This article applies to:

• MailMarshal 11.2 and above
• MailMarshal SPE 4.4 and above
• Entra ID Group Import

Question:

• How do I register an application in Azure/Entra to allow group import to MailMarshal?
• What are the options and requirements for use of imported Entra groups?

Background:

MailMarshal allows you to retrieve user group information directly from Microsoft Entra ID (formerly known as Azure Active Directory). To connect, you must create an "application" in Entra.

You will enter the Client ID, Tenant ID, and Secret from Entra in the MailMarshal Management Console or the MailMarshal SPE Customer Console

Procedure:

1. Log in to the Microsoft Entra Admin Center (entra.microsoft.com). The minimum required permission is "Cloud Application Administrator"
2. If you have access to more than one tenant, use the Settings menu (gear icon in the top bar) to switch to the specific tenant.
3. From the left menu browse to Identity > Applications > App registrations. Click New registration.
   
4. Enter a name.
5. For "supported account types" accept the default (single tenant).
6. Click Register.
7. From the overview page of the application, note the following values:
   • Application (client) ID
   • Directory (tenant) ID
8. From the API Permissions page of the application, grant the following Microsoft Graph permissions (Application permissions):
   • Group.Read.All
   • Member.Read.Hidden
   • OrgContact.Read.All
   • User.Read.All
9. After updating the above permissions, click Grant admin consent (above the list of permissions)
   
10. From the Certificates & Secrets page of the application, create a new client secret. Note the value (it is only available immediately after creation).

Group usage:

After creating the connector you can select groups to import using the Import Connector Group or Import Entra Groups button on the User Groups page.

Groups are populated immediately. Group membership is queried and updated hourly.