Skip to main content
Microsoft Graph (SAM) connects Triggr to each client’s tenant as an app the client’s administrator consents to, with no partner relationship, for users, groups, licences, SharePoint and OneDrive, mail and directory settings. To work through partner relationships instead, use GDAP or CIPP. Each client needs a Global Administrator or Privileged Role Administrator to grant admin consent.

​
Register your own app

Skip this to use Triggr’s app, whose details come pre-filled in Triggr. Register your own to choose its permissions and manage its secret; you need an account that can register apps, such as a Cloud Application Administrator.
1

Register a multitenant app

In the Microsoft Entra admin centre, go to Entra ID > App registrations > New registration, choose Multiple Entra ID tenants (older versions: Accounts in any organizational directory), click Register and copy the Application (client) ID.
2

Add Triggr's redirect URI

Under Authentication, click Add Redirect URI (or Add a platform), choose Web, enter https://app.triggr-app.com/oauth/admin-consent-callback and click Configure.
3

Create a client secret

Under Certificates & secrets > Client secrets, click New client secret and copy its Value, not its Secret ID. Every client uses this secret, so note when it expires: Triggr can’t sign in to any client’s tenant until you replace it.
4

Add application permissions

Go to API permissions > Add a permission > Microsoft Graph > Application permissions and add what your workflows need from the table below. Skip Grant admin consent here; each client consents from Triggr.

​
Microsoft Graph permissions

Add these only if your workflows use them: Mail.Read (reading mail), Sites.Read.All (SharePoint sites, drives and lists), Files.ReadWrite.All (creating and sharing folders), RoleManagement.ReadWrite.Directory (directory roles), and Application.ReadWrite.All with AppRoleAssignment.ReadWrite.All (applications, service principals and app role assignments). If you add permissions later, each client must grant admin consent again.

​
Connect it in Triggr

1

Open the integration

Go to Integrations > Microsoft Graph (SAM) and click Configure on the Base Configuration card.
The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.
2

Enter your app and tenant

Keep the pre-filled ClientID and ClientSecret or enter your app’s, enter your own tenant ID in TenantID (or use Lookup By Domain) and click Save Configuration. There’s no Authorize step, and Admin Consent on this card consents in your own tenant only, for workflows that run without a client.
The Microsoft Graph (SAM) configuration window with ClientID and ClientSecret already filled in (blurred), an empty TenantID field, a Lookup By Domain link, an Allow insecure TLS switch under Advanced, and a Save Configuration button.

​
Connect each client

Per-client integrations never fall back to the Base Configuration, so each client needs its own tenant ID and admin consent.
The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button.
1

Add the client's tenant ID

Click Configure on the client’s row, enter its TenantID (or use Lookup By Domain) and click Save Configuration. Triggr saves it as the client’s microsoftTenantId variable. For many clients, click Automap, then Approve All.
2

Grant admin consent

Click Admin Consent on the client’s row and have an administrator of the client’s tenant sign in and click Accept. The Admin Consent column shows Granted.
To reset passwords, the app also needs at least User Administrator in the client’s tenant, and a more privileged role to change or delete admin accounts. Assign it to the app’s enterprise application there. See Microsoft’s Who can perform sensitive actions.

​
Make SAM your default Microsoft connection

In Settings > Org Variables, click Setup Wizard and choose Individual Enterprise Apps under Preferred Microsoft Connection Method. For one step only, set its Connection Type to Microsoft Graph (SAM).
The Setup Wizard's Preferred Microsoft Connection Method question with three cards: CIPP, GDAP and Individual Enterprise Apps, the last one selected.

​
Troubleshooting

Steps report is not configured for tenant or no Microsoft Graph (SAM) integration is configured for this client. Add the client’s tenant ID, or use Automap.
Check the client’s administrator granted consent and its TenantID is its own. With your own app, check ClientSecret is the secret’s Value and hasn’t expired.
Add the missing permission and click Admin Consent for the client again. For password resets or admin accounts, check the app’s role in that tenant.
Enter a domain verified in the client’s tenant, such as its .onmicrosoft.com domain, or paste the Tenant ID from Entra ID > Overview in that tenant.