Ellipse Gradient for Header
Microsoft Entra ID logo

Microsoft Entra ID Integration Guide

Integrate Microsoft Entra ID with enterprise systems through Microsoft Graph REST APIs, OAuth 2.0, selective change notifications, and scheduled synchronization workflows.

Microsoft Entra ID integration options at a glance

Microsoft Entra ID integrations are primarily implemented through Microsoft Graph REST APIs, which expose users, groups, applications, service principals, devices, directory roles, audit logs, and related resources. OAuth 2.0 supports delegated and application permissions, including client credentials for unattended workflows. Microsoft Graph also provides selective change notifications, resource-specific delta queries, JSON batching, and file or attachment APIs for related Microsoft 365 workloads. Martini can consume Graph endpoints, receive supported notifications through an exposed API, schedule reconciliation workflows, persist synchronization state, map Graph JSON, and apply validation, authorization, throttling, and retry rules.

Integration pointSupported by Microsoft Entra ID?Common use casesHow Martini supports it
Microsoft Graph REST APIsYesMicrosoft Graph is the primary API surface for users, groups, applications, service principals, devices, directory roles, audit logs, sign-in data, licenses, and authentication methods.Martini can consume REST endpoints from workflows, map Graph JSON responses, expose controlled APIs, and orchestrate downstream calls.
OAuth 2.0 authenticationYesAuthorization code supports delegated access, while client credentials supports daemon, scheduled, and service-to-service integrations. Delegated scopes and application roles control access.Martini can use configured REST authentication and secure environment settings for tokens, client credentials, secrets, or certificates as appropriate.
Webhooks and change notificationsLimitedMicrosoft Graph subscriptions provide notifications for selected resources and change types, with resource-specific expiration, validation, and lifecycle behavior.Martini can expose an API endpoint to receive notifications, validate requests, retrieve the current resource, deduplicate messages, and renew subscriptions through scheduled workflows.
Delta queriesLimitedSelected Graph resources provide delta links for incremental synchronization, including additions, updates, and removals according to resource-specific behavior.Martini can persist delta links, retrieve subsequent pages, process deletions, and fall back to a full synchronization when a link expires or is invalid.
JSON batching and asynchronous operationsYesGraph JSON batching reduces network round trips, while selected endpoints support asynchronous processing. Individual responses in a batch can succeed or fail independently.Martini can submit batch requests, inspect each embedded response, retry eligible failures, and coordinate asynchronous completion where the endpoint supports it.
File and attachment APIsLimitedGraph supports files and attachments for selected Microsoft 365 workloads such as OneDrive, SharePoint, Outlook, and related resources; these are not general Entra ID object attachments.Martini can call the relevant Graph file or attachment endpoints and route content through workflows when the related Microsoft 365 resource is in scope.
Audit and sign-in resourcesYesGraph exposes audit and sign-in resources for security monitoring, compliance workflows, operational reporting, and incident enrichment.Martini can page through time-bounded results, normalize events, persist checkpoints, and send them to security, operations, compliance, or reporting systems.
SDKsYesMicrosoft provides Graph SDKs for several languages, although the underlying HTTP API remains the main standards-based integration surface.Martini can consume the HTTP APIs directly and use custom JVM-compatible logic when specialized request construction or SDK-specific behavior is required.

How Microsoft Entra ID exposes data and business events

Microsoft Graph REST APIs

Microsoft Graph REST APIs are the primary integration mechanism for Microsoft Entra ID. They expose users, groups, applications, service principals, devices, directory roles, audit logs, sign-in data, and other Microsoft 365 resources. Endpoint behavior, permissions, OData support, pagination, and incremental synchronization capabilities vary by resource.

Martini implementation pattern

Martini implementation pattern: a workflow obtains an OAuth 2.0 access token, calls the required Graph endpoint, follows @odata.nextLink values, maps the JSON response into a canonical model, applies business rules, and writes the result to the target system. Reusable Martini workflows can isolate resource-specific permissions and API behavior.

Implementation sequence

Obtain an OAuth 2.0 access token with the required Graph permissions
Call the Microsoft Graph resource endpoint
Follow @odata.nextLink until the collection is complete
Map Graph JSON to the canonical and target models
Apply validation, authorization, and idempotency rules
Write the result and persist synchronization status

Microsoft Graph change notifications

Microsoft Graph supports subscriptions for selected resources and change types. Notifications are selective rather than a universal Entra ID event stream, and subscriptions have resource-specific expiration, validation, and lifecycle requirements.

