Fill gaps from assistant conversations: Entra SSO and multi-connector setup

baton/microsoft-entra.mdx

@@ -1,11 +1,15 @@
 ---
 title: "Set up a Microsoft Entra ID connector"
 og:title: "Set up a Microsoft Entra ID connector"
 og:description: "C1 provides identity governance and just-in-time provisioning for Entra ID. Integrate your Entra ID instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access."
 description: "C1 provides identity governance and just-in-time provisioning for Entra ID. Integrate your Entra ID instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access."
 sidebarTitle: "Microsoft Entra ID"
 ---
 
+<Note>
+This page covers the Entra ID **connector**, which syncs and provisions access data for identity governance. It does not control how you sign in to C1. To set up signing in to C1 with your Entra ID account, see [Create a C1 tenant and set up SSO](/product/how-to/qs-set-up-c1).
+</Note>
+
 ## Capabilities
 
 | Resource | Sync | Provision |
@@ -18,13 +22,13 @@
 | Managed identities | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |  |
 | Service principal credentials | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |  |
 
 The Entra ID connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning). 
 
 When a new account is created by C1, the account's password will be sent to a [vault](/product/admin/vaults).
 
 #### Account creation fields
 
 The following fields are available when provisioning a new Entra ID user account:
 
 | Field | Required | Description |
 | :--- | :--- | :--- |
@@ -38,12 +42,12 @@
 | `employeeId` | No | Employee identifier assigned by the organization (max 16 characters) |
 | `jobTitle` | No | The user's job title |
 | `department` | No | The department the user works in |
 | `manager` | No | Manager identifier: Entra object ID (GUID), UPN, or employee ID |
 | `additionalAttributes` | No | JSON object of additional Microsoft Graph user properties (see below) |
 
 If manager resolution fails, the user is still created and a warning is logged.
 
 The `additionalAttributes` field accepts a JSON string containing any writable [Microsoft Graph user property](https://learn.microsoft.com/en-us/graph/api/user-post-users). For example: `{"city":"Springfield","usageLocation":"US","companyName":"SNPP"}`. This field cannot override any of the explicitly named fields listed above.
 
 <Info>
 **Tip:** If you plan to assign licenses to the user (either directly or via a group), include `usageLocation` in `additionalAttributes`. Microsoft requires a usage location before a license can be assigned.
@@ -53,42 +57,42 @@
 
 ### Connector actions
 
 Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the [Perform connector action](/product/admin/automations-steps-reference#perform-connector-action) automation step.
 
 | Action name | Additional fields | Description |
 |-------------|-------------------|-------------|
 | enable_user | `user_id` (string, required) | Enables a disabled Microsoft Entra user account |
 | disable_user | `user_id` (string, required) | Disables an active Microsoft Entra user account |
 | update_user | `user_id` (string, required)<br/>`user_profile` (JSON string, required) | Updates user account attributes including profile information, employment details, and contact information |
 | set_manager | `user_id` (string, required)<br/>`manager_identifier` (string, optional) | Sets or updates a user's manager relationship. Accepts manager ID, UPN, or Employee ID. Leave manager_identifier empty to remove the current manager. |
 | check_upn | `proposed_upn` (string, required) | Checks if a User Principal Name (UPN) is available. If taken, finds an available UPN by appending incrementing numbers. |
 | update_profile | `user_id` (string, required)<br/>Plus optional profile fields | Updates user profile attributes including mail, displayName, jobTitle, employeeId, department, companyName, country, and extensionAttribute1 through extensionAttribute15. |
 | create_group | `displayName` (string, required)<br/>`group_type` (string, required): `security` or `microsoft_365`<br/>`mailNickname` (string, optional): auto-generated from display name if omitted<br/>`description` (string, optional)<br/>`isAssignableToRole` (bool, optional): security groups only<br/>`owner` (resource ID, optional): initial group owner<br/>`userMembers` (resource ID list, optional): initial group members | Creates a new Entra ID group. Supports security and Microsoft 365 (unified) group types with assigned membership. Requires the `Group.Create` permission. |
 | revoke_sessions | `user_id` (string, required) | Revokes all active sign-in sessions for a user by invalidating their refresh tokens, forcing re-authentication (`POST /users/{id}/revokeSignInSessions`). Refresh tokens are invalidated immediately, but existing access tokens can remain valid for up to ~1 hour unless Continuous Access Evaluation (CAE) is enabled. Requires the `User.RevokeSessions.All` permission. |
 | revoke_mfa | `user_id` (string, required) | Deletes a user's registered MFA (authentication) methods, forcing re-registration at next sign-in. Lists the user's methods and deletes each deletable one; password methods are skipped. Graph refuses to delete the user's default method while other methods remain (HTTP 400), so MFA may not be fully revocable in one invocation — per-method failures are reported and do not abort the action. Returns `success` (true only if every deletable method was deleted), `deleted_count`, `failed_count`, `skipped_count`, and per-method `results`. Requires the `UserAuthenticationMethod.ReadWrite.All` permission. |
 
