Skip to main content

Graph Service Principal (Guest Invitation)

Administrator

When an Entra ID user is added to DataCentral but is not recognised in your Azure tenant, DataCentral can automatically invite them as a guest. This requires a Graph Service Principal with permission to send invitations.

Optionally, once the guest user is invited, DataCentral can also place them into a specified Entra ID security group.

1. Register an Application in Entra ID​

  1. Log in to the Azure portal.
  2. Navigate to Microsoft Entra ID > App registrations.
  3. Click New registration.
  4. Provide a name (e.g., DataCentral Guest Invitations) and click Register.
  5. Copy the Application (client) ID and Directory (tenant) ID from the Overview tab.
  6. Go to Certificates & secrets, click New client secret, and copy the Value immediately.

2. Configure API Permissions​

  1. In the App Registration, go to API permissions.
  2. Click Add a permission > Microsoft Graph > Application permissions.
  3. Add the following permissions:
    • User.Invite.All
    • User.Read.All
  4. Click Grant admin consent for your organisation.

3. Configure DataCentral​

  1. Navigate to Administration > Settings > Azure Configurations.
  2. Enter the following credentials from your App Registration:
    • Tenant ID
    • Client ID
    • Client Secret
  3. Click Save.

Once configured, DataCentral will use this service principal to invite unrecognised users as guests to your tenant when they are added in DataCentral.