Microsoft Entra ID connector reference

Important

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft Entra ID from the Previews page. See Manage Azure Databricks previews.

This page has reference information for the managed Microsoft Entra ID connector, including supported source tables and destination table schemas.

Supported source tables

The Microsoft Entra ID connector supports the following source tables, all under the default source schema:

Source table	Primary key	Description	Sync mode	Cursor field
`users`	`id`	Users in the tenant, including each user's manager.	Full refresh only
`groups`	`id`	Groups in the tenant.	Full refresh only
`group_members`	`group_id`, `id`	Direct members of each group.	Full refresh only
`group_owner`	`group_id`, `id`	Owners of each group.	Full refresh only
`applications`	`id`	Application registrations in the tenant.	Full refresh only
`serviceprincipals`	`id`	Service principals (enterprise applications) in the tenant.	Full refresh only
`directoryroles`	`id`	Directory roles that are activated in the tenant.	Full refresh only
`directory_role_member`	`role_id`, `id`	Members of each activated directory role.	Full refresh only
`directoryroletemplates`	`id`	Templates of the built-in directory roles.	Full refresh only
`directoryaudits`	`id`	Directory audit log events.	Incremental	`activityDateTime`
`signins`	`id`	User sign-in log events.	Incremental	`createdDateTime`
`user_registration_detail`	`id`	Authentication methods that each user has registered.	Full refresh only
`identityproviders`	`id`	Identity providers configured in the tenant.	Full refresh only
`adminconsentrequestpolicy`	`policy_id`	The tenant's admin consent request policy.	Full refresh only
`role_eligibility_schedule`	`id`	Privileged Identity Management (PIM) role eligibility schedules for directory roles.	Full refresh only

Connector options

The Microsoft Entra ID connector supports the following pipeline-level option. For usage, see Examples.

Option	Type	Scope	Required	Applies to	Description
`start_datetime`	String	Pipeline	No	`directoryaudits`, `signins`	Earliest event time to ingest on the first sync, as an RFC 3339 timestamp, for example `2026-09-15T00:00:00Z`. The connector limits the value to between 30 days and 1 day before the sync. Defaults to 30 days before the sync.

