Microsoft Entra Users by Group - Version 2.0

Overview

The Microsoft Entra Users by Group - Version 2.0 collector retrieves the members of a specified Microsoft Entra ID security or Microsoft 365 group, submitting one record per user found in that group.

This collector enables organizations to track group membership for billing, allocation, or reporting purposes within Varibill. Each execution captures which users currently belong to a named Entra group, with a configurable Product Identifier that defines how the membership is represented as a billable item.

The collector retrieves unrated allocation data, meaning no monetary values are supplied by the source system. Pricing and billing calculations are applied within Varibill based on configured contracts and pricing rules.

This is a point-in-time collector, meaning each execution retrieves the current group membership at the time of collection.

For general instructions on creating and running Source Collectors, see: Configuring a New Cloud Source Collector

Collector Summary

About Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service. It provides authentication, authorization, and directory services for organizations using Microsoft cloud services and applications.

Microsoft Entra ID manages user identities, application access, and security policies across an organization’s cloud environment. It is the identity backbone for Microsoft 365, Azure, and thousands of third-party SaaS applications.

Groups in Microsoft Entra ID are used to organize users for access control, licensing, and administration. Security groups and Microsoft 365 groups can contain users, devices, and other groups, and are commonly used to manage access to resources or to define service scopes.

Data Collected

The Microsoft Entra Users by Group - Version 2.0 collector retrieves unrated group membership data from Microsoft Entra ID. For each user that belongs to the specified group, the collector submits one record with a quantity of 1.

Each record includes the user’s display name, email address (user principal name), and the group’s display name.

The Product Identifier for all records is set to the configured Product Identifier parameter value (for example, SupportedUsers). This allows you to define how the group membership is represented as a product in Varibill.

The Client Identifier for all records is the Entra Tenant ID, identifying the tenant from which the data was collected.

The Record Identifier for each record takes the form The user {display name} ({email}) belongs to the group {group name}.

The Unique Identifier for each record is constructed as {group ID}#{user ID}, where both values are Microsoft Entra GUIDs.

Ensure your Varibill product configuration accounts for these formats.

Prerequisites

Before configuring this collector, ensure that:

• You have access to a Microsoft Entra ID tenant (Azure Active Directory)
• You have permission to create or manage Application Registrations in the Azure portal
• You have registered an application in Microsoft Entra ID with the following Microsoft Graph API application permissions:
  • Group.Read.All — to retrieve group data and membership
  • User.Read.All — to retrieve user profile data for group members
• You have granted Admin Consent for the above API permissions
• You have created a Client Secret for the application registration
• You have noted the Tenant ID, Application (Client) ID, and Client Secret value
• You know the exact display name of the Entra group you want to collect membership for
• You have access to the Varibill Source Collector configuration screen

Configuration Parameters

The parameters below are entered when configuring the collector in Varibill. They are grouped by function.

Connection Parameters

These parameters identify and authenticate against your Microsoft Entra ID tenant using OAuth 2.0 client credentials.

Group and Product Parameters

Operational Parameters

These parameters control file management behavior.

Configuration Steps

Step 1: Prepare Microsoft Entra ID

1. Sign in to the Azure portal.
2. Navigate to Microsoft Entra ID > App registrations and create a new application registration (or use an existing one).
3. Note the Application (client) ID and the Directory (tenant) ID from the application’s Overview page.
4. Navigate to API permissions and add the following Microsoft Graph application permissions:
   • Group.Read.All
   • User.Read.All
5. Click Grant admin consent to authorize the permissions.
6. Navigate to Certificates & secrets > Client secrets and create a new client secret.
7. Copy the Value of the client secret immediately — it is only displayed once.
8. Note the exact display name of the Entra group you want to collect membership for. Navigate to Microsoft Entra ID > Groups and confirm the name.

Step 2: Configure the Collector in Varibill

1. In the Varibill User Interface, open the Source Collector configuration screen.

2. Enter the required field values under the Details tab:

   • Hosting Provider: Select Varibill Cloud
   • Source Collector Name: Select Microsoft Entra Users by Group - Version 2.0

3. Enter the connection parameters:

   • Entra Tenant ID: The Directory (tenant) ID from the Azure portal
   • Entra Application ID: The Application (client) ID from the Azure portal
   • Entra Secret Key: The client secret value

4. Configure the group and product parameters:

   • Entra Group Name: The exact display name of the target group in Microsoft Entra ID
   • Product Identifier: The product code to use in Varibill (for example, SupportedUsers)

5. Save the collector configuration.

Step 3: Run the Collector

Run or schedule the collector according to your standard Source Collector execution process.

For detailed instructions, see: Configuring a New Cloud Source Collector

Troubleshooting

If the collector fails to connect to Microsoft Entra ID, verify that:

• The Entra Tenant ID is correct and matches the tenant containing your group.
• The Entra Application ID is correct and corresponds to a valid application registration.
• The Entra Secret Key is valid, has not expired, and has not been revoked.
• The required Microsoft Graph API permissions (Group.Read.All, User.Read.All) have been granted to the application registration.
• Admin Consent has been granted for the API permissions.

If the collector connects successfully but returns no data, verify that:

• The Entra Group Name matches the group’s display name in Microsoft Entra ID exactly, including spacing and capitalization.
• The group contains at least one member.
• The application registration has sufficient permissions to read group membership data.

Microsoft Entra ID References

The following resources may assist with locating values or configuring your Microsoft Entra ID application registration.

Microsoft Documentation (External)

• Microsoft Entra ID Documentation
• Microsoft Graph API Reference
• How to find your Microsoft Entra Tenant ID
• How to register an application in Microsoft Entra
• How to create a Client Secret
• How to grant Admin Consent