 ## Gather Entra ID credentials 
 
 Configuring the connector requires you to pass in credentials generated in Entra ID. Gather these credentials before you move on. 
 
 <Tip>
 If you prefer to set up a cloud-hosted Entra ID connector using OAuth, skip ahead to the **OAuth** tab below.
 </Tip>
 
 <Warning>
 A user with the **Global Administrator** permission in Entra ID must perform this task.
 </Warning>
 
 ### Create a new Entra application 
 <Steps>
 <Step>
 In Entra admin center, navigate to **App registrations**.
 </Step>
 <Step>
 Click **+ New registration**. 
 </Step>
 <Step>
 Give the application a name, such as "C1", and select the supported account type relevant to your Entra installation. You do not need to set a redirect URL. 
 </Step>
 <Step>
 Click **Register**. 
@@ -112,7 +116,7 @@
 The client secret is generated. Carefully copy and save the **Secret Value**.  
 </Step>
 </Steps>
 ### Give the new Entra app API permissions
 <Steps>
 <Step>
 Click **API permissions**.
@@ -168,9 +172,9 @@
    User.EnableDisableAccount.All 
    ```
 
    To set or rotate passwords for non-admin users, the app requires, in addition to the stated permissions, a privileged role such as Helpdesk Administrator or Password Administrator. **To set or rotate passwords for users with admin roles, the app must be assigned Privileged Authentication Administrator (or Global Administrator).**
 
    To deprovision users who have a privileged role assigned to them, the app requires, in addition to the stated permissions, a privileged role such as Global Administrator or Privileged Authentication Administrator.
 
    <Info>
    **Optional:** To enable group management (creating groups via connector actions), add the following permission in addition to the provisioning permissions above:
@@ -183,7 +187,7 @@
    </Info>
 
    <Info>
    **Optional:** To enable the offboarding connector actions (`revoke_sessions` and `revoke_mfa`), add the following permissions in addition to the provisioning permissions above:
 
    ```bash
    User.RevokeSessions.All
@@ -214,14 +218,14 @@
 ## Optional: Configure Exchange groups provisioning with client secret-based auth
 
 <Note>
 This section requires assigning the **Exchange Administrator** role to the connector's app registration. This is required because distribution lists and mail-enabled security groups are Exchange-only objects — Microsoft Graph API has no support for managing them, so the Exchange Online admin API (the same mechanism used by Exchange Online PowerShell) is the only Microsoft-supported path. If you'd rather not grant this role, you can skip this section: the rest of the connector (users, Entra ID groups, licenses, and so on) will keep working normally — you just won't get provisioning for Exchange distribution lists and mail-enabled security groups.
 </Note>
 
 To set up the connector to support provisioning owners and members to Exchange groups, which are distribution lists and mail-enabled security groups, follow these steps:
 
 <Steps>
 <Step>
 In the Microsoft Entra Admin Center, navigate to **App registrations** and click the name of the app you created for this connector. 
 </Step>
 <Step>
  In the application dashboard, click **API permissions** > **Add a permission**. 
@@ -264,13 +268,13 @@
 </Steps>
 **Done.** Your connector is now ready to allow the provisioning of users as owners and members in Exchange groups.
 