Destination table schemas

`users`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`displayName`	`STRING`
`givenName`	`STRING`
`surname`	`STRING`
`userPrincipalName`	`STRING`
`mail`	`STRING`
`jobTitle`	`STRING`
`mobilePhone`	`STRING`
`officeLocation`	`STRING`
`preferredLanguage`	`STRING`
`accountEnabled`	`BOOLEAN`
`userType`	`STRING`
`createdDateTime`	`TIMESTAMP`
`lastPasswordChangeDateTime`	`TIMESTAMP`
`department`	`STRING`
`companyName`	`STRING`
`employeeId`	`STRING`
`employeeType`	`STRING`
`employeeHireDate`	`TIMESTAMP`
`employeeOrgData`	`STRUCT<costCenter:STRING, division:STRING>`
`securityIdentifier`	`STRING`
`usageLocation`	`STRING`
`city`	`STRING`
`state`	`STRING`
`country`	`STRING`
`postalCode`	`STRING`
`streetAddress`	`STRING`
`externalUserState`	`STRING`
`externalUserStateChangeDateTime`	`TIMESTAMP`
`creationType`	`STRING`
`onPremisesSyncEnabled`	`BOOLEAN`
`businessPhones`	`ARRAY<STRING>`
`proxyAddresses`	`ARRAY<STRING>`
`imAddresses`	`ARRAY<STRING>`
`otherMails`	`ARRAY<STRING>`
`refreshTokensValidFromDateTime`	`TIMESTAMP`
`signInSessionsValidFromDateTime`	`TIMESTAMP`
`onPremisesImmutableId`	`STRING`
`onPremisesSecurityIdentifier`	`STRING`
`onPremisesSamAccountName`	`STRING`
`onPremisesUserPrincipalName`	`STRING`
`onPremisesDomainName`	`STRING`
`onPremisesLastSyncDateTime`	`TIMESTAMP`
`identities`	`ARRAY<STRUCT<issuer:STRING, issuerAssignedId:STRING, signInType:STRING>>`
`assignedLicenses`	`ARRAY<STRUCT<disabledPlans:ARRAY<STRING>, skuId:STRING>>`
`assignedPlans`	`ARRAY<STRUCT<assignedDateTime:TIMESTAMP, capabilityStatus:STRING, service:STRING, servicePlanId:STRING>>`
`licenseAssignmentStates`	`ARRAY<STRUCT<assignedByGroup:STRING, disabledPlans:ARRAY<STRING>, error:STRING, lastUpdatedDateTime:TIMESTAMP, skuId:STRING, state:STRING>>`
`onPremisesExtensionAttributes`	`STRUCT<extensionAttribute1:STRING, extensionAttribute10:STRING, extensionAttribute11:STRING, extensionAttribute12:STRING, extensionAttribute13:STRING, extensionAttribute14:STRING, extensionAttribute15:STRING, extensionAttribute2:STRING, extensionAttribute3:STRING, extensionAttribute4:STRING, extensionAttribute5:STRING, extensionAttribute6:STRING, extensionAttribute7:STRING, extensionAttribute8:STRING, extensionAttribute9:STRING>`
`onPremisesProvisioningErrors`	`ARRAY<STRUCT<category:STRING, occurredDateTime:TIMESTAMP, propertyCausingError:STRING, value:STRING>>`
`ageGroup`	`STRING`
`consentProvidedForMinor`	`STRING`
`legalAgeGroupClassification`	`STRING`
`faxNumber`	`STRING`
`mailNickname`	`STRING`
`preferredDataLocation`	`STRING`
`onPremisesDistinguishedName`	`STRING`
`passwordPolicies`	`STRING`
`isManagementRestricted`	`BOOLEAN`
`isResourceAccount`	`BOOLEAN`
`showInAddressList`	`BOOLEAN`
`deletedDateTime`	`TIMESTAMP`
`employeeLeaveDateTime`	`TIMESTAMP`
`customSecurityAttributes`	`VARIANT`
`passwordProfile`	`STRUCT<forceChangePasswordNextSignIn:BOOLEAN, forceChangePasswordNextSignInWithMfa:BOOLEAN>`
`provisionedPlans`	`ARRAY<STRUCT<capabilityStatus:STRING, provisioningStatus:STRING, service:STRING>>`
`serviceProvisioningErrors`	`ARRAY<STRUCT<`@odata.type`:STRING, createdDateTime:TIMESTAMP, errorDetail:STRING, isResolved:BOOLEAN, serviceInstance:STRING>>`
`signInActivity`	`STRUCT<lastNonInteractiveSignInDateTime:TIMESTAMP, lastNonInteractiveSignInRequestId:STRING, lastSignInDateTime:TIMESTAMP, lastSignInRequestId:STRING, lastSuccessfulSignInDateTime:TIMESTAMP, lastSuccessfulSignInRequestId:STRING>`
`authorizationInfo`	`STRUCT<certificateUserIds:ARRAY<STRING>>`
`identityParentId`	`STRING`
`manager`	`STRUCT<`@odata.type`:STRING, id:STRING, displayName:STRING, userPrincipalName:STRING, mail:STRING, jobTitle:STRING, givenName:STRING, surname:STRING, mobilePhone:STRING, officeLocation:STRING, preferredLanguage:STRING, businessPhones:ARRAY<STRING>>`

Note

This table does not support SCD type 2 because it has VARIANT columns.

