<\/div>\n\n\n\n
Create an App Registration in Microsoft Entra ID<\/strong><\/p>\n\n\n\n\nLog in to the Microsoft Entra Admin Center<\/strong>.<\/li>\n\n\n\nGo to App registrations<\/strong> and click New registration<\/strong>.<\/li>\n\n\n\nType a name for the application and click Register<\/strong>.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t\nCopy the Application (client) ID<\/strong> \u2014 you will need it in WatchGuard Cloud configuration.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\tUpdate the Manifest<\/strong><\/p>\n\n\n\n\nOpen Manifest<\/strong>.<\/li>\n\n\n\nSelect the Microsoft Graph App Manifest<\/strong> tab.<\/li>\n\n\n\nSet isFallbackPublicClient<\/strong> to true<\/strong>.<\/li>\n\n\n\nClick Save<\/strong>.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Add API Permissions<\/strong><\/p>\n\n\n\n\nGo to API permissions<\/strong> \u2192 Add a permission<\/strong>.<\/li>\n\n\n\nSelect Microsoft Graph<\/strong>.<\/li>\n\n\n\nAdd these permissions:\n\nDelegated permissions<\/strong>\n\nUser.Read<\/li>\n\n\n\n Device.Read.All<\/li>\n<\/ul>\n<\/li>\n\n\n\n Application permissions<\/strong>\n\nGroup.Read.All<\/li>\n\n\n\n User.Read.All<\/li>\n\n\n\n Directory.ReadWrite.All<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n Click Grant admin consent<\/strong>.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Enable Public Client Flow<\/strong><\/p>\n\n\n\n\nGo to Authentication<\/strong> \u2192 Settings<\/strong>.<\/li>\n\n\n\nMake sure Allow public client flows<\/strong> is enabled<\/strong>.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\tCreate a Client Secret<\/strong><\/p>\n\n\n\n\nGo to Certificates & secrets<\/strong>. Click New client secret<\/strong>.<\/li>\n\n\n\nAdd a description and choose when it expires. Click Add<\/strong>.<\/li>\n\n\n\nCopy the Value<\/strong> of the client secret \u2014 you need this in WatchGuard Cloud configuration.<\/li>\n\n\n\n\u26a0 Important:<\/strong> You cannot view and copy the secret value later. If you lose it, you must create a new one.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Add Entra ID in WatchGuard Cloud<\/strong><\/p>\n\n\n\n\nIn WatchGuard Cloud, go to Configure \u2192 Directories and Domain Services<\/strong>.<\/li>\n\n\n\nClick Add Authentication Domain<\/strong>.<\/li>\n\n\n\nChoose External Directory<\/strong> \u2192 Entra ID<\/strong>.<\/li>\n\n\n\nEnter your Entra ID domain name<\/strong>.<\/li>\n\n\n\nPaste the Application ID<\/strong> and Client Secret Value<\/strong> from Entra ID.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Start Directory Sync<\/strong><\/p>\n\n\n\n\nOpen the Entra ID domain you created.<\/li>\n\n\n\n Go to Directory Sync<\/strong>.<\/li>\n\n\n\nClick Configure Sync Directory<\/strong>.<\/li>\n\n\n\nChoose a sync interval and click Save<\/strong>.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t\nAfter a short time, you should see Users<\/strong> and Groups<\/strong> from Entra ID.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Add Entra ID as an External Identity in AuthPoint<\/strong><\/p>\n\n\n\n\nIn AuthPoint, go to External Identities<\/strong>.<\/li>\n\n\n\nClick Add External Identity<\/strong>.<\/li>\n\n\n\nSelect Directories and Domain Services<\/strong>.<\/li>\n\n\n\nEnter a Name<\/strong> and choose your Entra ID domain<\/strong><\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\tSync Users and Groups<\/strong><\/p>\n\n\n\n\nIn Sync Users and Groups<\/strong>, click Add Group Sync<\/strong>.<\/li>\n\n\n\nChoose a Group<\/strong> from Entra ID.<\/li>\n\n\n\nSet User Type<\/strong> to MFA user<\/strong>.<\/li>\n\n\n\nIf you do\u00a0not<\/strong>\u00a0want AuthPoint to automatically create mobile tokens or send activation emails, clear those checkboxes.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
\nUsers in that Entra ID group should now appear in the AuthPoint Users<\/strong> list.<\/li>\n<\/ul>\n\n\n\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n
\n
\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
If you see users in Directories and Domain Services<\/strong> but not<\/strong> in AuthPoint Users<\/strong>, check the user in Entra ID. All three must be filled in:<\/p>\n\n\n\n\nUser Name<\/li>\n\n\n\n First Name<\/li>\n\n\n\n Email<\/li>\n<\/ul>\n\n\n\n<\/div>\n\n\n\n
If you left the default Automatically create a mobile token for this user<\/strong> enabled the user also receives email messages to activate a token in the AuthPoint mobile app.Automatically create a mobile token for this user<\/strong>, go to the AuthPoint Users <\/strong>list choose the user and click the three dots menu and select Add New Token<\/strong>.\n
\n\t\t\t\n\t\t\t\t
![\"\"](\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/06\/AuthPoint-UserTypes-1.png\")