Integrate Scribe with Azure AD/Microsoft 365 for User Management

Mohammad Kanny
34 steps
5 minutes

Azure

Bassemlabs

STEP 1 — Access Azure Portal

Go to <https://portal.azure.com/> and sign in with a **[[Global Administrator]]** account.

In the search bar at the top, type **[["Microsoft Entra ID"]]** and select it

STEP 2 — Register a New Application

In the left sidebar, click **[[App registrations]]** **,** then Click **[[+ Add]]** at the top

Choose "App registration"

Now we need to fill in the application details: \ for **[[Name]]** we can put **[[BassemLabs Integration]]** (or any descriptive name)

Select **[["Accounts in this organizational directory only (Single tenant)]]**

Click "Register"

STEP 3 — Copy Your Tenant ID and Application (Client) ID

After registration, you'll see the app's **[[Overview]]** page.

Copy **[[Directory (tenant) ID]]**

Let's add the key to BassemLabs

Paste the key and Click "Save"

Back to azure, Copy **[[Application (client) ID]]**

Paste the key and Click "Save"

STEP 4 — Create a Client Secret

In the left sidebar of your app, click **[[Certificates & secrets]]**\ then under **[[Client secrets]]**, click **[[+ New client secret]]**

Add a description: [[BassemLabs Integration Secret]]

Select an expiration period: **Recommended**: 24 months.

Mark your calendar to rotate this secret before it expires

Click "Add"

Here we have the new secret !

**[[COPY THE SECRET VALUE IMMEDIATELY]]** — it will only be shown once!

If you lose this secret, you'll need to generate a new one.

STEP 5 — Configure API Permissions (Microsoft Graph)

Your application needs permissions to manage users in your tenant.

In the left sidebar, click **[[API permissions]]**

Click **[[+ Add a permission]]**

Select **[[Microsoft Graph]]**

Select **[[Application permissions]]** (NOT Delegated permissions)

Search for **[[User.ReadWrite.All]]**

Check the permission

Now let's add: **[[Directory.ReadWrite.All]]**

Click "Add permissions"

STEP 6 — Grant Admin Consent

Application permissions require admin consent before they can be used

On the **[[API permissions]]** page, you'll see a warning: *[["Not granted for \[Your Organization\]"]]* 1. Click the button: **✅ Grant admin consent for \[Your Organization\]** 2. A popup will appear asking for confirmation 3. Click **Yes** 4. Wait a few seconds — the status column should change to: - ✅ **Granted for \[Your Organization\]** (with a green checkmark)

Now we can paste the **[[Client Secret]]** we've copied earlier

Click "Save"

STEP 6B — Assign User Administrator Role to the App

**This Step is Required for password changes**

1. In the left sidebar of **Microsoft Entra ID** (or Azure Active Directory), click **Roles and administrators** 2. Search for **User Administrator** and click on it 3. Click **+ Add assignments** 4. In the search box, type the **exact name** of your app (e.g., `BassemLabs Integration`) - ⚠️ **Note**: The app may not appear in the default list — you must type the name to search 5. Select your application from the results 6. Click **Add** 7. Verify the assignment appears under **Assignments** for the User Administrator role ✅ **Your app can now update user passwords!**

Integrate Scribe with Azure AD/Microsoft 365 for User Management

Mohammad Kanny
34 steps
5 minutes

Azure

Bassemlabs

STEP 1 — Access Azure Portal

Go to <https://portal.azure.com/> and sign in with a **[[Global Administrator]]** account.

In the search bar at the top, type **[["Microsoft Entra ID"]]** and select it

STEP 2 — Register a New Application

In the left sidebar, click **[[App registrations]]** **,** then Click **[[+ Add]]** at the top

Choose "App registration"

Now we need to fill in the application details: \ for **[[Name]]** we can put **[[BassemLabs Integration]]** (or any descriptive name)

Select **[["Accounts in this organizational directory only (Single tenant)]]**

Click "Register"

STEP 3 — Copy Your Tenant ID and Application (Client) ID

After registration, you'll see the app's **[[Overview]]** page.

Copy **[[Directory (tenant) ID]]**

Let's add the key to BassemLabs

Paste the key and Click "Save"

Back to azure, Copy **[[Application (client) ID]]**

Paste the key and Click "Save"

STEP 4 — Create a Client Secret

In the left sidebar of your app, click **[[Certificates & secrets]]**\ then under **[[Client secrets]]**, click **[[+ New client secret]]**

Add a description: [[BassemLabs Integration Secret]]

Select an expiration period: **Recommended**: 24 months.

Mark your calendar to rotate this secret before it expires

Click "Add"

Here we have the new secret !

**[[COPY THE SECRET VALUE IMMEDIATELY]]** — it will only be shown once!

If you lose this secret, you'll need to generate a new one.

STEP 5 — Configure API Permissions (Microsoft Graph)

Your application needs permissions to manage users in your tenant.

In the left sidebar, click **[[API permissions]]**

Click **[[+ Add a permission]]**

Select **[[Microsoft Graph]]**

Select **[[Application permissions]]** (NOT Delegated permissions)

Search for **[[User.ReadWrite.All]]**

Check the permission

Now let's add: **[[Directory.ReadWrite.All]]**

Click "Add permissions"

STEP 6 — Grant Admin Consent

Application permissions require admin consent before they can be used

Now we can paste the **[[Client Secret]]** we've copied earlier

Click "Save"

STEP 6B — Assign User Administrator Role to the App

**This Step is Required for password changes**