`groups`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`displayName`	`STRING`
`description`	`STRING`
`mail`	`STRING`
`mailNickname`	`STRING`
`mailEnabled`	`BOOLEAN`
`securityEnabled`	`BOOLEAN`
`visibility`	`STRING`
`createdDateTime`	`TIMESTAMP`
`renewedDateTime`	`TIMESTAMP`
`securityIdentifier`	`STRING`
`membershipRule`	`STRING`
`membershipRuleProcessingState`	`STRING`
`groupTypes`	`ARRAY<STRING>`
`proxyAddresses`	`ARRAY<STRING>`
`isAssignableToRole`	`BOOLEAN`
`expirationDateTime`	`TIMESTAMP`
`onPremisesSyncEnabled`	`BOOLEAN`
`onPremisesSecurityIdentifier`	`STRING`
`onPremisesSamAccountName`	`STRING`
`onPremisesNetBiosName`	`STRING`
`onPremisesDomainName`	`STRING`
`onPremisesLastSyncDateTime`	`TIMESTAMP`
`creationOptions`	`ARRAY<STRING>`
`resourceProvisioningOptions`	`ARRAY<STRING>`
`onPremisesProvisioningErrors`	`ARRAY<STRUCT<category:STRING, occurredDateTime:TIMESTAMP, propertyCausingError:STRING, value:STRING>>`
`serviceProvisioningErrors`	`ARRAY<STRUCT<`@odata.type`:STRING, createdDateTime:TIMESTAMP, errorDetail:STRING, isResolved:BOOLEAN, serviceInstance:STRING>>`
`classification`	`STRING`
`deletedDateTime`	`TIMESTAMP`
`infoCatalogs`	`ARRAY<STRING>`
`preferredDataLocation`	`STRING`
`preferredLanguage`	`STRING`
`resourceBehaviorOptions`	`ARRAY<STRING>`
`theme`	`STRING`
`uniqueName`	`STRING`
`assignedLicenses`	`ARRAY<STRUCT<disabledPlans:ARRAY<STRING>, skuId:STRING>>`
`isManagementRestricted`	`BOOLEAN`
`licenseProcessingState`	`STRUCT<state:STRING>`
`onPremisesExtensionAttributes`	`STRUCT<extensionAttribute1:STRING, extensionAttribute10:STRING, extensionAttribute11:STRING, extensionAttribute12:STRING, extensionAttribute13:STRING, extensionAttribute14:STRING, extensionAttribute15:STRING, extensionAttribute2:STRING, extensionAttribute3:STRING, extensionAttribute4:STRING, extensionAttribute5:STRING, extensionAttribute6:STRING, extensionAttribute7:STRING, extensionAttribute8:STRING, extensionAttribute9:STRING>`

`group_members`

Primary key: group_id, id

Sync mode: Full refresh only

Field	Data type
`group_id`	`STRING`
`id`	`STRING`
`displayName`	`STRING`
`userPrincipalName`	`STRING`
`mail`	`STRING`
`givenName`	`STRING`
`surname`	`STRING`
`businessPhones`	`ARRAY<STRING>`
`@odata.type`	`STRING`
`deletedDateTime`	`TIMESTAMP`

`group_owner`

Primary key: group_id, id

Sync mode: Full refresh only

Field	Data type
`group_id`	`STRING`
`id`	`STRING`
`displayName`	`STRING`
`userPrincipalName`	`STRING`
`@odata.type`	`STRING`
`deletedDateTime`	`TIMESTAMP`

