entra_id

Identity and directory management for Microsoft Entra ID (formerly Azure Active Directory), derived from the Microsoft Graph v1.0 API.

Provider Summary

total services: 39
total resources: 849

Installation

To pull the latest version of the entra_id provider, run the following command:

REGISTRY PULL entra_id;

To view previous provider versions or to pull a specific provider version, see here.

Authentication

The entra_id provider authenticates to Microsoft Graph using the OAuth2 client credentials (app-only) grant. Register an application in Microsoft Entra ID, grant it the required Microsoft Graph application permissions (and admin-consent them), then create a client secret.

The following system environment variables are used for authentication by default:

AZURE_TENANT_ID - your Entra ID tenant ID (GUID or verified domain), used in the token endpoint
AZURE_CLIENT_ID - the application (client) ID of your app registration
AZURE_CLIENT_SECRET - a client secret for the app registration

These variables are sourced at runtime (from the local machine or as CI variables/secrets).

Using different environment variables

To use different environment variables (instead of the defaults), use the --auth flag of the stackql program. For example:

AUTH='{ "entra_id": { "type": "oauth2", "grant_type": "client_credentials", "client_id_env_var": "MY_CLIENT_ID", "client_secret_env_var": "MY_CLIENT_SECRET", "token_url": "https://login.microsoftonline.com/{{ .__env__MY_TENANT_ID }}/oauth2/v2.0/token", "scopes": ["https://graph.microsoft.com/.default"] }}'
stackql shell --auth="${AUTH}"

Installation​

Authentication​

Services​

Installation

Authentication

Services