Microsoft 365 (Entra ID)

Sprooster reads your people from Microsoft Graph: names, titles, managers, departments, and (when your tenant populates them) hire dates. The connection uses an app registration in your Entra tenant with application permissions, so it keeps working no matter who set it up or who leaves.

You'll need to be able to create app registrations and grant admin consent, typically a Global Administrator or Privileged Role Administrator. Budget about ten minutes.

1. Register the app

1. Open the Entra admin center and go to Identity → Applications → App registrations → New registration.
2. Name it something recognizable: Sprooster works.
3. Leave Supported account types on Accounts in this organizational directory only.
4. Skip the redirect URI. Sprooster connects server-to-server; there is no sign-in flow.
5. Click Register.

2. Grant Graph permissions

1. In the new registration, open API permissions → Add a permission → Microsoft Graph.
2. Choose Application permissions (not delegated).
3. Add User.Read.All.
4. Optionally add OrganizationalBranding.Read.All as well (see below).
5. Click Grant admin consent for your org and confirm. The status column should show a green check.

User.Read.All covers everything the sync reads: user profiles and each user's manager link. Sprooster requests the standard .default scope, so whatever you consent to here is the ceiling.

OrganizationalBranding.Read.All is optional and read-only. With it, Sprooster picks up the square logo and background colour you already set on your Entra sign-in page and uses them to brand your workspace, so you don't have to upload a logo by hand. Skip it and nothing breaks: the connection works the same and you set your branding in Settings → Branding instead. Sprooster reads your branding once when the connection is saved and stores a copy, and it never overwrites a logo you uploaded yourself.

3. Create a client secret

1. Open Certificates & secrets → Client secrets → New client secret.
2. Give it a description and an expiry your policy allows (you'll rotate it in Sprooster by pasting a new one, which takes seconds).
3. Copy the secret Value immediately. Entra only shows it once.

4. Paste three values into Sprooster

From the registration's Overview page, collect:

In Sprooster's Connect directory step (or Settings → Data sources → Microsoft 365), paste the three values, hit Test connection (you should see a count of your people and a few sample names), then Save connection.

For your security review

The details an IT or security team usually wants before granting consent:

Auth flow. OAuth 2.0 client credentials against https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token, requesting the https://graph.microsoft.com/.default scope. No user sign-in, no delegated tokens, no redirect URIs.

API surface. Two Graph endpoints, both reads:

Exactly what's read. The $select is a fixed allow-list. Nothing outside it is requested:

accountEnabled, displayName, givenName, surname, jobTitle, mail, userPrincipalName, department, officeLocation, timeZone, businessPhones, mobilePhone, aboutMe, skills, interests, employeeHireDate, birthday, plus each user's manager reference. No group memberships, no mailbox contents, no sign-in activity, no devices. Disabled accounts (accountEnabled: false) are excluded from the directory. A null birthday is treated as "not shared" and stays empty.

Credential handling. The client secret is encrypted app-side with AES-256-GCM before it's stored. The encryption key lives outside the database, so the database alone can't yield your credential. The secret is write-only: the browser never receives it back, and an untouched secret field on later edits means "keep what's stored." Rotation is paste-over-and-save.

Throttling. Retry-After headers are honored; the sync backs off rather than hammering Graph.

Troubleshooting

• Authorization_RequestDenied on test — admin consent wasn't granted (step 2), or was granted for delegated instead of application permissions.
• invalid_client — the secret was pasted with whitespace, or it's the secret ID instead of the secret Value.
• Test passes but people are missing titles or managers — those fields are empty in Entra itself; Sprooster shows what Graph returns.
• Hire dates missing — employeeHireDate is only populated if your HR sync writes it to Entra; otherwise add hire dates in Sprooster or via CSV.