MS Graph
The MS Graph connector enables data synchronization between Entra ID and RAC/M Identity. To do this, the connector uses the MS Graph API.
Note
This connector exposes many objects available in the Microsoft Graph API. The MS Graph API is constantly evolving and not all objects are exposed, if you need access to an object or functionality in the MS Graph API, please contact OKIOK via your Jira support portal to describe your needs and which part of the MS Graph API you need access to.
Configuration
The following parameters are required:
| Configuration | Description |
|---|---|
| Application ID | The application ID displayed through the Entra ID portal in the registered application panel. |
| Directory (tenant) ID | Azure AD / Microsoft Entra Directory (tenant) ID. Displayed through the Azure portal in the registered application panel. Used to build the default OAUTH 2.0 Token Endpoint. |
| Application Secret Key | The secret key generated for your application. This key can be generated through the Entra ID portal in the Keys panel. |
Advanced Configuration
| Configuration | Description |
|---|---|
| MS Graph API Endpoint | The MS Graph API Endpoint. If none specified, defaults to https://graph.microsoft.com |
| MS Graph API Version | The MS Graph API Version. If none specified, defaults to 1.0 |
| Access Token Endpoint | The OAUTH 2.0 Token Endpoint. If none specified, defaults to https://login.microsoftonline.com/{tenantId}/oauth2/token |
| User Filter | User Request Filter. Will be used in the $filter attribute. Refer to the MS GraphAPI documentation for proper usage. |
| Group Filter | Group Request Filter. Will be used in the $filter attribute. Refer to the MS GraphAPI documentation for proper usage. |
| Connection Timeout in seconds | Connection Timeout in seconds. Will be used as the Connection, Read, and Write timeout. |
| Photo Save Folder | Folder where the photos of the users will be saved. Each user photo data will be in a file named with the user ID. |
| Result Page Size | Result page size in items when executing a GET request. If none specified, defaults to 999 |
| Included Members Types | A comma-separated list of the types to include. Example: #microsoft.graph.orgContact,#microsoft.graph.user |
| Excluded Members Types | A comma-separated list of the types to exclude. Example: #microsoft.graph.device,#microsoft.graph.servicePrincipal |
| Included Owners Types | A comma-separated list of the types to include. Example: #microsoft.graph.orgContact,#microsoft.graph.user |
| Excluded Owners Types | A comma-separated list of the types to exclude. Example: #microsoft.graph.device,#microsoft.graph.servicePrincipal |
| Included User Sponsors Types | A comma-separated list of the types to include. Example: #microsoft.graph.orgContact,#microsoft.graph.user |
| Excluded User Sponsors Types | A comma-separated list of the types to exclude. Example: #microsoft.graph.device,#microsoft.graph.servicePrincipal |
Supported object classes
| ObjectClass | Description | Supported operations |
|---|---|---|
| __ACCOUNT__ | Entra ID user account. API | Search Creation Update Delete |
| __GROUP__ | Entra ID group. API | Search |
| License | Entra ID commercial subscriptions that an organization has acquired. API | Search Update |
| License Plan (Service plan) | Contains information about a service plan associated with a subscribed SKU. The servicePlans property of the subscribedSku entity is a collection of servicePlanInfo. API | Search |
| License Assignment | Represents licenses (and plans) assigned to a user API | Search Update |
| joinedTeams | Represents the teams in Microsoft Teams that a user is a direct member of. API | Search |
| members | Allows efficiently listing and updating members of Entra ID groups API | Search Update |
| owners | Represents the owner user(s) of a group. API | Search |
| userSponsors | Represents the user(s) and group(s) that are responsible the guest ore of an account. API | Search |
| manageDevices | Represents properties and relationship of the managedDevices. API | Search |
| servicePrincipals | Represents an instance of an application in an Entra ID tenant (enterprise application). API | Search |
📌 Reading & Writing
- User Accounts (User Management)
| Action | Microsoft Graph API Permission |
|---|---|
| Modify a user attribute (first name, last name, title, department, etc.) | User.ReadWrite.All |
| Revoke user session (not shown in the image but typically required) | Directory.AccessAsUser.All |
- Groups and Group Membership
| Action | Microsoft Graph API Permission |
|---|---|
| Read all groups | Group.Read.All |
| Read and write all groups | Group.ReadWrite.All |
| Read all group memberships | GroupMember.Read.All |
| Add a user to a group | GroupMember.ReadWrite.All |
| Remove a user from a group | GroupMember.ReadWrite.All |
| Read and write group memberships (Delegated) | GroupMember.ReadWrite.All |
- Microsoft Applications (Assignment, Roles, etc.)
| Action | Microsoft Graph API Permission |
|---|---|
| Read all applications | Application.Read.All |
| Assign an application to a user | AppRoleAssignment.ReadWrite.All |
| Remove an application assignment from a user | AppRoleAssignment.ReadWrite.All |
| Manage app permission grants and app role assignments | AppRoleAssignment.ReadWrite.All |
| Read API connectors for authentication flows | APIConnectors.Read.All |
- Directory and Organization Data
| Action | Microsoft Graph API Permission |
|---|---|
| Read directory data | Directory.Read.All |
| Read domains | Domain.Read.All |
| Read all audit log data | AuditLog.Read.All |
- Mailbox Management
| Action | Microsoft Graph API Permission |
|---|---|
| Add auto reply | MailboxSettings.ReadWrite |
| Remove auto reply | MailboxSettings.ReadWrite |
| Send mail as any user | Mail.Send |
- Licenses
| Action | Microsoft Graph API Permission |
|---|---|
| Manage all license assignments | LicenseAssignment.ReadWrite.All |
Out of Office Email
https://learn.microsoft.com/en-us/graph/api/resources/automaticrepliessetting?view=graph-rest-1.0
