Connect Microsoft Entra ID

Connecting Microsoft Entra ID lets signplume read your Microsoft 365 directory, so joiners, title changes and leavers reach everyone's signature without anyone uploading a CSV. It takes about five minutes in the Microsoft Entra admin center. Granting the permissions needs a Global Administrator or a Privileged Role Administrator.

signplume reads the names, job titles, departments, phone numbers, email addresses and profile photos of the people in your directory, whether each account is enabled, and, if you allow it, your groups. It writes nothing to your directory.

The permissions signplume asks for

Both are Microsoft Graph application permissions, granted to an app registration in your own tenant:

• User.Read.All, required: reads the people in your directory and their photos.
• Group.Read.All, optional: reads your groups and who is in them, for group templates on Rules and group audiences on Campaigns. Without it, groups are skipped.

signplume asks Microsoft for a token with the scope https://graph.microsoft.com/.default, which means "the application permissions this app has been granted". What it can read is therefore set entirely by what you grant below, and nothing more.

1. Register the app

1. In the Microsoft Entra admin center, open App registrations and choose New registration.
2. Name it, for example signplume. Leave Supported account types on Accounts in this organizational directory only, leave the redirect URI empty, and choose Register.
3. On the app's Overview, note the Directory (tenant) ID and the Application (client) ID.

2. Grant the permissions

1. Open API permissions → Add a permission → Microsoft Graph → Application permissions.
2. Find and tick User.Read.All. To sync groups, tick Group.Read.All as well. Choose Add permissions.
3. Choose Grant admin consent for your organisation and confirm. The status should read Granted: an application permission does nothing until an administrator consents to it.

Every new registration starts with the delegated permission User.Read. signplume does not use it; you can leave it or remove it.

3. Create a client secret

1. Open Certificates & secrets → Client secrets → New client secret, give it a description and an expiry, and choose Add.
2. Copy the secret's Value straight away, not its Secret ID. Entra shows the value only once.

A client secret expires on the date you chose. When it does, the sync fails until you create a new secret and paste it under Replace credentials on Entra ID sync, so note the date.

4. Paste it on Entra ID sync

Open Entra ID sync in signplume (/admin/entra-sync) and fill in:

• Directory (tenant) ID: from the app's Overview. Your verified domain, such as contoso.onmicrosoft.com, works too.
• Application (client) ID: from the same Overview.
• Client secret value: the value you copied.

Press Connect Microsoft Entra ID. The secret is stored encrypted and never shown again. Press Sync now for the first run; after that the sync runs on its own about every six hours.

If the sync fails

Entra ID sync shows the last error in Microsoft's own words. The usual causes:

• AADSTS7000215 (invalid client secret): the Secret ID was pasted instead of the value, or the secret has expired.
• Authorization_RequestDenied (insufficient privileges): admin consent has not been granted for User.Read.All.
• AADSTS700016 (application not found): the tenant ID or the application ID is wrong.

Replacing the secret

Open Replace credentials on Entra ID sync. Saving always replaces the stored secret; there is no way to change the other fields and keep it. To stop syncing without removing anything, press Pause syncing instead.