 ## Configure the Entra ID connector
 
 <Warning>
 To complete this task, you'll need:
 
 - The **Connector Administrator** or **Super Administrator** role in C1
 - Access to the set of Entra ID credentials generated by following the instructions above
 </Warning>
 
 <Tabs>
@@ -284,9 +288,9 @@
 Search for **Entra ID** and click **Add**. 
 </Step>
 <Step>
 Choose how to set up the new Entra ID connector: 
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -307,30 +311,30 @@
 Select **Client secret**.
 </Step>
 <Step>
 Paste the tenant ID into the **Entra tenant ID** field.
 </Step>
 <Step>
 Paste the client ID into the **Entra client ID** field.
 </Step>
 <Step>
 Paste the client secret into the **Entra client secret** field.
 </Step>
 <Step>
 **Optional.** Check the box if you want to **Skip syncing Active Directory Server groups**.
 </Step>
 <Step>
 **Optional.** If you enabled **Skip syncing Active Directory Server groups** in the previous step, you can also enable **Include on-premises users in cloud group memberships**. This keeps on-premises synced users as members of cloud-native Entra groups. See [Hybrid AD configuration](#hybrid-ad-configuration) below for details. This setting has no effect if **Skip syncing Active Directory Server groups** is disabled.
 </Step>
 <Step>
 **Optional** If you connect to a Microsoft Graph API domain other than graph.microsoft.com, specify your domain in the **Microsoft Graph domain** field.
 </Step>
 <Step>
 **Optional.** To capture Entra usage data, click to enable **Fetch user sign-in activity**.
 
    The usage data feature requires a Microsoft Entra ID P1 or P2 license. Usage data collection is not supported on Microsoft Entra ID Free licenses.
 </Step>
 <Step>
 **Optional.** Click to opt into **Schedule SCIM provisioning**, which forces an Entra SCIM sync when a new entitlement is provisioned for a user in C1.
 </Step>
 <Step>
 **Optional.** Click to **Disable resource changed event feed**. These logs are enabled by default.
@@ -352,7 +356,7 @@
 The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
 </Step>
 </Steps>
 **Done.** Your Entra ID connector is now pulling access data into C1.
 </Tab>
 
 <Tab title="Certificate">
@@ -364,12 +368,12 @@
 In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
 </Step>
 <Step>
 Search for **Entra ID** and click **Add**.
 </Step>
 <Step>
 Choose how to set up the new Entra ID connector:
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -390,7 +394,7 @@
 Select **Certificate**.
 </Step>
 <Step>
 Paste the tenant ID into the **Entra tenant ID** field.
 </Step>
 <Step>
 Paste the client ID into the **Client ID** field.
@@ -405,18 +409,18 @@
 **Optional.** Check the box if you want to **Skip syncing Active Directory Server groups**.
 </Step>
 <Step>
 **Optional.** If you enabled **Skip syncing Active Directory Server groups** in the previous step, you can also enable **Include on-premises users in cloud group memberships**. This keeps on-premises synced users as members of cloud-native Entra groups. See [Hybrid AD configuration](#hybrid-ad-configuration) below for details. This setting has no effect if **Skip syncing Active Directory Server groups** is disabled.
 </Step>
 <Step>
 **Optional.** If you connect to a Microsoft Graph API domain other than graph.microsoft.com, specify your domain in the **Microsoft Graph domain** field.
 </Step>
 <Step>
 **Optional.** To capture Entra usage data, click to enable **Fetch user sign-in activity**.
 
    The usage data feature requires a Microsoft Entra ID P1 or P2 license. Usage data collection is not supported on Microsoft Entra ID Free licenses.
 </Step>
 <Step>
 **Optional.** Click to opt into **Schedule SCIM provisioning**, which forces an Entra SCIM sync when a new entitlement is provisioned for a user in C1.
 </Step>
 <Step>
 **Optional.** Click to **Disable resource changed event feed**. These logs are enabled by default.
@@ -438,7 +442,7 @@
 The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
 </Step>
 </Steps>
 **Done.** Your Entra ID connector is now pulling access data into C1.
 </Tab>
 
