---
title: "Microsoft Entra Role Members"
slug: "microsoft-entra-role-members"
updated: 2026-10-26T14:44:44Z
published: 2026-10-26T14:44:44Z
canonical: "docs.databee.buzz/microsoft-entra-role-members"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra Role Members

Microsoft Entra tracks user activity and generate reports that help to understand how users access and use Entra services.

**Integration Method:** API Ingest

**Tables**: User Access Management (3005), Group Management (3006)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Role Members | Fetches members (users and groups) for specified Microsoft Entra directory roles. |
| Role Assignments | Fetches PIM assignment metadata (assignment type, start/end time, member type) for members of specified Microsoft Entra directory roles, distinguishing standing admins from time-bound/PIM-activated assignments. |

This integration supports the following versions

| Microsoft Entra API version | V 1.0 |
| --- | --- |

> **Note**:
> 
> Microsoft Entra is a continuously updated cloud service. As of this document preparation, latest release was on Dec 2025.

## Prerequisites

- The user should have access to the [Azure portal](https://portal.azure.com/) with an account that has the Global Administrator privileges
- The user should have access to the **DataBee console**.

## Configuration Overview

1. Create an application with required permissions to fetch the data.
2. Create [Microsoft Entra Role Members Data Feed](/user-manual/docs/microsoft-entra-role-members#databee-configuration) in the DataBee console with the required Client credentials.

| **DataBee Parameter** | **Azure Parameter** |
| --- | --- |
| Client Key | [Application (client) ID](/docs/microsoft-entra-role-members#client_id_and_tenant_id) |
| Client Secret | [Client Secret Value](/docs/microsoft-entra-role-members#client_secret) |
| Token URL() | [Directory (Tenant) ID](/docs/microsoft-entra-role-members#client_id_and_tenant_id) |

## Azure Configuration

### Create an application

1. Log on to [Azure portal](https://portal.azure.com/) with an account that has the **Global Administrator** privileges.
2. In the **search bar**, search for **App registrations** and select it. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-v7rmd4rv.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
3. On the “App registrations” page, select **New registration**,then **“**Register an application” window will appear. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-uw4vcsvb.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
4. On the “Register an application” window, enter your application name in the **Name** field, then click **Register** to create the application. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-ldrkjdve.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
5. On the app **Overview** page, copy the **Application (client) ID** and **Directory (tenant) ID** for later use.

### Add Endpoint Access

Once the application is created, two permissions should be provided to fetch data. The appropriate permissions for the application are needed to access these endpoints. The following section details how to configure and add permissions to the required endpoints.

**Add Permissions**

From the **Azure Active Directory portal**:

1. Select the application registered in the previous step.
2. Under **Manage,** click **API permissions** and then click **Add a permission**,the “Request API permissions” window will appear. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-yjglheen.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
3. On “Request API permissions” window, click on **Microsoft APIs** then on **Microsoft Graph**. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-jmc5lh3k.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
4. Click on **Application permissions**. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-tg1frftd.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
5. The following permission need to be granted for the endpoint to function properly:

| **Event** | **Type** | **Permission** |
| --- | --- | --- |
| Role Members | Application | Directory.Read.All |

In the **Select permissions** search bar, enter the permission shown above, and check the box to include them.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-33rtmta7.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D) 6. Click the **Add permissions** button after selecting the required permission. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-sjusuf17.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D) 7. On the “API permissions” page, click **Grant admin consent** **for** . ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-4dckkyh7.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D) 8. Click the **Yes** button on the consent confirmation. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-m2p2b2t8.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D) 9. The required permission is now added for the endpoints. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-328zshyp.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)

### Create the Client Secret

The final step in accessing the APIs is creating a **Client Secret**. To create it from the Azure Portal:

1. Select the application created above.
2. Under **Manage**, click **Certificates & secrets**, and then **Client secrets**. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-2fyxc5p2.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
3. Click **New client secret**. Then “Add a client secret” window appears. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-hnylrysr.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
4. On “Add a client secret” window:
5. Enter a ‘Description’ for this client secret and select the desired expiry period from the ‘Expires’drop-list.
6. Then click on **Add** to create the client secret. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-17w19ajh.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)

> **Note:**
> 
> The user needs to re-create the client secret when it expires. 5. Copy the **Value** field to use it as **Client Secret** while configuring the [Data Feed Auth Configurations](/docs/microsoft-entra-role-members#data_feed_auth_config). ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-lbp4z3u2.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-m2078xpk.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
2. Search for the **Microsoft Entra Role Members** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-2paoi5nm.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
3. Click on the **API Ingest** option for collection method ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-7n6o93mu.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
4. Enter feed contact information. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-10v0k28t.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
5. In the configuration page, enter the following:
6. **Authorization Method**: OAuth2
7. **Client Key:** Paste the [Application (Client) ID](/docs/microsoft-entra-role-members#client_id_and_tenant_id) generated earlier in the Azure portal.
8. **Client Secret**: Paste the [Client Secret](/docs/microsoft-entra-role-members#client_secret) value generated earlier in the Azure portal.
9. **Token URL:** Replace with your [Directory (Tenant) ID](/docs/microsoft-entra-role-members#client_id_and_tenant_id).
10. **Role Names:** Comma separated list of directory roles for which members will be fetched. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-role-members-image-ynm2205d.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A22%3A40Z&se=2026-10-30T13%3A22%3A40Z&sr=c&sp=r&sig=RPSHjR6Y26t0hs9ff9YUfqsXJGnDskJGpiiVsvFAeck%3D)
11. Click **Submit**.

## Troubleshooting Tips

- If you are facing an **invalid client** or **unauthorized client** error this might be possibly due to incorrect credentials. Ensure the client key, client secret and Tenant ID are pasted correctly. Since you cannot view the client secret after the 1st time, re-create it, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.
- If you are facing a 403-response code this might be possibly due to missing permission. Ensure that the required permission is granted correctly as per the above-mentioned steps.
- Ensure that the requested directory role names are correctly entered and separated by commas.