# Configure the Microsoft Entra ID integration in Persona

> Connect Microsoft Entra ID with delegated or app-only permissions to manage users and authentication methods, including password reset and MFA revocation.

Source: https://help.withpersona.com/articles/6vHVa8KcEURyza3nk2v0RH/
Section: Marketplace and 3rd-Party Integrations > Authentication > Microsoft Entra

## Overview

[Microsoft Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id) is a identity management platform that helps organizations manage access to applications and resources in a secure manner. Integrating Microsoft Entra ID with Persona enables businesses to leverage Persona's identity verification capabilities within the Microsoft ecosystem to manage employee authentication and account recovery workflows, including password resets and MFA method revocation.

## Prerequisites

To set up the Microsoft Entra ID integration with Persona, you need:

- A Microsoft Entra tenant configured for service.
- Completion of the onboarding process with Persona. You can create an account by registering through the Persona Dashboard.

## Connect Microsoft Entra ID to your Persona account

Visit the Marketplace integrations in your Persona dashboard and select **Microsoft Entra ID**.

Microsoft Entra ID supports two authentication methods:

1.  **Delegated permissions** (default) — allows full user authentication method management
2.  **Application permissions** (app-only) — allows limited authentication method operations

To learn more about the differences between these permission types, see Microsoft's documentation on [delegated and application permissions](https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview).

### Option 1: Delegated permissions

Delegated permissions allow Persona to act on behalf of a signed-in user and access a range of Microsoft Graph authentication methods APIs. The authorizing user’s permissions will determine the Microsoft Entra ID operations Persona can make on behalf of the user.

**Supported operations and associated permissions:**

- Get user - `User.Read.All`, `CustomSecAttributeAssignment.Read.All`
- Get user by email - `User.Read.All`
- Create a user - `User.ReadWrite.All`
- Update a user - `User.ReadWrite.All`, `User-PasswordProfile.ReadWrite.All`
- List authentication methods - `UserAuthenticationMethod.ReadWrite.All`
- Delete authentication method - `UserAuthenticationMethod.ReadWrite.All`
- Reset password - `UserAuthenticationMethod.ReadWrite.All`
- Create temporary access pass - `UserAuthenticationMethod.ReadWrite.All`

**Setup steps:**

1.  Choose **\+ Add credential** and select **Microsoft Entra Authorization**
2.  Provide a name for this credential (e.g., "Persona")
3.  Sign in to your Microsoft account

**Note that the `offline_access` permission is required to enable Persona to maintain access to Graph APIs.**

### Option 2: Application permissions (app-only)

Application permissions allow Persona to authenticate with its own identity (client credentials) rather than on behalf of a user. This is useful for automated, unattended scenarios. The app’s permissions will determine the Microsoft Entra ID operations Persona can make.

**Supported operations and associated permissions:**

- Get user - `User.ReadWrite.All`
- Get user by email - `User.ReadWrite.All`
- Create a user - `User.ReadWrite.All`
- Update a user - `User.ReadWrite.All`, `User-PasswordProfile.ReadWrite.All`
- List authentication methods - `UserAuthenticationMethod.ReadWrite.All`
- Delete authentication method - `UserAuthenticationMethod.ReadWrite.All`
- Create temporary access pass - `UserAuthenticationMethod.ReadWrite.All`

**Unsupported operations:**

- Reset password — Microsoft does not support this operation with application-only permissions

ℹ️

If your use case requires password resets, you may update the password
profile for a given user with the Update a user request.

#### Setting up app-only permissions

1.  In the Azure/Entra portal, navigate to **App registrations** (not Enterprise Applications)
2.  Select your Persona application or create a new app registration
3.  Under **Certificates & secrets**, create a new client secret and save it securely
4.  Under **API permissions**, add the relevant **Application permissions** (not Delegated).
5.  Click **Grant admin consent** for your tenant
6.  In your Persona dashboard, navigate to [Marketplace Integrations](https://app.withpersona.com/dashboard/marketplace) and search Microsoft Entra.
7.  Choose **\+ Add credential**
8.  Provide a name for this credential (e.g., "Persona App-Only")
9.  Enter your:
    - **Tenant ID**
    - **Client ID** (Application ID)
    - **Client Secret**

## Your employee's experience

To help an employee reset their password, you'll need to pre-fill their Entra ID—typically their work email address—as part of the inquiry URL. Your helpdesk can generate a Persona inquiry link that includes the employee's Entra ID in the URL.