`applications`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`appId`	`STRING`
`displayName`	`STRING`
`description`	`STRING`
`signInAudience`	`STRING`
`publisherDomain`	`STRING`
`createdDateTime`	`TIMESTAMP`
`createdByAppId`	`STRING`
`isDisabled`	`BOOLEAN`
`disabledByMicrosoftStatus`	`STRING`
`isFallbackPublicClient`	`BOOLEAN`
`defaultRedirectUri`	`STRING`
`applicationTemplateId`	`STRING`
`identifierUris`	`ARRAY<STRING>`
`tags`	`ARRAY<STRING>`
`requiredResourceAccess`	`ARRAY<STRUCT<resourceAccess:ARRAY<STRUCT<id:STRING, type:STRING>>, resourceAppId:STRING>>`
`passwordCredentials`	`ARRAY<STRUCT<customKeyIdentifier:STRING, displayName:STRING, endDateTime:TIMESTAMP, hint:STRING, keyId:STRING, startDateTime:TIMESTAMP>>`
`keyCredentials`	`ARRAY<STRUCT<customKeyIdentifier:STRING, displayName:STRING, endDateTime:TIMESTAMP, key:STRING, keyId:STRING, startDateTime:TIMESTAMP, type:STRING, usage:STRING>>`
`web`	`STRUCT<homePageUrl:STRING, implicitGrantSettings:STRUCT<enableAccessTokenIssuance:BOOLEAN, enableIdTokenIssuance:BOOLEAN>, logoutUrl:STRING, redirectUriSettings:ARRAY<STRUCT<index:BIGINT, uri:STRING>>, redirectUris:ARRAY<STRING>>`
`api`	`STRUCT<acceptMappedClaims:BOOLEAN, knownClientApplications:ARRAY<STRING>, oauth2PermissionScopes:ARRAY<STRUCT<adminConsentDescription:STRING, adminConsentDisplayName:STRING, id:STRING, isEnabled:BOOLEAN, origin:STRING, type:STRING, userConsentDescription:STRING, userConsentDisplayName:STRING, value:STRING>>, preAuthorizedApplications:ARRAY<STRUCT<appId:STRING, delegatedPermissionIds:ARRAY<STRING>>>, requestedAccessTokenVersion:BIGINT>`
`servicePrincipalLockConfiguration`	`STRUCT<allProperties:BOOLEAN, credentialsWithUsageSign:BOOLEAN, credentialsWithUsageVerify:BOOLEAN, identifierUris:BOOLEAN, isEnabled:BOOLEAN, tokenEncryptionKeyId:BOOLEAN>`
`addIns`	`ARRAY<STRUCT<id:STRING, properties:ARRAY<STRUCT<key:STRING, value:STRING>>, type:STRING>>`
`appRoles`	`ARRAY<STRUCT<allowedMemberTypes:ARRAY<STRING>, description:STRING, displayName:STRING, id:STRING, isEnabled:BOOLEAN, origin:STRING, value:STRING>>`
`certification`	`STRUCT<certificationDetailsUrl:STRING, certificationExpirationDateTime:TIMESTAMP, isCertifiedByMicrosoft:BOOLEAN, isPublisherAttested:BOOLEAN, lastCertificationDateTime:TIMESTAMP>`
`deletedDateTime`	`TIMESTAMP`
`groupMembershipClaims`	`STRING`
`info`	`STRUCT<logoUrl:STRING, marketingUrl:STRING, privacyStatementUrl:STRING, supportUrl:STRING, termsOfServiceUrl:STRING>`
`isDeviceOnlyAuthSupported`	`BOOLEAN`
`nativeAuthenticationApisEnabled`	`STRING`
`notes`	`STRING`
`optionalClaims`	`STRUCT<accessToken:ARRAY<STRUCT<additionalProperties:ARRAY<STRING>, essential:BOOLEAN, name:STRING, source:STRING>>, idToken:ARRAY<STRUCT<additionalProperties:ARRAY<STRING>, essential:BOOLEAN, name:STRING, source:STRING>>, saml2Token:ARRAY<STRUCT<additionalProperties:ARRAY<STRING>, essential:BOOLEAN, name:STRING, source:STRING>>>`
`parentalControlSettings`	`STRUCT<countriesBlockedForMinors:ARRAY<STRING>, legalAgeGroupRule:STRING>`
`publicClient`	`STRUCT<redirectUris:ARRAY<STRING>>`
`requestSignatureVerification`	`STRUCT<allowedWeakAlgorithms:STRING, isSignedRequestRequired:BOOLEAN>`
`samlMetadataUrl`	`STRING`
`serviceManagementReference`	`STRING`
`spa`	`STRUCT<redirectUris:ARRAY<STRING>>`
`tokenEncryptionKeyId`	`STRING`
`uniqueName`	`STRING`
`verifiedPublisher`	`STRUCT<addedDateTime:TIMESTAMP, displayName:STRING, verifiedPublisherId:STRING>`
`managerApplications`	`ARRAY<STRING>`
`authenticationBehaviors`	`STRUCT<blockAzureADGraphAccess:BOOLEAN, coopEnforcement:BOOLEAN, removeUnverifiedEmailClaim:BOOLEAN, requireClientServicePrincipal:BOOLEAN>`