 <Tab title="OAuth">
@@ -453,9 +457,9 @@
 Search for **Entra ID** and click **Add**. 
 </Step>
 <Step>
 Choose how to set up the new Entra ID connector: 
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -476,24 +480,24 @@
 Select **OAuth**. 
 </Step>
 <Step>
 Specify the ID of the Entra tenant you're integrating in the **Entra tenant ID** field. 
 </Step>
 <Step>
 **Optional.** Check the box if you want to **Skip syncing Active Directory Server groups**.
 </Step>
 <Step>
 **Optional.** If you enabled **Skip syncing Active Directory Server groups** in the previous step, you can also enable **Include on-premises users in cloud group memberships**. This keeps on-premises synced users as members of cloud-native Entra groups. See [Hybrid AD configuration](#hybrid-ad-configuration) below for details. This setting has no effect if **Skip syncing Active Directory Server groups** is disabled.
 </Step>
 <Step>
 **Optional** If you connect to a Microsoft Graph API domain other than graph.microsoft.com, specify your domain in the **Microsoft Graph domain** field.
 </Step>
 <Step>
 **Optional.** To capture Entra usage data, click to enable **Fetch user sign-in activity**.
 
    The usage data feature requires a Microsoft Entra ID P1 or P2 license. Usage data collection is not supported on Microsoft Entra ID Free licenses.
 </Step>
 <Step>
 **Optional.** Click to opt into **Schedule SCIM provisioning**, which forces an Entra SCIM sync when a new entitlement is provisioned for a user in C1.
 </Step>
 <Step>
 **Optional.** Click to **Disable resource changed event feed**. These logs are enabled by default.
@@ -512,7 +516,7 @@
 Click **Login with OAuth**. 
 </Step>
 <Step>
 Log in and authorize C1 with your Entra ID instance.
 
    In order for the integration to work properly, you must consent to all permissions. 
 </Step>
@@ -522,7 +526,7 @@
 
 <Steps>
 <Step>
 In the Entra ID control panel, navigate to **Enterprise Applications**.
 </Step>
 <Step>
 Click the **C1 Integration** app (not to be confused with the **C1 SSO** app, which is used to log into C1, not to synchronize your data).
@@ -541,7 +545,7 @@
 
 <Steps>
 <Step>
 Return to the Entra ID integration in C1 by clicking the **Entra ID** tile on the **Integrations** page.
 </Step>
 <Step>
 Click the **Entra ID** connector link that shows today's date in the **Connected on** column.
@@ -551,11 +555,11 @@
 </Step>
 </Steps>
 
 **Done.** Your Entra ID connector is now pulling access data into C1.
 </Tab>
 
 <Tab title="Self-hosted">
 **Follow these instructions to use the Entra ID connector, hosted and run in your own environment.**
 
 When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.
 
@@ -563,7 +567,7 @@
 
 * [Official download center](https://dist.conductorone.com/ConductorOne/baton-microsoft-entra): For stable binaries (Windows/Linux/macOS) and container images.
 
 ### Step 1: Set up a new Entra ID connector
 <Steps>
 <Step>
 In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
@@ -572,9 +576,9 @@
 Search for **Baton** and click **Add**.
 </Step>
 <Step>
 Choose how to set up the new Entra ID connector: 
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -599,7 +603,7 @@
 </Steps>
 ### Step 2: Create Kubernetes configuration files
 
 Create two Kubernetes manifest files for your Entra ID connector deployment:
 
 #### Secrets configuration
 
@@ -687,23 +691,23 @@
 ### Step 3: Deploy the connector
 <Steps>
 <Step>
 Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files. 
 </Step>
 <Step>
 Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Entra ID connector to. Entra ID data should be found on the **Entitlements** and **Accounts** tabs.
 </Step>
 </Steps>
 **Done.** Your Entra ID connector is now pulling access data into C1.
 </Tab>
 </Tabs>
 
 ## Hybrid AD configuration
 
 Organizations that use Microsoft Entra Connect to sync on-premises Active Directory with Entra ID have a mix of cloud-native and on-premises synced objects. The connector provides two settings to control how these are handled:
 
 ### Skip Active Directory Server groups (`--skip-ad-groups` / `BATON_SKIP_AD_GROUPS`)
 
 When enabled, the connector excludes groups that originate from on-premises Active Directory (where `onPremisesSyncEnabled` is `true`). Only cloud-native Entra groups are synced.
 
 By default, this also filters out on-premises synced users from the membership lists of cloud groups. This means that if a cloud group contains both cloud-native and on-premises synced users, only the cloud-native members will appear as grants.
 
