Connecting Microsoft Entra ID to KlaritiQ

If your company manages people in Microsoft Entra ID (the new name for Azure Active Directory), you can connect it to KlaritiQ so that people are added when they join, moved when their groups change, and removed when they leave. Nobody has to invite or remove anyone by hand, and a leaver cannot keep access to your KlaritiQ workspace by being forgotten.

The protections stay in place. Entra can only add people as Light (read-only) or Member. It can never make anyone an admin or an owner, and it never removes your owner or your last admin.

Before you start

• You need to be an owner or admin of your KlaritiQ organization.
• You need permission to create an Enterprise application in the Microsoft Entra admin centre. Microsoft decides which Entra plans include automatic provisioning, so check yours in Microsoft's documentation.
• You need access to the DNS settings for your company email domain, for example example.com. This proves the domain is yours.
• People are matched by work email address.

Step 1: Open Integrations and find Microsoft Entra ID

Go to Integrations in the admin menu. Under Workspace connections find Microsoft Entra ID and choose Set up. The card has four steps, in order.

Step 2: Prove you own your email domain

Only people whose email address is at a verified domain can be added from Entra. This stops anyone from adding strangers to your workspace.

1. Type your domain, such as example.com, and choose Add.
2. KlaritiQ shows a TXT record with a Name and a Value. The name starts with _klaritiq-verify and the value starts with klaritiq-verify=.
3. Add that record at your DNS provider.
4. Choose Verify. DNS changes can take a while to appear, so if it is not found yet, try again later.

A domain can be verified by one organization at a time. If you manage several email domains, add each one.

Step 3: Connect Entra

Once a domain is verified, choose Create token. KlaritiQ shows a Secret Token and a Tenant URL one time. Copy both now. The token is not shown again, and KlaritiQ keeps only a one-way hash of it.

Then, in the Microsoft Entra admin centre:

1. Open Enterprise applications, choose New application, then Create your own application.
2. Open Provisioning and set the mode to Automatic.
3. Paste the Tenant URL and the Secret Token, then choose Test connection.
4. Assign the group of people you want to add. Entra syncs about every 40 minutes.

Back in KlaritiQ the card shows Connected, with when it was last used and last synced.

Step 4: Decide who gets what

After Entra's first sync, your Entra groups appear on the card. For each group choose a role:

• Light (read-only) can look but not change anything.
• Member can do the work.
• No rule leaves the group out of the decision.

You can also choose a department, and whether the group sees the Whole organisation or its Own department only. Then choose Save.

A person in no mapped group joins as Light. A person in several mapped groups gets the highest role, so Member wins over Light. Changing a rule changes the people already provisioned from that group.

What happens when Entra adds someone

KlaritiQ does not create an account for them and does not send an email. The person has a pending invitation. The next time they sign in to KlaritiQ with a verified email address that matches, they see a banner that says your organization added them as Member or Light, and they choose Accept to join. Entra can never skip that step, and it can never confirm anyone's email address.

What happens when someone leaves

When Entra turns a person off, KlaritiQ removes them from your organization. Their KlaritiQ account is not deleted, only their membership, and what they wrote stays in your record.

• Their access to your workspace stops, in every row of their membership.
• They stop receiving overdue task, milestone and blocker alerts. If they were the owner of a regulatory clock, the alert goes to your admins instead, so a missed deadline still reaches a person who is still here.
• They stop counting in the Capacity page's headcount and skills.
• If Entra tries to remove your owner, a co-owner or your last active admin, KlaritiQ refuses, records it, and alerts your admins.
• If an admin removed someone by hand, Entra turning them back on does not bring them back.

If a person who left still owns work, the card's fourth step shows People who left but still own work, with the counts, so you can reassign it before anything is left without an owner.

What you can see

The fourth step shows how many people were added, how many are waiting to accept, how many are active and how many were removed, and a log of what Entra did, newest first. Each line says whether it was applied, skipped or rejected. A person whose email is not at a verified domain is rejected, and the log says so.

What KlaritiQ stores

Only what the job needs: the person's Entra ID, work email, display name, whether they are active, their department, and which groups they belong to. Everything else Entra sends is dropped when it arrives.

Replacing the token, or disconnecting

• Replace token creates a new token and stops the old one at once. Paste the new one into Entra straight away, or syncing stops.
• Disconnect stops Entra from adding or removing anyone. Nobody who is already in your workspace is removed. You can connect again later with a new token.
• Removing a domain stops Entra from adding people at that domain. Again, nobody already here is removed.

If something looks wrong

• Test connection fails in Entra: check that you pasted the Tenant URL exactly, that the token is the newest one and that Connected shows in KlaritiQ.
• A person is rejected: their email is not at a verified domain. Verify the domain in step 1.
• No groups appear: groups appear after Entra's first sync, once a group is assigned to the application in Entra.
• Someone added is not in your workspace yet: they have to accept the invitation after signing in.

This version covers provisioning only. Signing in to KlaritiQ with Entra is not part of it. For what every connection can access and how credentials are protected, see How KlaritiQ Integrations Work.

Was this article helpful?

Community Questions (0)

Still have questions?