`serviceprincipals`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`appId`	`STRING`
`displayName`	`STRING`
`appDisplayName`	`STRING`
`servicePrincipalType`	`STRING`
`accountEnabled`	`BOOLEAN`
`appOwnerOrganizationId`	`STRING`
`appRoleAssignmentRequired`	`BOOLEAN`
`signInAudience`	`STRING`
`disabledByMicrosoftStatus`	`STRING`
`preferredSingleSignOnMode`	`STRING`
`servicePrincipalNames`	`ARRAY<STRING>`
`replyUrls`	`ARRAY<STRING>`
`alternativeNames`	`ARRAY<STRING>`
`tags`	`ARRAY<STRING>`
`appRoles`	`ARRAY<STRUCT<allowedMemberTypes:ARRAY<STRING>, description:STRING, displayName:STRING, id:STRING, isEnabled:BOOLEAN, origin:STRING, value:STRING>>`
`createdDateTime`	`TIMESTAMP`
`oauth2PermissionScopes`	`ARRAY<STRUCT<adminConsentDescription:STRING, adminConsentDisplayName:STRING, id:STRING, isEnabled:BOOLEAN, origin:STRING, type:STRING, userConsentDescription:STRING, userConsentDisplayName:STRING, value:STRING>>`
`verifiedPublisher`	`STRUCT<addedDateTime:TIMESTAMP, displayName:STRING, verifiedPublisherId:STRING>`
`keyCredentials`	`ARRAY<STRUCT<customKeyIdentifier:STRING, displayName:STRING, endDateTime:TIMESTAMP, key:STRING, keyId:STRING, startDateTime:TIMESTAMP, type:STRING, usage:STRING>>`
`passwordCredentials`	`ARRAY<STRUCT<customKeyIdentifier:STRING, displayName:STRING, endDateTime:TIMESTAMP, hint:STRING, keyId:STRING, startDateTime:TIMESTAMP>>`
`resourceSpecificApplicationPermissions`	`ARRAY<STRUCT<description:STRING, displayName:STRING, id:STRING, isEnabled:BOOLEAN, value:STRING>>`
`notificationEmailAddresses`	`ARRAY<STRING>`
`logoutUrl`	`STRING`
`applicationTemplateId`	`STRING`
`createdByAppId`	`STRING`
`description`	`STRING`
`addIns`	`ARRAY<STRUCT<id:STRING, properties:ARRAY<STRUCT<key:STRING, value:STRING>>, type:STRING>>`
`appDescription`	`STRING`
`deletedDateTime`	`TIMESTAMP`
`homepage`	`STRING`
`info`	`STRUCT<logoUrl:STRING, marketingUrl:STRING, privacyStatementUrl:STRING, supportUrl:STRING, termsOfServiceUrl:STRING>`
`isDisabled`	`BOOLEAN`
`loginUrl`	`STRING`
`notes`	`STRING`
`preferredTokenSigningKeyThumbprint`	`STRING`
`samlSingleSignOnSettings`	`STRUCT<relayState:STRING>`
`tokenEncryptionKeyId`	`STRING`
`customSecurityAttributes`	`VARIANT`

Note

This table does not support SCD type 2 because it has VARIANT columns.

