Microsoft Entra ID Directory Manager

Introduction

Microsoft Entra ID Directory Manager plugin is a directory manager plugin with sync and live query modes via Microsoft Graph API, with optional support for extending the Security Enhanced Directory Manager.

Plugin Info

Plugins available in the bundle:

1. Microsoft Entra ID Directory Manager
2. Microsoft Entra ID Sync Tool
3. Microsoft Entra ID User Security Web Service
4. Microsoft Entra ID — SAML 2.0 ACS Callback

This plugin bundle is compatible with Joget DX 9.

Expected Outcome

Get started

Where to get the plugin

You can download the plugin from Joget Marketplace.

How to install

1. Download the plugin JAR file from the Joget Marketplace.
2. Go to Settings > Manage Plugins > Upload Plugin.
3. Once uploaded, the plugin will be available in your Joget environment.

Prerequisites

Before using the plugin, you will need:

1. API Domain/IP Whitelist: To ensure the successful operation of this plugin, it is essential to whitelist the domains or IP addresses of the host. Typically, this involves adding the IP address or domain name of your Joget application server to the whitelist. 
   Go to Settings > General Settings and scroll to the API Domain/IP Whitelist section.
   
   
   • API Domain Whitelist  (Separated by ';'): Domain whitelist to allow API calls to Joget Workflow. Separated by semicolon.
     
     Example
     "localhost;www.joget.org”, or "*" to allow from everywhere.
     In a production environment, do not use "*".
     Doing so will allow anyone to call all JSON APIs from the Joget server.
   • API IP Whitelist (Separated by ';'): IP address whitelist to allow API calls to Joget. Separated by semicolon.
     
     Example
     "localhost; 192.168.101.10; www.joget.org ”, or "*" to allow from everywhere.
     In a production environment, do not use "*".
     Doing so will allow anyone to call all JSON APIs from the Joget server.
2. Licensed Users: Review the Licensed Users in the License section of Joget. If you surpass the allowed user limit, you won't be able to log in to Joget following the Single Sign-On (SSO) process.
   

Configure Microsoft Entra ID for OpenID Connect

Login Azure Portal

1. Sign in to the Azure portal. Under Azure Services, go to Microsoft Entra ID.
   

Create Test Users

1. Go to Users > All users >  "+ New user". Create some test users, or reuse existing users if available.

Create Groups and Assign Members

1. Go to Groups > All groups > "+ New group". Create some groups, and assign some users to the group.

Create an App Registration

1. In Azure Portal homepage, go to App registrations
   
2. Click on "+ New registration". Fill in the desired application name. Single tenant. Add the Redirect URI value which is retrieved from the plugin SSO Configuration field OIDC Redirect URI (for OpenID Connect).
3. Once you have created the application, you can note down the Directory (tenant) ID and Application (client) ID. You will need these values to configure Azure Connection. 
   

Configure API Permissions

1. Go to Manage > API permissions. Add these application permissions for Microsoft Graph:
   • Directory.Read.All: Read directory data
   • Group.Read.All: Read groups and members
   • GroupMember.Read.All: Read group memberships
   • User.Read.All: Read user profiles

• You must click "Grant admin consent". All four permissions should show a green checkmark
  

Create a Client Secret

1. Go to Manage > Certificates & secrets > "+ New client secret". Copy the value immediately, it is only shown once. You will need this value to configure Azure Connection.

Enable ROPC (Public Client Flow)

1. Go to Authentication (Preview) > Settings > "Allow public client flows" > Enabled > Save. Without this, users will not be able to login. Error AADSTS7000218 means ROPC is not enabled.
   

Configure Microsoft Entra ID for SAML

Refer to Knowledge Base > IdP-initiated SAML Directory Manager using Microsoft Entra ID.

Configure Microsoft Entra ID Directory Manager properties

Azure Connection

• Tenant ID*: The Azure AD / Microsoft Entra ID Directory (Tenant) ID. Found in Azure Portal > Microsoft Entra ID > Overview.
• Client ID (Application ID)*: The Application (Client) ID from the App Registration in Azure Portal.
• Client Secret*: The client secret value from App Registration > Certificates & secrets. Copy the Value (not the Secret ID).

Login & Access Control

• Plugin Mode*:
  • Standard Login (Live Mode): Users authenticate with Azure credentials, new users are auto-added to Joget on first login.
  • Sync Mode (Pre-synced Users Only): Users must be synced first (manually or auto-sync) before they can log in - provides full org chart, departments, and profile photos.
• Username Source*: Which Azure field to use as the Joget username and login ID.
  • Email Address (mail): uses the user's primary email address. 
  • User Principal Name (UPN): uses the userPrincipalName (typically user@domain.onmicrosoft.com). The chosen field is stored in both the 'username' and 'id' columns of the Joget dir_user table, while the other field is stored in 'email'.
• User Access Scope*: Controls which Azure AD users can access Joget.
  • All Azure AD Users: allows any user from your Azure tenant. 
  • Specific Azure AD Groups Only: restricts access to members of the groups you configure below. This applies to both standard login and SSO.

