> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/nightfall_settings/directory_sync/microsoft_entra_id.md).
# Add Microsoft Entra ID to Nightfall
Learn how to sync your Microsoft Entra ID's data to Nightfall.
This document explains the process of adding your Microsoft Entra ID to Nightfall to enable Directory Sync. Once you add the Microsoft tenant to Nightfall, you can sync users and user groups data from Microsoft to Nightfall. To get an overview of the Directory Sync feature in Nightfall, you can read [this article](/nightfall_settings/directory_sync.md) and then proceed with this document.
## Prerequisites
* You must have a Microsoft Entra ID (formerly known as Microsoft Azure Active Directory) account.
* A Microsoft Entra user account with the **Global Administrator** or **Privileged Role Administrator** role, or a custom directory role that can grant Microsoft Graph application permissions. The Nightfall IDP app requests Microsoft Graph application permissions, which Cloud Application Administrator and Application Administrator cannot grant. For more information, refer to the Microsoft documentation [here](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=ms-graph#prerequisites).
Nightfall IDP's access is read only. It is separate from the app registrations Nightfall creates for Microsoft Teams, OneDrive, and SharePoint. For the permissions it requests and why, see [SaaS App Permissions Reference](/nightfall_integrations/saas-app-permissions-reference.md).
## Configure Microsoft Entra ID
1. Click the **Settings** button on the Nightfall console (bottom-left).
2. Click the **Directory Sync** tab.
3. Click **Add Directory**.
4. Select **Azure Entra** as the identity provider.
5. Click **Connect**.
6. Enter Email or phone number associated with your Microsoft Azure account.
7. Click **Next**.
8. Enter your password and click **Sign In.**
When you sign in as an Azure admin, you can consent the installation of Nightfall IDP yourself. You can view the following screen. You must click **Accept**.
Once you approve the request, the installation proceeds. Once the installation is completed, you can see the following screen. You must click **Setup Complete**.
After the setup is complete, the first sync may take 15 to 30 min to complete. While the first sync is in progress you would see "pending" under status. Once the sync is complete, the status would transition from "pending" to "synced" and you can view the number of active users, inactive users and groups discovered.
{% hint style="info" %}
Active users in Azure are the users who actively log in to Azure and perform various tasks.
Inactive users are dormant users who have not logged in to their Azure account for a while. You can refer to this [Microsoft document](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-manage-inactive-user-accounts) to learn more about managing inactive users.
{% endhint %}
Nightfall syncs with your Identity and Access Provider every four hours. Also, you can manually sync once every hour. To sync data manually, click the ellipsis menu and select **Refresh.**
Currently, once registered you cannot unregister an Identity and Access Provider from Nightfall. If you do wish to unregister your Identity and Access Provider, please contact Nightfall support.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://help.nightfall.ai/nightfall_settings/directory_sync/microsoft_entra_id.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
