Skip to main content

Managing Microsoft Entra Credentials

Use the openit_idpconnectorconsole utility to manage Microsoft Entra credentials for data collection.

Open iT saves the credential file, idpconnector.db, in the OpeniT directory, which is by default in C:\ProgramData\OpeniT in Windows and /var/tmp/OpeniT in Unix.

You can:

Requirements​

  • An Open iT Core Client connected to an Open iT Core Server or a coexistent Open iT Core setup
  • Microsoft Entra ID Credentials:
    • Tenant ID – The directory (tenant) identifier from Microsoft Entra ID
    • Client ID – The application (client) ID from your Entra app registration
    • Client Secret – The secret generated for the app (store securely)

Add and Verify a Microsoft Entra Credential​

Follow these steps to configure and validate a credential.

Step 1: Open Command Prompt​

  1. Open a command prompt with Administrator level privileges.

Step 2: Navigate to the bin Directory​

  1. Go to the bin directory, which is by default in C:\Program Files\OpeniT\Core\bin, run the command:

    Command Syntax
    cd <bin_dir>
    Example
    cd C:\Program Files\OpeniT\Core\bin

Step 3: Add Microsoft Entra Credentials​

  1. Run the following command:

    Command Syntax
    openit_idpconnectorconsole azure credential add

  2. Enter the required details when prompted:

    • Tenant ID
    • Client ID
    • Client Secret
    Example
    Tenant ID: a1b2c3d4-5678-90ab-cdef-1234567890ab
    Client ID: 9f8e7d6c-5b4a-3210-fedc-ba0987654321
    Client Secret: V~*************************************************

Step 4: (Optional) Add Multiple Microsoft Entra Accounts​

If you need to collect HR roster data from multiple Microsoft Entra accounts, use the --name parameter:

Command Syntax
openit_idpconnectorconsole azure credential add --name <name>

where <name> is the name of the account you want to use for data collection.

Example
openit_idpconnectorconsole azure credential add --name azure1

Step 5: Verify the Credentials​

  1. Verify the default credential:

    Example
    openit_idpconnectorconsole azure credential verify

  2. Verify a named credential:

    Example
    openit_idpconnectorconsole azure credential verify --name <name>

    where <name> is the name of the account you want to verify.

  3. Confirm that the output indicates a successful connection:

    Sample Output
    Connection verified successfully. Access token acquired, expires on 2026-04-13 08:53:22 +00:00.
    Connection verified successfully.
note

Open iT saves the credential file, idpconnector.db, in the OpeniT directory, which is by default in C:\ProgramData\OpeniT. When using the --name parameter, Open iT appends the credentials to the same file, allowing multiple accounts to be managed within a single location.

Additional Credential Management​

Update a Credential​

Step 1: Open Command Prompt​

  1. Open a command prompt with Administrator level privileges.

Step 2: Navigate to the bin Directory​

  1. Go to the bin directory, which is by default in C:\Program Files\OpeniT\Core\bin, run the command:

    Command Syntax
    cd <bin_dir>
    Example
    cd C:\Program Files\OpeniT\Core\bin

Step 3: Update Microsoft Entra Credentials​

  1. Run the following command:

    Command Syntax
    openit_idpconnectorconsole azure credential update

    For named credentials:

    Command Syntax
    openit_idpconnectorconsole azure credential update --name <name>

Delete a Credential​

Step 1: Open Command Prompt​

  1. Open a command prompt with Administrator level privileges.

Step 2: Navigate to the bin Directory​

  1. Go to the bin directory, which is by default in C:\Program Files\OpeniT\Core\bin, run the command:

    Command Syntax
    cd <bin_dir>
    Example
    cd C:\Program Files\OpeniT\Core\bin

Step 3: Delete Microsoft Entra Credentials​

  1. Run the following command:

    Command Syntax
    openit_idpconnectorconsole azure credential delete

    For named credentials:

    Command Syntax
    openit_idpconnectorconsole azure credential delete --name <name>
note

The --name parameter applies to all actions (add, update, delete, verify). If not specified, the default credential, <default>, is used.