Available when User Access Scope is set to All Azure AD Users:

• Default Role for All Users*: Checkbox. Built-in Joget Role assigned to every user provisioned from Azure AD when 'All Azure AD Users' is selected. Default: ROLE_USER. Case-insensitive — both ROLE_ADMIN and role_admin will match the same role.
  • User
  • Admin
  • App Creator
  • System Manager
• Default Joget Group ID: When 'All Azure AD Users' is selected, all provisioned users are added to this Joget group. Leave blank if you don't need group assignment. The ID should be camelCase without special characters (e.g. azureUsers). If you leave the ID blank but fill in a Name, the ID is auto-generated from the name.
• Default Joget Group Name: Display name for the default Joget group above. If blank, the Group ID is used as the name.
• Default Joget Organization ID: When 'All Azure AD Users' is selected, all provisioned users are assigned to this Joget organization. Leave blank if you don't need organization assignment. The ID should be camelCase without special characters (e.g. acmeCorp). If you leave the ID blank but fill in a Name, the ID is auto-generated from the name.
• Default Joget Organization Name: Display name for the default Joget organization above. If blank, the Organization ID is used as the name.

Available when User Access Scope is set to Specific Azure AD Groups Only:

• Azure AD Group Mappings*: Map Azure AD groups to Joget roles and organizations. For each row:
  • (1) Azure AD Group Display Name = the EXACT display name of the group in Azure Portal — its Joget Group ID and Name are taken from Azure automatically (Group ID = Azure GUID; Group Name = Azure displayName).
  • (2) Joget Role ID = a built-in role identifier like ROLE_ADMIN, ROLE_USER. Case-insensitive.
  • (3) Joget Organization ID / Name = optional; users in this Azure group are assigned to this Joget org. If you provide only the Name, the ID is auto-generated as a camelCase version of the name.

Available when Plugin Mode is set to Live Mode:

• Enable User Data Refresh on Login: Checkbox. When enabled, the plugin will refresh the user's profile and group membership from Azure AD during standard login or SSO. 
• Refresh Interval (minutes)*: Minimum time (in minutes) between full user data refreshes from Azure. While this interval has not elapsed, the user can still log in but their profile data is not re-fetched. Default: 15 minutes. Set higher (e.g. 60, 1440) for fewer Graph API calls or lower (e.g. 5) for more up-to-date data. Available when Enable User Data Refresh on Login is set to checked:

SSO Configuration

• OIDC Redirect URI (for OpenID Connect): Auto-generated. Copy this URL and register it as a Redirect URI in Azure Portal > App Registration > Authentication > Web platform > Redirect URIs. Required only if you selected OpenID Connect as the SSO Protocol. Value: http://domain/jw/web/json/plugin/org.joget.marketplace.EntraIdDirectoryManager/service
• SP Entity ID / Identifier (for SAML 2.0): Auto-generated. Use this as the Identifier (Entity ID) in Azure Portal > Enterprise Application > Single sign-on > Basic SAML Configuration. Required only if you selected SAML 2.0 (IdP-Initiated) as the SSO Protocol. Value: http://domain/jw/web/json/plugin/org.joget.marketplace.EntraIdSamlCallback/service
• SAML Reply URL / ACS URL (for SAML 2.0): Auto-generated. Use this as the Reply URL (Assertion Consumer Service URL) in Azure Portal > Enterprise Application > Single sign-on > Basic SAML Configuration. This URL uses a clean path (no query parameter) matching the convention used by Joget's official SAML plugin — if you are migrating from Selva's plugin or Joget's official SAML plugin, simply replace the existing Reply URL with this one. Required only if you selected SAML 2.0 (IdP-Initiated) as the SSO Protocol. Value: http://domain/jw/web/json/plugin/org.joget.marketplace.EntraIdSamlCallback/service
• Enable Single Sign-On (SSO): Checkbox. Enable browser-based SSO login. A 'Login with Microsoft' button will appear on the Joget login page (for OIDC). SSO works with both Live and Sync modes, and supports MFA-enabled users (unlike standard username/password login which uses ROPC).

Available when Enable Single Sign-On is set to checked:

• SSO Types*:
  • OpenID Connect (Recommended): Browser-based OAuth 2.0 authorization code flow. Supports MFA. User clicks 'Login with Microsoft' on Joget login page, authenticates at Microsoft, and is redirected back. 
  • SAML 2.0 (IdP-Initiated): User starts from Azure MyApps portal and is redirected to Joget with a SAML assertion. Requires SAML Enterprise Application setup in Azure.

Available when SSO Types is set to OpenID Connect:

• Login Button Text: Login button styling text
  Sample Value
  Login
• Login Button Icon (CSS class): Login button styling icon class
  Sample Value
  fas fa-arrow-right
• Button Text Color: Login button styling button text color
  Sample Value
  white
• Button Background Color: Login button styling button background-color
  Sample Value
  black

Available when SSO Types is set to SAML 2.0:

• IDP Signing Certificate (X.509)*: The Base64-encoded X.509 certificate from Azure Portal > Enterprise Application > Single sign-on > SAML Certificates > Certificate (Base64). Download the file, open it in a text editor, and paste the content here. Include or exclude the BEGIN/END lines — both work.

Advanced

• API Page Size*: Maximum number of items per Microsoft Graph API request. Default 999 is the API maximum and recommended for most setups. Reduce only if you experience timeout errors with very large directories.
• Enable Debug Logging: Writes detailed debug information to the Joget server log. Useful for troubleshooting connection issues, sync problems, or SSO failures. Disable in production to reduce log volume.
• Enable Security Enhanced Directory Manager (SEDM): When enabled, exposes the Security Enhanced Directory Manager tabs which allow configuring password policies, account lockout rules, MFA settings, and add-on directory manager chaining. Requires the Joget Enterprise Security Enhanced Directory Manager feature.