`directoryroles`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`displayName`	`STRING`
`description`	`STRING`
`roleTemplateId`	`STRING`
`deletedDateTime`	`TIMESTAMP`

`directory_role_member`

Primary key: role_id, id

Sync mode: Full refresh only

Field	Data type
`role_id`	`STRING`
`id`	`STRING`
`displayName`	`STRING`
`userPrincipalName`	`STRING`
`@odata.type`	`STRING`
`mail`	`STRING`
`givenName`	`STRING`
`surname`	`STRING`
`businessPhones`	`ARRAY<STRING>`
`deletedDateTime`	`TIMESTAMP`

`directoryroletemplates`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`displayName`	`STRING`
`description`	`STRING`
`deletedDateTime`	`TIMESTAMP`

`directoryaudits`

Primary key: id

Cursor field: activityDateTime

Field	Data type
`id`	`STRING`
`activityDateTime`	`TIMESTAMP`
`activityDisplayName`	`STRING`
`category`	`STRING`
`correlationId`	`STRING`
`loggedByService`	`STRING`
`operationType`	`STRING`
`result`	`STRING`
`resultReason`	`STRING`
`initiatedBy`	`STRUCT<app:STRUCT<appId:STRING, displayName:STRING, servicePrincipalId:STRING, servicePrincipalName:STRING>, user:STRUCT<agentType:STRING, displayName:STRING, homeTenantId:STRING, homeTenantName:STRING, id:STRING, ipAddress:STRING, userPrincipalName:STRING, userType:STRING>>`
`targetResources`	`ARRAY<STRUCT<displayName:STRING, groupType:STRING, id:STRING, modifiedProperties:ARRAY<STRUCT<displayName:STRING, newValue:STRING, oldValue:STRING>>, type:STRING, userPrincipalName:STRING>>`
`additionalDetails`	`ARRAY<STRUCT<key:STRING, value:STRING>>`

`signins`

Primary key: id

Cursor field: createdDateTime

Field	Data type
`id`	`STRING`
`createdDateTime`	`TIMESTAMP`
`userDisplayName`	`STRING`
`userPrincipalName`	`STRING`
`userId`	`STRING`
`appId`	`STRING`
`appDisplayName`	`STRING`
`ipAddress`	`STRING`
`clientAppUsed`	`STRING`
`correlationId`	`STRING`
`conditionalAccessStatus`	`STRING`
`isInteractive`	`BOOLEAN`
`resourceDisplayName`	`STRING`
`resourceId`	`STRING`
`status`	`STRUCT<additionalDetails:STRING, errorCode:BIGINT, failureReason:STRING>`
`location`	`STRUCT<city:STRING, countryOrRegion:STRING, geoCoordinates:STRUCT<altitude:DOUBLE, latitude:DOUBLE, longitude:DOUBLE>, state:STRING>`
`deviceDetail`	`STRUCT<browser:STRING, deviceId:STRING, displayName:STRING, isCompliant:BOOLEAN, isManaged:BOOLEAN, operatingSystem:STRING, trustType:STRING>`
`authenticationAppDeviceDetails`	`STRUCT<appVersion:STRING, clientApp:STRING, deviceId:STRING, operatingSystem:STRING>`
`appliedConditionalAccessPolicies`	`ARRAY<STRUCT<displayName:STRING, enforcedGrantControls:ARRAY<STRING>, enforcedSessionControls:ARRAY<STRING>, id:STRING, result:STRING>>`
`riskDetail`	`STRING`
`riskLevelAggregated`	`STRING`
`riskLevelDuringSignIn`	`STRING`
`riskState`	`STRING`
`riskEventTypes`	`ARRAY<STRING>`
`userAgent`	`STRING`
`homeTenantId`	`STRING`
`resourceTenantId`	`STRING`
`servicePrincipalId`	`STRING`
`riskEventTypes_v2`	`ARRAY<STRING>`
`servicePrincipalName`	`STRING`
`_observed_at`	`TIMESTAMP`