Martini implementation pattern

Martini implementation pattern: expose a Martini API endpoint as the notification URL, handle Graph validation requests, record the notification, retrieve the current resource from Graph, and process the state change asynchronously. A scheduler renews subscriptions and reconciles resources that do not support the required notification.

Implementation sequence

Register or renew the Microsoft Graph subscription
Receive and validate the change notification
Record the subscription and notification identifiers
Retrieve the current resource state from Graph
Map and process the current object in a workflow
Deduplicate the notification and persist the processing result

Delta queries

Selected Microsoft Graph resources support delta queries that return changes since a prior synchronization state and provide a delta link for subsequent requests. Support and deletion behavior are resource-specific.

Martini implementation pattern

Martini implementation pattern: store the returned delta link in durable state, invoke it on the next scheduled run, process additions, updates, and removals, and replace the stored link only after successful processing. If Graph rejects or expires the link, Martini can initiate a controlled full synchronization.

Implementation sequence

Read the stored delta link for the resource
Request the next delta page from Microsoft Graph
Process additions, updates, and removals
Follow continuation links until a delta link is returned
Commit the new delta link after successful processing
Start a full resynchronization when the delta link is invalid

JSON batching

Microsoft Graph supports JSON batching to submit multiple HTTP requests in one request. Batching reduces network round trips but does not eliminate throttling, permission requirements, or individual operation failures.

Martini implementation pattern

Martini implementation pattern: construct a batch from eligible independent operations, submit it through the Graph REST API, inspect each embedded response, and retry only transient or otherwise eligible failures. The workflow records per-operation status rather than treating an HTTP-successful batch envelope as universal success.

Implementation sequence

Partition independent Graph operations into eligible batches
Submit the JSON batch request
Inspect every response within the batch
Map successful operations to their target outcomes
Queue eligible failures for controlled retry
Record permanent failures with correlation details

Common Microsoft Entra ID integration patterns

Pattern 1: Synchronize workforce users

When to use this pattern

Use this pattern when Workday or another workforce system owns employee lifecycle data and Microsoft Entra ID must create, update, disable, or reconcile User objects. It supports joiner, mover, and leaver processes while keeping stable identifiers and ownership rules explicit.

Integration direction
Workday
Martini
Microsoft Entra ID
Example Mapping
Microsoft Entra ID FieldCanonical FieldTarget Field
workerIdexternalEmployeeIdemployeeId
workerStatuslifecycleStatusaccountEnabled
primaryEmailbusinessEmailmail
displayNamedisplayNamedisplayName
Martini implementation pattern

A scheduled or source-triggered Martini workflow consumes employee changes, validates required attributes, resolves the existing Graph User by a stable identifier, and performs an idempotent create or update. Leaver rules can disable rather than delete accounts, while failed Graph calls are retried according to status and recorded for reconciliation.

Martini capabilities used
  • workflows
  • API consumption
  • OAuth 2.0 configuration
  • data mapping
  • business rules
  • error handling
  • scheduled execution

Pattern 2: Govern group membership and application access

When to use this pattern

Use this pattern when approved access requests or workforce attributes must drive Microsoft Entra ID Group membership or application-access decisions. It is suited to ServiceNow approvals, periodic entitlement reviews, and controlled provisioning.

Integration direction
ServiceNow
Martini
Microsoft Entra ID
Example Mapping
Microsoft Entra ID FieldCanonical FieldTarget Field
request.numberaccessRequestIdexternalReference
requestedGroupIdtargetGroupIdgroup.id
requestedUserIdsubjectUserIdmembers.$ref
approval.stateauthorizationDecisionoperation
Martini implementation pattern

Martini receives an approved request, verifies the requester, subject, target group, and requested operation, then calls the appropriate Graph membership or assignment API. It records the request and Graph identifiers, prevents duplicate changes, and routes privileged or partial failures for review.

Martini capabilities used
  • API exposure
  • workflows
  • data mapping
  • business rules
  • validation
  • audit logging
  • error handling

Pattern 3: Process identity change notifications

When to use this pattern

Use this pattern when the required Microsoft Graph resource supports change notifications and downstream systems need near-real-time updates. It should be paired with scheduled reconciliation because webhook coverage is not universal across Entra ID resources.

Integration direction
Microsoft Entra ID
Martini
ServiceNow
Example Mapping
Microsoft Entra ID FieldCanonical FieldTarget Field
subscriptionIdeventSubscriptionIdsourceSubscription
resourcechangedResourceobjectReference
changeTypechangeOperationeventType
resourceData.idgraphObjectIdconfigurationItem.externalId
Martini implementation pattern

A Martini API receives and validates the Graph notification, stores a deduplication key, retrieves the current object, and maps it to the downstream event or record. The workflow acknowledges quickly, processes asynchronously where appropriate, renews subscriptions before expiry, and uses scheduled reconciliation for missed or unsupported events.