@@ -716,7 +720,7 @@
 - On-premises AD **groups** are still skipped (not synced)
 - On-premises synced **users** who are members of cloud groups are included in those groups' membership grants
 
 This is useful in hybrid environments where cloud-native Entra groups contain a mix of cloud and on-premises synced users, and you want full visibility into who has access to what through those cloud groups.
 
 <Warning>
 This setting has no effect unless **Skip Active Directory Server groups** is also enabled. When **Skip Active Directory Server groups** is disabled, all groups and all their members are synced regardless of this setting.
@@ -724,7 +728,7 @@
 
 ### What's next?
 
 If Entra ID is your company's identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in C1 for all of your SCIMed software. Before you move on, review the [Create applications](/product/admin/applications) page for important information about how to set up integrations with the SCIMed apps.
 
 
 

product/admin/applications.mdx

@@ -15,7 +15,7 @@
 
 - **Managed apps:** These are the apps you've set up in C1 so it can provide visibility, governance, and automation. You're actively managing these apps with C1.  
 
 - **Unmanaged apps:** When you add a connector for an app that is an identity provider (IdP), SSO, or federation provider, the connector discovers the child apps inside of it. These apps are listed as unmanaged. You can move these apps to the **Managed** state (more on that below) or leave them as-is.
 
 - **Shadow apps:** These are apps that have been discovered in your environment but are likely not sanctioned for use by your organization's corporate IT. [Learn more about shadow apps](/product/admin/shadow-apps).
 
@@ -47,9 +47,9 @@
 
    * **Connector** to sync data automatically through a direct integration with the tool or service. 
 
    * **File import** to upload access data from a file or datasource. Learn more about [formatting files for upload](/baton/file-connectors).
 
       Also select this option if you want to create a custom app that provisions access using webhooks or helpdesk tickets. 
 
    * **Single-sign-on provider** to pull data about the app via your single-sign-on provider's connector. 
 </Step>
@@ -62,11 +62,11 @@
 
   * For a **File import** app, set the new app's name and provide a description. You'll be prompted to import the data on the next screen. 
 
   * For a **Single-sign-on** app, select the application from the list of currently unmanaged apps. Optionally, select a connector to add to this app.  
 
     Adding a connector to a single-sign-on app means that the application will contain records of both what the single-sign-on provider knows about the app (activity and accounts), and the resource and entitlement data pulled from the software itself by the connector. 
 
     For example, if your organization signs into BizApp via your SSO provider, you'd select the unmanaged BizApp application, then add the BizApp connector you set up to pull access data directly from the software into C1. (You can also add a connector to a single-sign-on app later, if it's not set up quite yet.) 
 
 </Step>
 <Step>
@@ -83,15 +83,15 @@
 **Done.** From here, you can configure the new app, add connectors or upload data, view resources, entitlements, and accounts, run reports, and more. 
 
 
 ## Move an unmanaged app to managed
 
 When you add a connector for an app that is an identity provider (IdP), SSO, or federation provider, the connector discovers the apps that are inside of it. These apps are added to the **Unmanaged** app list. 
 
 <Warning>
 A user with the **Super Administrator** role in C1 must complete this task.
 </Warning>
 
 If you want to bring an unmanaged app under C1 management so you can start enforcing access controls on it: 
 
 <Steps>
 <Step>
@@ -109,7 +109,7 @@
    [Learn more about app owners.](#manage-app-owners)
 </Step>
 <Step>
 Click **Manage**. The unmanaged app becomes a new managed app. 
 </Step>
 </Steps>
 
@@ -192,10 +192,12 @@
 
 For example, you might use a complex tool that requires multiple flat file uploads to fully represent the user and access data. In this case, you would add multiple file connectors to the application, one for each of the files.
 
+You can also set up more than one connector of the same type in C1. For example, if your organization has two Okta orgs, add a second Okta connector by repeating the connector's standard setup flow. During setup, choose whether to add the new connector to an existing managed app, to a currently unmanaged app, or to a new managed app.
+
 ## Important notes about managing applications 
 
 ### Delete applications with great caution! 
 
 If you delete an IdP, federation, or SSO provider application from C1, all of the applications that have been discovered within it, both those that are unmanaged and those you've moved to managed and added connectors to, will also be deleted. You'll have to manually recreate these apps and re-add connectors to them to continue managing them with C1.