, IdentityRiskyUser.ReadWrite.All |
| Organization and reports | Organization.Read.All, Reports.Read.All |
| Teams | Team.Read.All, Team.ReadBasic.All, TeamSettings.ReadWrite.All |
| Users and authentication methods | User.Read.All, User.ReadWrite.All, UserAuthenticationMethod.Read.All, UserAuthenticationMethod.ReadWrite.All |
After adding the permissions, select Grant admin consent for <your organization> and confirm the action. The connection will not have access to the selected application permissions until consent is granted.
Validate the manual connectionDirect link to Validate the manual connection
- Save the NIM system configuration.
- Select Test Connection.
- If the test fails, verify the client ID, tenant ID, selected certificate, and the granted Microsoft Graph permissions.