Martini capabilities used
  • API exposure
  • webhook consumption
  • workflows
  • data retrieval
  • data mapping
  • deduplication
  • scheduling
  • retry handling

Pattern 4: Send audit and sign-in data to security operations

When to use this pattern

Use this pattern when audit logs and sign-in records must be normalized for a SIEM, incident platform, compliance store, or reporting database. It uses bounded time windows and durable checkpoints rather than assuming unlimited retention or a complete event stream.

Integration direction
Microsoft Entra ID
Martini
ServiceNow
Example Mapping
Microsoft Entra ID FieldCanonical FieldTarget Field
ideventIdcorrelationId
activityDateTimeeventTimestampopenedAt
activityDisplayNameeventNameshortDescription
initiatedByactorcaller
Martini implementation pattern

A scheduled Martini workflow reads the relevant Graph audit or sign-in resource using a checkpoint and bounded window, follows pagination, normalizes event details, and sends them to the target. It deduplicates by Graph event ID, handles throttling, and advances the checkpoint only after successful delivery.

Martini capabilities used
  • scheduled workflows
  • API consumption
  • pagination
  • data mapping
  • checkpoint management
  • deduplication
  • throttling and retry handling

Applications commonly integrated with Microsoft Entra ID

Microsoft Entra ID commonly participates in workforce identity, access governance, collaboration, cloud-resource, and security operations architectures. Martini can coordinate these systems through Microsoft Graph and the adjacent application's APIs, while keeping ownership, permissions, and synchronization state explicit.

Application Scenario Direction Martini Pattern
Microsoft 365 Synchronize users, groups, licenses, collaboration access, and Microsoft 365 service identities. Microsoft Entra ID → Martini → Microsoft 365 Martini consumes Microsoft Graph resources, maps identity and group attributes to Microsoft 365-related workflows, applies ownership and duplicate checks, and records synchronization outcomes for reconciliation.
Azure Coordinate Entra ID identities, groups, service principals, managed identities, and role-assignment context for Azure resource access. Microsoft Entra ID → Martini → Azure A Martini workflow reads or updates authorized Graph identity objects, validates requested access changes, and orchestrates the related Azure API calls with auditable approval and retry handling.
Salesforce Support user provisioning, deprovisioning, group-based access governance, and enterprise identity administration. Microsoft Entra ID → Martini → Salesforce Martini retrieves Graph User and Group data, maps stable identifiers and lifecycle status to Salesforce user operations, and uses reconciliation workflows to detect drift.
ServiceNow Automate access requests, approvals, identity lifecycle tasks, and incident creation for identity-related events. ServiceNow → Martini → Microsoft Entra ID Martini receives approved ServiceNow requests, validates the requested scope, calls Microsoft Graph with narrowly scoped permissions, and returns status or creates follow-up incidents for failures.
Workday Use employee lifecycle data to create, update, disable, and reconcile Microsoft Entra ID users and organizational attributes. Workday → Martini → Microsoft Entra ID Martini consumes Workday changes or scheduled extracts, maps employee identifiers and lifecycle status to Graph User properties, and performs idempotent create, update, or disable operations.
Okta Coordinate identity records, groups, and application access in environments operating both identity platforms. Microsoft Entra ID → Martini → Okta Martini compares ownership-controlled identity and group attributes between APIs, suppresses synchronization loops, and writes only approved differences with durable correlation keys.
Slack Provision or deprovision workforce access and align collaboration access with identity status and group membership. Microsoft Entra ID → Martini → Slack A Martini workflow consumes Graph User or Group changes, applies lifecycle and membership rules, calls Slack's configured APIs, and records provisioning feedback for reconciliation.
GitHub Enterprise Govern developer access, teams, and enterprise membership using workforce identity and group data. Microsoft Entra ID → Martini → GitHub Enterprise Martini maps approved Graph group membership to GitHub Enterprise organization or team operations, validates stable identifiers, and handles partial failures through retryable work items.

How to build a Microsoft Entra ID integration in Martini

Objective

Create the Graph application registration and configure the tenant-specific authority, Graph permissions, and OAuth 2.0 flow required by the integration.

Instructions in Martini

  • Use client credentials for unattended service-to-service workflows or authorization code for delegated access
  • Store client secrets or certificates in secure Martini environment configuration
  • Record administrator consent and separate read-only permissions from administrative write permissions
  • Configure the appropriate Microsoft Graph cloud endpoint for the tenant environment

Objective

Select the trigger that matches the resource and latency requirement while accounting for Microsoft Graph's resource-specific event coverage.

