Microsoft Entra Connector

The CloudTools Microsoft Entra connector brings Microsoft 365 identity and collaboration operations into Salesforce through Microsoft Graph. Work with directory users and groups, guest invitations, user licenses and mailbox contacts, group document libraries, calendars, and events. Use supported actions in Salesforce Flow automations or custom Apex and Lightning Web Component experiences.

This introduction covers the connector’s capabilities and integration planning. Individual action references describe permissions, inputs, outputs, examples, authorization restrictions, and implementation limits.

Directory and collaboration resources

Directory users identify Microsoft accounts, while groups organize directory membership and can provide Microsoft 365 collaboration resources. User mailbox contacts are separate from directory accounts. License details describe assigned products and service plans; invitations support external-user access and redemption.

A group’s document libraries are represented by Graph drives, with files and folders represented by drive items. Calendars and events belong to a mailbox or a supported Microsoft 365 group context. Keep resource IDs with their source user, group, drive, item, or calendar. Microsoft Graph IDs and user principal names are not Salesforce record IDs or interchangeable browser links.

Collection lookup helpers search previously retrieved items by ID without calling Microsoft. Use the helper’s documented model type: response wrappers, individual license details, directory users, and mailbox contacts have different shapes.

What you can build

Build user and group discovery experiences, provision supported directory resources, manage membership, and connect Salesforce records with group files. Calendar and event actions can support availability checks and meeting workflows. License assignment and invitations can support account administration when the caller has the required permissions and directory roles.

Your application controls how Microsoft resources relate to Salesforce records. Calling an action does not automatically save returned metadata, create Salesforce Files, synchronize records, or establish ongoing two-way updates. Creating a user, inviting a guest, assigning a license, and creating a mailbox contact are distinct operations.

Connection and authorization

Use a CloudTools Connector record with Connector Type set to Microsoft 365. Choose OAuth Delegated (Authorization Code) for interactive access and complete Microsoft sign-in. For operations supporting unattended access, choose OAuth Application (Client Credentials), grant application permissions and administrator consent, and supply the target identifiers requested by the action.

Permission requirements depend on the operation, target resource, and authorization type. Directory administration can require supported Microsoft Entra roles in addition to Graph scopes; mailbox, group, and library access also depend on resource permissions and tenant policy. A Named Credential does not remove these requirements. Use Creating an Entra ID App and Integration Connectors for setup, then consult the relevant Microsoft operation reference.

All Entra Graph action classes implement getAppPermission providers. A declared scope is an alternative permission, not a guarantee that every target or field is supported. License detail lookup requires delegated access, and group calendar support differs from user calendars. Check each action before assuming that application authentication supports it.

Use in Salesforce Flow

For operations supporting application access, configure a Microsoft 365 application connector as Set as default for Flow automations. Supply the required target identifiers, retain useful outputs, and add fault handling. Delegated connections are not supported for CloudTools Flow automation; verify operation and target support before including an administrative or calendar action in a Flow.

Graph actions process only the first input request. Most collection actions return an outer list containing one collection, but schedule results, library search results, and item version collections use flat lists. License operations include response wrappers and property lists. Collection lookup helpers process every request and preserve null matches. Follow the individual reference’s result shape when connecting subsequent steps.

Use in custom development

Subscriber Apex uses the Apptigent namespace and the global methods and input types documented for each action. Arrange authorization first, run Graph actions in a context permitting callouts, and handle exceptions, empty results, and default or unmapped objects. Global invocable inputs do not expose connectorId.

Lightning Web Components can use msEntraConnectorLib through MSEntraConnectorController. For direct MSEntraAction operations, request.connectorId selects a configured connector. Group library wrappers delegate to shared file helpers without passing that selection, so those file calls use the default Microsoft 365 connection. Review connector behavior for each operation.

The controller maps shared request DTOs into global inputs, sometimes renaming fields or converting arrays and nested objects. JavaScript results can flatten or serialize nested Apex models. rawJson contains mapped Apex data rather than the untouched Microsoft response. Authorization helpers support delegated sign-in; the library does not automatically authorize or retry an action.

Planning your workflow

Identify the resource and required authorization before designing the sequence. Preserve directory membership references separately from the user or group objects they reference. Confirm group type and available collaboration resources before working with libraries or group calendars. Calendar date/time values require the appropriate time zones; meeting responses, cancellation, deletion, and forwarding have different organizer and attendee effects.

Review pagination, query support, advanced directory query requirements, field visibility, and output mapping. The action references distinguish nested collection results, flat lists, license wrappers, and public-only legacy properties. A default object or partial collection does not prove that a resource exists or that all data was returned.

File transfer actions must explicitly handle Salesforce storage and callout/heap limits. Upload retrieves content from a source URL; download returns file data for the caller to store or transform. Copy can run asynchronously and its wrapper does not expose a monitor URL. Verify destination state before continuing dependent work.

Inspect resource state before retrying a mutation whose outcome is uncertain. Directory changes, license assignments, meeting invitations, and group deletion can affect connected workflows; use the individual references to confirm the intended resource and resulting behavior.