How multiple Microsoft credentials, the default credential, and tenant ID work on a connector

How do multiple Microsoft credentials, the default credential, and tenant ID work on a connector?

A Microsoft connector can hold more than one credential. A credential is a client ID and secret, or a certificate, for an Azure app registration. This lets you register a new credential on the connector and rotate to it without disconnecting users who are already authenticated.

Add new vs. Set as default

• Add new: registers (or updates) another credential on the same Microsoft connector.

• Set as default: points the connector's

  active_credential_id

  at that credential.

The default credential only affects new grants. When a grant is created and it doesn't specify its own credential, it inherits the connector's active (default) credential.

What happens to existing grants

Every grant that is already connected has its own credential ID stored. Because that value is already set, changing the connector's default does not re-point existing grants.

This means that adding a new credential or changing the default is safe for accounts that are already connected:

• Existing grants keep using the credential they authenticated with.
• They only move to a different credential when the user re-authenticates.

If you need a specific grant to use a particular credential, you can pass that credential explicitly when you create the grant. For hosted authentication, include credential_id in the Hosted OAuth authorization request. An explicit credential always takes precedence over the connector's default.

Rotating a credential safely

1. Add the new credential to the Microsoft connector.
2. Set it as the default so new grants use it going forward.
3. Leave existing grants as they are. They continue to work with the credential they authenticated with.
4. Users move to the new credential only when they re-authenticate.

Tenant ID

The tenant ID ties a Microsoft credential to one specific Azure AD (Microsoft Entra ID) organization. Set it when you want:

• Single-tenant authentication: only accounts from that Azure directory can authorize.
• Scoped admin consent: an admin approves your app for that tenant, and you can restrict exactly which permissions are granted.

Please contact support if you have any more questions!