Microsoft 365

This integration connects ZombieLicenseHunter to Microsoft Entra ID (formerly Azure Active Directory) and Microsoft 365. It syncs user accounts, license assignments, and sign-in activity so you can identify inactive users and reclaim unused licenses.

Prerequisites

• An active Microsoft 365 / Azure subscription
• Access to the Azure Portal with permission to create App Registrations
• A Global Administrator or Privileged Role Administrator to grant admin consent for API permissions

Setup Instructions

Step 1: Create an Azure App Registration

1. Sign in to the Azure Portal.
2. Navigate to Microsoft Entra ID > App registrations > New registration.
3. Give the application a name (e.g., ZombieLicenseHunter).
4. Under Supported account types, select Accounts in this organizational directory only.
5. Leave the Redirect URI blank — this integration uses server-to-server auth with no user redirect.
6. Click Register.
7. On the Overview page, copy and save:
   • Application (client) ID
   • Directory (tenant) ID

Step 2: Configure API Permissions

1. In your App Registration, go to API permissions > Add a permission.

2. Select Microsoft Graph > Application permissions.

3. Add the following three permissions:

   Permission	Purpose
   User.Read.All	Read user accounts, status, and license assignments
   Directory.Read.All	Read group memberships and org structure
   AuditLog.Read.All	Read sign-in activity for zombie detection

4. Click Grant admin consent for [your organization] and confirm. This step requires a Global Admin or Privileged Role Admin.

All three permissions are Application type (not Delegated). If you do not see the "Grant admin consent" button, contact your Azure administrator.

Step 3: Create a Client Secret

1. In your App Registration, go to Certificates & secrets > New client secret.
2. Add a description (e.g., ZombieLicenseHunter) and choose an expiration period.
3. Click Add, then immediately copy the Value — it will not be shown again.

Important: Client secrets expire. Note the expiration date and plan to rotate the secret before it expires; once it has expired, every sync fails with an authentication error until you enter a new secret on the integration's edit page.

Step 4: Connect in ZombieLicenseHunter

1. In ZombieLicenseHunter, go to Integrations → Add Integration and select Microsoft Entra ID. Set Category to Directory.
2. The Authentication Method shows Service Principal; it is the only method offered.
3. Enter the three values collected above:
   • Azure Tenant ID — the Directory (tenant) ID from the App Registration Overview
   • Client ID — the Application (client) ID from the App Registration Overview
   • Client Secret — the value copied in Step 3
4. Click Save Integration. ZombieLicenseHunter requests a token from Microsoft with these values to validate them, then encrypts and stores them.
5. A background job verifies connectivity by calling the Microsoft Graph API, then begins syncing users and license data.

What Gets Synced

Troubleshooting

"Insufficient privileges" or 403 error on first sync Admin consent was not granted, or was granted before all three permissions were added. Re-add any missing permissions and click Grant admin consent again.

"Invalid client secret" error The client secret may have expired or been copied incorrectly. Generate a new secret in Azure Portal (Certificates & secrets) and update the credentials in ZombieLicenseHunter.

No sign-in data appearing AuditLog.Read.All is required for sign-in timestamps. Confirm it is listed under API permissions with a green admin-consent checkmark.

Users appear but licenses are missing Verify User.Read.All has admin consent. Also confirm the users have licenses assigned in the Microsoft 365 Admin Center — unassigned users will show no license data.

Tenant ID not recognized Ensure you are using the Directory (tenant) ID (a UUID), not your .onmicrosoft.com domain name.