Instructions in Martini

  • Use a Martini API endpoint for supported Graph change notifications
  • Use a scheduler for delta queries, reconciliation, audit extraction, or subscription renewal
  • Confirm that the selected resource and change type support Graph subscriptions or delta queries
  • Persist subscription, expiration, and checkpoint state

Objective

Call Microsoft Graph and retrieve complete resource data rather than relying on a single response or notification payload.

Instructions in Martini

  • Call the v1.0 endpoint when the required operation is available there
  • Follow @odata.nextLink values for paged collections
  • Retrieve the current resource after a change notification
  • Inspect every individual response in a JSON batch

Objective

Convert Graph JSON into a canonical model and target-specific payload while validating identifiers, lifecycle values, and permissions.

Instructions in Martini

  • Map stable Graph object IDs and external identifiers
  • Use JSON handling and reusable mappings for User, Group, Application, and related objects
  • Validate required fields before write operations
  • Avoid using display names or email addresses as the only unique key

Objective

Enforce ownership, approval, least-privilege, idempotency, and synchronization-loop rules before changing identity or access state.

Instructions in Martini

  • Separate read, provisioning, membership, role, and application-management operations
  • Require approval for privileged role or permission changes
  • Compare current and desired state before submitting updates
  • Prevent repeated processing of duplicate notifications or previously completed requests

Objective

Deliver results to downstream systems, retain synchronization state, and make failures observable and recoverable.

Instructions in Martini

  • Write mapped data to the target application, database, or security platform
  • Persist delta links, checkpoints, subscription IDs, expiration times, and correlation identifiers
  • Honor Retry-After for HTTP 429 responses and apply controlled backoff
  • Log partial batch failures and route permanent errors for operational review

Common Microsoft Entra ID data objects used in integrations

ObjectTypical UseCommon target systemsMartini handling
UserProvision, update, disable, reconcile, or enrich workforce identities and profile attributes.Workday, Salesforce, ServiceNow, Slack, GitHub Enterprise, Microsoft 365Martini maps stable Graph IDs, principal names, lifecycle status, and selected attributes; it applies validation, idempotency, pagination, and permission rules.
GroupSynchronize security groups, Microsoft 365 groups, membership, ownership, and access-governance state.ServiceNow, Salesforce, Slack, GitHub Enterprise, Microsoft 365Martini retrieves group pages or supported delta results, compares membership against the target, applies business rules, and records membership changes.
ApplicationRead or manage application registrations, redirect URIs, credentials, permissions, and application settings where authorized.ServiceNow, Azure, security data stores, compliance platformsMartini isolates privileged operations, validates requested changes, uses narrowly scoped permissions, and audits each result.
Service principalRepresent tenant-local application identities, managed identities, assignments, and access context.Azure, ServiceNow, security platforms, compliance data storesMartini correlates application and service-principal IDs, validates assignment changes, and prevents duplicate or unauthorized updates.
DeviceSynchronize registered or joined device information and related ownership or compliance references available through Graph.ServiceNow, security platforms, reporting databases, AzureMartini retrieves supported device properties, normalizes them, applies checkpointed synchronization, and routes exceptions for review.
Directory roleGovern tenant directory roles and role assignments used for administrative authorization.ServiceNow, compliance platforms, security data storesMartini treats role changes as privileged operations, requiring approval, narrow permissions, validation, audit logging, and controlled retries.

Authentication and security considerations

OAuth 2.0 and permissions

Microsoft Graph uses OAuth 2.0 bearer access tokens. Authorization code supports delegated access on behalf of a user, while client credentials supports unattended service-to-service workflows. Delegated scopes and application roles determine what the integration can do.

Least privilege

Use the narrowest Graph permissions for the required resources and operations. Separate read-only synchronization from user, group, application, role-assignment, and audit-log administration. Many privileged permissions require tenant administrator consent.

Credential protection

Store client secrets and certificates in Martini secure environment configuration rather than workflows, mappings, or source-controlled files. Tenant authorities, cloud endpoints, and consent configuration should be environment-specific.

Operational considerations for Microsoft Entra ID integrations

Pagination and throttling

Graph collections commonly return an @odata.nextLink. Martini workflows should follow continuation links and handle HTTP 429 responses by respecting Retry-After, reducing concurrency, and applying backoff.

Incremental synchronization

Delta queries are resource-specific. Persist delta links only after successful processing, handle deletions and invalid links, and provide a full synchronization fallback.

