MeCard × Microsoft Entra ID
Microsoft sign-in & OAuth 2.0
Understand secure Microsoft login, IT approval and approved employee information updates.
What connects to what?
1. Employee Microsoft sign-in
OAuth 2.0 is used for the authorization-code exchange. OpenID Connect (OIDC) adds the verified identity token. MeCard uses the authorization-code flow with PKCE, state and nonce. A matching email alone cannot link an unauthorized Microsoft user to a MeCard account.
2. Employee data and group verification
Employee information sync is separate from sign-in. The approved server connection uses OAuth 2.0 client credentials to obtain a Microsoft Graph access token. MeCard reads approved employee attributes and direct membership of selected Security Groups.
A Microsoft Security Group answers who is eligible. MeCard profile/role groups determine which cards, roles, markets and languages each approved employee receives.
3. What permissions are requested?
| Purpose | Typical approved Graph application permission |
|---|---|
| Employee attributes | User.Read.All |
| Direct Security Group membership | GroupMember.ReadBasic.All or an existing approved GroupMember.Read.All |
| Optional group-name discovery | Group.ReadBasic.All or another approved supported read permission |
| Optional profile photos | ProfilePhoto.Read.All when separately approved |
Microsoft IT reviews the actual Microsoft app permissions before consent. MeCard does not need broad directory write permissions for the documented flow. Client secrets stay in protected server configuration, not in a customer-facing page.
4. What stays under your control?
- Company Admin: eligible employees, account/card allocation, login method, profile fields, preview/approval and translation reviews.
- Microsoft IT: tenant/application configuration, consent, approved groups and source attributes.
- Employees: access only their linked MeCard account and assigned digital cards.
Is legacy MS AD Sync needed?
No. Microsoft Integration is the separate feature used for SSO and approved employee-data synchronization.
Will every card be changed automatically?
No. Updates require approved sources, selected destinations and publication approval. Missing Microsoft values are not treated as instructions to erase existing card text.
Can one Microsoft employee have multiple digital cards?
Yes. One verified Microsoft identity can be assigned multiple MeCard profiles for different roles, markets and languages. See the attributes guide.
Official Microsoft references: OAuth authorization code + PKCE · OIDC · Graph application access.
