Connect your app to Azure Graph & Entra API

1. 1

   Sign in to the Microsoft Entra admin center, navigate to App registrations, and register a new single-tenant application without a redirect URI.

   This creates the service principal identity your app will use to contact Microsoft Graph.

2. 2

   Copy the Directory (tenant) ID and Application (client) ID from the app overview page.

   Lovable requires both 36-character identifiers to locate and authenticate your app.

3. 3

   Go to Certificates & secrets, create a new client secret, and immediately copy its Value.

   This acts as the password for the app identity, and Microsoft will never display the value again after leaving the page.

4. 4

   Open API permissions, add Microsoft Graph Application permissions (such as User.Read.All), and click Grant admin consent.

   The application identity starts with zero permissions; a Global Administrator or Privileged Role Administrator must grant tenant-wide consent before data can be accessed.

5. 5

   In Lovable, navigate to Connectors, select Azure Graph & Entra API, click Connect, and enter your Tenant ID, Client ID, and Client Secret Value.

   Lovable verifies the credentials against Microsoft Entra and securely creates the shared server-side connection for your projects.

Use Azure Graph & Entra API and build an admin panel that lists the users in our Microsoft Entra directory with their account status, email, and display name in a filterable table.

Service principal

An automated app identity in Microsoft Entra that acts like a service account rather than a real person.

Application permissions

Broad, organization-wide access rights that work in the background without any real user logging in.

Admin consent

Approval from a top-level Microsoft administrator allowing an app identity to access company-wide data.

Client secret

A secure password generated for an app identity rather than a human account.

• Copying the Secret ID instead of the secret Value from the Microsoft portal will cause authentication to fail.
• A successful connection in Lovable only checks that the secret is valid; you will still get 403 errors until an admin actually clicks 'Grant admin consent' for the required permissions.
• Endpoints tied to a logged-in person (like /me) will fail because this connector runs without a signed-in user.
• The client secret will eventually expire; when it does, the connection will break until you generate a new secret in Entra and update it in Lovable.