Notifications and renewal

Change notifications are selective rather than a universal Entra ID event stream. Validate notification requests, deduplicate deliveries, retrieve current resource state, and renew subscriptions before expiration.

Idempotency and change control

Use Graph object IDs, application IDs, service principal IDs, and external identifiers instead of display names alone. Prefer Microsoft Graph v1.0 where available and isolate beta behavior behind reusable workflows.

Testing and observability

Test permissions, pagination, partial batch responses, throttling, expired delta links, duplicate notifications, and tenant-specific cloud behavior. Monitor checkpoints, subscription expiry, retries, and permanent failures.

Why use Martini instead of scripts or point-to-point integrations?

Orchestrate more than an API call

Point-to-point scripts often combine authentication, pagination, mapping, retries, state management, and business rules in code that is difficult to reuse. Martini organizes these concerns in workflows and APIs that can be maintained as reusable integration assets.

Handle selective event coverage

Microsoft Graph change notifications do not cover every Entra ID object or operation. Martini can combine supported notifications with scheduled delta queries, reconciliation, and audit extraction in a coordinated design.

Control privileged operations

Martini can separate read, provisioning, membership, role, and application-management workflows, apply validation and approval rules, and retain correlation and processing state for operational review.

Support reliable delivery

Reusable mappings, checkpoints, idempotency rules, pagination, throttling controls, retries, and monitoring provide a more maintainable foundation than isolated scripts or tightly coupled point-to-point flows.

Frequently asked questions

How can Microsoft Entra ID be integrated with enterprise systems?

Microsoft Entra ID is primarily integrated through Microsoft Graph REST APIs using OAuth 2.0. Enterprise workflows can read and manage users, groups, applications, service principals, devices, directory roles, audit logs, and sign-in data. Selected resources also support change notifications, delta queries, and JSON batching.

Can Martini integrate with Microsoft Entra ID?

Yes. Martini can consume Microsoft Graph REST APIs, authenticate using the required OAuth 2.0 pattern, expose an API endpoint for supported Microsoft Graph change notifications, schedule reconciliation workflows, and map Entra ID data to downstream applications. A dedicated Martini connector is not required or confirmed.

Do I need a connector to integrate Microsoft Entra ID with Martini?

No. A dedicated Microsoft Entra ID connector is not required. Martini can use Microsoft Graph's native REST APIs, OAuth 2.0 authentication, selected change notifications, delta queries, JSON batching, and related endpoints through workflows and APIs.

Is there any extra Lonti cost to integrate Microsoft Entra ID with Martini?

Lonti does not charge an additional per-connector or per-vendor fee to integrate Microsoft Entra ID with Martini. Integrations are subject to the provisioned capacity of the Martini environment. Separate costs may apply from Microsoft, cloud infrastructure, or other third-party systems based on subscription, usage, and deployment model.

Which Microsoft Entra ID integration methods should be used?

Microsoft Graph REST APIs are the primary method. Use application permissions and client credentials for unattended synchronization, delegated permissions when acting on behalf of a user, change notifications for supported resources, delta queries where available, and scheduled reconciliation when event or delta coverage is insufficient. GraphQL is not confirmed and SOAP is not supported as a modern Entra ID integration method.

Can Martini receive Microsoft Entra ID events through webhooks?

Martini can receive Microsoft Graph change notifications through an exposed API endpoint, but coverage is limited to selected resources and change types. Subscriptions require validation and renewal, and a scheduled polling or delta-query fallback may be needed for unsupported or missed changes.

How does synchronization and data mapping work?

Martini retrieves Graph JSON, follows pagination or delta links where supported, maps actual objects such as User, Group, Application, and Service principal into canonical and target models, and applies validation and business rules. Durable checkpoints, stable Graph IDs, deduplication, and reconciliation workflows support reliable synchronization.

How are Microsoft Graph errors, throttling, and duplicates handled?

Martini workflows can inspect HTTP status codes, honor Retry-After for HTTP 429 responses, apply controlled backoff, limit concurrency, and retry eligible transient failures. Stable Graph object or event IDs support idempotency, while batch workflows inspect each embedded response independently. Permanent failures can be logged and routed for operational review.

Related Martini documentation

Microsoft Graph

Events

Workflows

Security

Operations

Integrate Microsoft Entra ID with Martini

Use Microsoft Graph, OAuth 2.0, workflows, and APIs to build reliable Microsoft Entra ID integrations with the synchronization, security, and operational controls your enterprise requires.

EXPLORE MARTINI
BOOK A DEMO