Composio connects AI agents to Microsoft Entra ID so they can work with identity and directory data. Access is limited by the permissions you approve and your account’s existing access.
This guide shows you how to set up OAuth credentials and connect Microsoft Entra ID to Composio.
Part 1: Create your Microsoft Entra OAuth app
Step 1: Register the app
1. Open Azure portal → App registrations → New registration. Name your app and choose the organizational accounts you want to support.
2. Select Web, enter this redirect URI and click Register.
https://backend.composio.dev/api/v1/auth-apps/add
Step 2: Copy your client ID and create a secret
1. Copy the Application (client) ID from Overview.
2. Open Certificates & secrets → New client secret.
3. Enter a description, choose an expiry and click Add.
4. Copy and securely store the secret Value. Use the Value, not the Secret ID. Rotate it before expiry.
Step 3: Add Microsoft Graph delegated permissions
1. Open API permissions → Add a permission.
2. Select Microsoft Graph.
3. Choose Delegated permissions.
Permission reference. For reading the signed-in user's profile, the minimum delegated permission is User.Read; offline_access supports continued access. Directory administration requires operation-specific permissions and roles. Choose for your own workflow; the screenshots are examples. Microsoft permission reference.
4. Choose the delegated permissions needed for the operations your integration will use. Then click Add permissions.
Part 2: Connect Microsoft Entra ID in Composio
Step 1: Create an auth config
1. In Composio, open Auth Configs and click Create.
2. Search for and select Microsoft Entra ID.
3. Enter a config name and click Next.
Step 2: Enter your OAuth credentials
1. Choose OAuth 2.0. Enter your app’s Client id and client-secret Value. This guide uses signed-in-user OAuth.
2. Keep the original redirect URI. Set Microsoft cloud environment to global for commercial Microsoft 365, or gcc_high for GCC High. The app registration and tenant must belong to that cloud.
3. Under Scopes, choose permissions required by your integration and supported by your app registration. Click Create Auth Config.
Step 3: Connect your account
1. Open the auth config and click Connect Account.
2. Sign in to the tenant containing the directory you want to use. Review any requested permissions before accepting. Your tenant may require administrator approval.
3. Wait for the successful connection page. Existing authorization may skip the consent prompt.
Step 4: Check the connection
1. Return to the auth config’s Accounts tab and confirm the connected account shows Active. Copy the Auth Config ID for your application.
