Microsoft Entra ID Attribute Provider

The Microsoft Entra ID Attribute Provider connector retrieves user attributes from Microsoft Entra ID (formerly Microsoft Entra ID) using the Microsoft Graph API — enriching session claims with directory data beyond what authentication alone provides.

Console terminology: In the Maverics Console, this section is called Identity Fabric. The YAML configuration uses the connectors key to define attribute provider integrations.

Overview

The Entra ID Attribute Provider uses the Microsoft Graph API to look up user profile data, group memberships, and other directory attributes. It shares the same connector type as the Microsoft Entra ID IdP connector, but configured without OIDC authentication fields. This connector is not an identity provider. It does not handle authentication. Instead, it is paired with an IdP connector (such as Okta, ADFS, or Microsoft Entra ID OIDC) to supplement the session with additional attributes from Microsoft Entra ID.

Use Cases

Unified SSO with Entra ID attribute enrichment — Enrich sessions with Entra ID profile data (department, job title, manager) so applications receive consistent identity attributes regardless of which IdP handles authentication
Cross-IdP authorization with Entra ID groups — Query Entra ID group memberships to drive authorization decisions in Orchestrator policies, even when users authenticate through a non-Microsoft IdP like Okta or ADFS
Bridge identity data during IdP consolidation — During migration away from or toward Entra ID, maintain access to Microsoft directory attributes so applications continue to receive the claims they depend on
Multi-directory identity enrichment — Combine Entra ID attribute lookups with authentication from any supported IdP, bridging identity data across organizational boundaries such as post-acquisition environments

Configuration

Console UI
Configuration

To create a Microsoft Entra ID Attribute Provider connector in the Maverics Console:

Navigate to Identity Fabric in the Console sidebar.
Click Create and select Microsoft Entra ID Attribute Provider.
Enter a Name — this is the friendly name that identifies your provider.
Enter the Microsoft Graph URL — this defines the endpoint used to make calls to the Microsoft Graph API. Use https://graph.microsoft.com/v1.0 for the stable API version.
Optionally enter the OIDC Well Known URL — the URL that returns OpenID Connect metadata about the Entra ID authorization server. This follows the pattern https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration.
Enter the OAuth Client ID — the client ID of the Maverics application registered in the Entra ID organization.
Enter the OAuth Client Secret — the client secret of the Maverics application registered in the Entra ID organization.
Click Save.

maverics.yaml

connectors:
  - name: azure-attr
    type: azure
    graphURL: "https://graph.microsoft.com/v1.0"
    oidcWellKnownURL: "https://login.microsoftonline.com/{{ env.AZURE_TENANT_ID }}/v2.0/.well-known/openid-configuration"
    oauthClientID: "{{ env.AZURE_CLIENT_ID }}"
    oauthClientSecret: <vault.azure_client_secret>

The Entra ID Attribute Provider requires an app registration in the Azure portal with Microsoft Graph API permissions. Grant the application User.Read.All (or equivalent) permissions so the Orchestrator can query user attributes.

Configuration Reference

Key	Type	Required	Description
`name`	string	Yes	Unique connector identifier referenced in app policies
`type`	string	Yes	Must be `azure`
`graphURL`	string	Yes	Microsoft Graph API endpoint (e.g., `https://graph.microsoft.com/v1.0`)
`oidcWellKnownURL`	string	No	OIDC discovery endpoint URL for Entra ID authorization
`oauthClientID`	string	Yes	OAuth 2.0 client (application) ID from the Azure portal
`oauthClientSecret`	string	Yes	OAuth 2.0 client secret (use secret reference syntax)

For the complete field reference, see Identity Fabric.

Troubleshooting

Verify the graphURL is reachable from the Orchestrator host — the standard endpoint is https://graph.microsoft.com/v1.0
Ensure the app registration has the correct Graph API permissions — without User.Read.All or similar scopes, attribute lookups will fail with 403 errors
Check that the oauthClientSecret reference resolves correctly via your secret provider — Entra ID client secrets expire and need periodic rotation
Confirm the tenant ID in the oidcWellKnownURL matches the directory where the app registration and target users reside