Persona uses this to fetch employee data from Microsoft Entra—such as name and date of birth—so we can verify the correct individual before proceeding with any account updates.

Once verified, the employee will be shown a temporary password. They can use this to sign in at [https://entra.microsoft.com](https://entra.microsoft.com), where they'll be prompted to set a new password.

For more on what the employee will see, visit [What to expect when verifying your identity with Persona to reset your Microsoft Entra ID password](https://help.withpersona.com/articles/3fe4bvIj8lSLLPligSzZVL/).

## Resetting an employee's MFA

Beyond password reset, the integration can reset an employee's multi-factor authentication (MFA) by deleting a registered authentication method, which revokes that factor and forces the employee to re-enroll it at next sign-in. Unlike Okta, Microsoft Graph has no single "reset all factors" endpoint, so MFA reset in Entra works per method using two operations in sequence:

1.  **List authentication methods** — fetch the employee's registered methods to identify the one to reset. The response includes each method's `@odata.type` (which maps to the method type) and `id`.
2.  **Delete authentication method** — delete the specific method by its type and ID. Deleting the method revokes that factor, and the employee is prompted to re-enroll it on next sign-in according to your Entra policies.

The **Method Type** parameter selects the kind of method to delete and accepts one of:

- `softwareOathMethods`
- `emailMethods`
- `fido2Methods`
- `microsoftAuthenticatorMethods`
- `phoneMethods`
- `platformCredentialMethods`
- `temporaryAccessPassMethods`
- `windowsHelloForBusinessMethods`

Both operations require the `UserAuthenticationMethod.ReadWrite.All` permission. Deleting an authentication method is delegated only: like password reset, Microsoft Graph does not support it with application-only permissions.

⚠️

Deleting an authentication method is irreversible and immediately revokes that factor. Confirm you are deleting the correct method for the correct user before proceeding, and prefer verifying the employee's identity through a Persona inquiry before revoking a factor.

## Frequently Asked Questions

### What minimum permissions and scopes are required?

You must create a Microsoft Entra API credential with the appropriate scopes. These include `User.Read.All` and `UserAuthenticationMethod.ReadWrite.All`. If these permissions are not provided, the integration setup will fail with the message _"Need admin approval: Persona needs permission to access resources in your organization that only an admin can grant."_

**For delegated permissions:** The signed-in user must have these delegated permissions and appropriate admin privileges.

**For app-only permissions:** The application must be granted these application permissions in the App registration, and admin consent must be granted.

### Can I reset all of an employee's MFA factors at once?

No. Microsoft Graph has no single endpoint that resets every factor at once, so the integration resets MFA one method at a time: list the employee's authentication methods, then delete each method you want to revoke. Each deleted method forces re-enrollment at next sign-in. This is delegated only, like password reset.

### How can I get my user a verification link?

In many cases, employees may reach out to a helpdesk via ServiceNow or similar tools. The helpdesk can pre-fill the employee's Entra ID in the inquiry URL before sharing it. Persona will then pull data from Entra to verify identity before performing the configured authentication method operation. Microsoft Entra will enforce a password change the next time the employee signs in (when using password reset).

## Plans Explained

### Microsoft Entra Integration by plan

|                             | Startup Program | Essential Plan | Growth Plan | Enterprise Plan |
| --------------------------- | --------------- | -------------- | ----------- | --------------- |
| Microsoft Entra Integration | Not Available   | Not Available  | Limited     | Available       |

[Learn more about pricing and plans](https://withpersona.com/pricing?utm_source=product&utm_medium=referral&utm_audience=a&utm_campaign=cm_gen_ds_hc-plan-table).

_Last updated on August 25, 2026._