Integrate CapaOne with Entra ID

Connect CapaOne to Microsoft Entra ID to sync your directory users to Management → Users. You register an application in Entra ID, give it read permissions for users and groups, and then create an Entra ID integration in CapaOne with the application’s details. The same integration can also be used to upload Company Apps to Intune. See Set Up Intune Permissions for CustomApps Upload.

Before you start

You need an Entra ID account that can register applications and grant admin consent for Microsoft Graph application permissions, for example a Global Administrator.

Register an application in Entra ID

1. Navigate to https://portal.azure.com/#home

2. Click Microsoft Entra ID

3. Click App registrations

4. Click New registration

5. Provide a name, select Accounts in this organizational directory only under Supported account types, and click Register at the bottom of the page

6. Click on Add a certificate or secret

7. Click on New client secret

8. Provide a description (not required) and set an expiration date. We suggest setting it to 24 months. Afterwards click Add at the bottom of the page

9. After the client secret is created you need to copy the value and save it in a notepad. If you refresh or leave the page you will have to create a new client secret

10. Click on API permissions in the sidebar and then Add a permission

11. Select Microsoft Graph

12. Select Application permissions

13. Scroll down and expand Group and set a checkmark in Group.Read.All and then Add permissions at the bottom of the page

14. Go through the same permission steps and set a checkmark in User for User.Read.All and Add permissions

15. Go through the same permission steps and set a checkmark in GroupMember for GroupMember.Read.All and Add permissions

16. Click on Grant admin consent for (name of directory)

17. Click Yes to the popup

18. Click on Home in the upper left corner

19. Click on Microsoft Entra ID

20. Click on App registrations in the left pane, and open the application you registered

21. Copy the Application (client) ID to your notepad

22. Click on Properties in the left pane

23. Copy the tenant ID to your notepad

Create the integration in CapaOne

24. In CapaOne, go to Management → Integrations

25. Click on New to create a new integration

26. Provide the following information for the new Entra ID integration

• Name – a name for the integration
• Application (client) ID – from step 21
• Directory (tenant) ID – from step 23
• Client secret value – from step 9
• Client secret expiration date – the expiration date you chose in step 8
• User Properties – optional. Select extra Entra ID user properties to sync, such as Department, Job Title, or Office Location. The user ID and email are always stored.

Then select a synchronization schedule: Never, Daily, Weekly, or Monthly. Unless you select Never, also select the time of day for the sync. For Weekly and Monthly, select the day as well. Click on Create.

27. If you click on the 3 dots to the right of the newly created integration you can do the following

• Edit
• Sync now
• View integration
• Delete

28. Click on Sync now

29. When the sync is done, go to Management → Users. The users from Entra ID have an Entra ID icon to the left of their name

Renew the client secret

The client secret expires on the date you set in Entra ID. When it expires, the integration can’t sync users and groups. Renew it before it expires:

1. In the Azure portal, create a new client secret for the app registration, as in steps 6–9.
2. In CapaOne, go to Management → Integrations.
3. Click the options menu (⋮) next to the integration and select Edit. The Integration configuration page opens.
4. Enter the new secret in Client secret. If you leave the field empty, the current secret is kept.
5. Update Client Secret Expiration Date to the new expiration date.
6. Click Save, and then select Sync now to confirm that the sync works.

The integration card on Management → Integrations shows the Secret expiration date. It turns yellow when the secret expires within a month and red when it has expired, so you can see when it’s time to renew. The card also shows the Last sync status. If a sync failed, click the status to open the synchronization log.