`user_registration_detail`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`userPrincipalName`	`STRING`
`userDisplayName`	`STRING`
`userType`	`STRING`
`isAdmin`	`BOOLEAN`
`isSsprRegistered`	`BOOLEAN`
`isSsprEnabled`	`BOOLEAN`
`isSsprCapable`	`BOOLEAN`
`isMfaRegistered`	`BOOLEAN`
`isMfaCapable`	`BOOLEAN`
`isPasswordlessCapable`	`BOOLEAN`
`isSystemPreferredAuthenticationMethodEnabled`	`BOOLEAN`
`userPreferredMethodForSecondaryAuthentication`	`STRING`
`lastUpdatedDateTime`	`TIMESTAMP`
`methodsRegistered`	`ARRAY<STRING>`
`systemPreferredAuthenticationMethods`	`ARRAY<STRING>`

`identityproviders`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`displayName`	`STRING`
`identityProviderType`	`STRING`
`@odata.type`	`STRING`

`adminconsentrequestpolicy`

Primary key: policy_id

Sync mode: Full refresh only

Field	Data type
`policy_id`	`STRING`
`isEnabled`	`BOOLEAN`
`notifyReviewers`	`BOOLEAN`
`remindersEnabled`	`BOOLEAN`
`requestDurationInDays`	`BIGINT`
`version`	`BIGINT`
`reviewers`	`ARRAY<STRUCT<query:STRING, queryRoot:STRING, queryType:STRING, reviewerId:STRING, scopeType:STRING>>`

`role_eligibility_schedule`

Primary key: id

Sync mode: Full refresh only

Field	Data type
`id`	`STRING`
`principalId`	`STRING`
`roleDefinitionId`	`STRING`
`directoryScopeId`	`STRING`
`appScopeId`	`STRING`
`createdUsing`	`STRING`
`createdDateTime`	`TIMESTAMP`
`modifiedDateTime`	`TIMESTAMP`
`status`	`STRING`
`memberType`	`STRING`
`scheduleInfo`	`STRUCT<expiration:STRUCT<duration:STRING, endDateTime:TIMESTAMP, type:STRING>, recurrence:STRUCT<pattern:STRUCT<dayOfMonth:INT, daysOfWeek:ARRAY<STRING>, firstDayOfWeek:STRING, index:STRING, interval:INT, month:INT, type:STRING>, range:STRUCT<endDate:DATE, numberOfOccurrences:INT, recurrenceTimeZone:STRING, startDate:DATE, type:STRING>>, startDateTime:TIMESTAMP>`

Required OAuth permissions

Grant the following Microsoft Graph application permissions to the Microsoft Entra ID app registration, then grant admin consent. See Microsoft Graph permissions reference.

Permission	Required for
`User.Read.All`	`users`
`AuditLog.Read.All`	`directoryaudits`, `signins`, `user_registration_detail`, and the `signInActivity` column of `users`
`CustomSecAttributeAssignment.Read.All`	The `customSecurityAttributes` column of `users` and `serviceprincipals`
`Group.Read.All`	`groups`
`GroupMember.Read.All`	`group_members`, `group_owner`
`Application.Read.All`	`applications`, `serviceprincipals`
`RoleManagement.Read.Directory`	`directoryroles`, `directory_role_member`, `directoryroletemplates`
`RoleEligibilitySchedule.Read.Directory`	`role_eligibility_schedule`
`IdentityProvider.Read.All`	`identityproviders`
`Policy.Read.All`	`adminconsentrequestpolicy`, and the `appliedConditionalAccessPolicies` column of `signins`

Feedback

Was this page helpful?

Last updated on 2026-10-22

Microsoft Entra ID connector reference

Supported source tables

Connector options

Destination table schemas

users

groups

group_members

group_owner

applications

serviceprincipals

directoryroles

directory_role_member

directoryroletemplates

directoryaudits

signins

user_registration_detail

identityproviders

adminconsentrequestpolicy

role_eligibility_schedule

Required OAuth permissions

Feedback

Additional resources

`users`

`groups`

`group_members`

`group_owner`

`applications`

`serviceprincipals`

`directoryroles`

`directory_role_member`

`directoryroletemplates`

`directoryaudits`

`signins`

`user_registration_detail`

`identityproviders`

`adminconsentrequestpolicy`

`role_eligibility_schedule`