Microsoft Entra ID (formerly Azure Active Directory) Setup

1. Register an application in the Entra ID (formerly Azure) Portal

Be sure to replace $YOUR_QUIQ_TENANT with your tenant name.

2. Create a Client Secret by navigating to "Certificates & secrets" and choosing “New client secret”

1. Input whatever you like in the Description field and for Expires choose Never.

2. Note to copy the secret value now and put it into a local file. This is the last chance to read it! But you can always create another.

3. Work with your Quiq implementation specialist to securely share the client secret value, the client secret ID, the Application (client) ID, and your Entra tenant name.

• Application ID is in the Essentials section of the Overview

• Client secret will be in the Client Secrets list under Certificates & secrets

• Use these instructions for finding your tenant name: https://docs.microsoft.com/en-us/partner-center/find-ids-and-domain-names

3. Configure API permissions

Quiq uses delegated Microsoft Graph permissions only. Quiq never accesses your directory without a signed-in user present, and only ever reads the profile of the user who is currently logging in. No application (app-only) permissions are required, and Quiq requests no write permissions of any kind.

1. In your app registration, select API permissions.
2. Add the following Microsoft Graph delegated permissions:

   Permission	Type	Admin consent required	Needed for
   openid	Delegated	Not by default	All SSO logins
   User.Read	Delegated	Not by default	All SSO logins
   User.ReadBasic.All	Delegated	No — see note below	Group to role mapping only
   GroupMember.Read.All	Delegated	Yes	Group to role mapping only

3. Select Grant admin consent for <your directory> after adding the
   permissions.

   📘

   Who has to consent to what. openid and User.Read are normally consentable
   by each user at first sign-in, unless your directory disallows user consent. The
   two group-mapping permissions must be granted by an administrator — including
   User.ReadBasic.All, which the Entra portal lists as not requiring admin
   consent — because Quiq requests only openid and User.Read when an agent signs
   in, so users are never shown a consent prompt covering the group-mapping
   permissions. When in doubt, grant admin consent for all four: it is always safe
   and avoids per-user consent prompts.

Directory.Read.All can be granted instead of User.ReadBasic.All +
GroupMember.Read.All, but it allows considerably broader read access to your
directory. Quiq recommends the two narrower permissions.

What Quiq calls

For security review, these are the only Microsoft endpoints Quiq contacts:

Given name and surname become the agent's first and last name in Quiq; the user principal name (or the alternate username property, if configured) becomes the agent's username.

When an alternate username property is configured, Quiq restricts the /me request to a fixed field list — the fields above plus job title, which Quiq ignores. Otherwise the request is unfiltered and Microsoft Graph returns its default profile set, which includes additional fields such as job title, business phone, mobile phone, office location, and preferred language. Quiq ignores those fields — they are neither stored nor displayed.

The group membership call is made with securityEnabledOnly: false, so the response covers all group types and directory roles the user belongs to, transitively — not only security groups. Quiq compares the returned IDs against your configured mapping and ignores everything else.

Quiq uses the OAuth 2.0 authorization code grant as a confidential client authenticated with the client secret. The scopes requested at sign-in are openid User.Read. Quiq's Entra ID integration is OAuth 2.0 / OpenID Connect based; SAML is not supported. Quiq establishes the agent's identity by calling Microsoft Graph /me with the access token, rather than by reading claims from an id_token.

The access token is used only during the login exchange and is discarded once the agent's identity is established. Quiq does not store Microsoft Graph access tokens, and because offline_access is never requested, Entra ID never issues Quiq a refresh token. Quiq therefore cannot call Microsoft Graph outside of an active agent login.

4. Configure which users will have access to Quiq

1. If you have users in your Entra ID (formerly Azure AD) that you do NOT want to have access to Quiq then proceed with these steps. If all users will be allowed to access Quiq then you can skip.

2. In Azure Portal search for Enterprise Applications

3. Select the Quiq AD Integration you created earlier.

4. Under Properties change User assignment required? to Yes and save.

5. Under Users and groups assign the appropriate users and groups to have access to Quiq.

5. Configure role mapping

1. Quiq supports an Entra ID (formerly Azure AD) group to Quiq role mapping. Work with your implementation specialist to provide a mapping from Entra ID group to Quiq role and permission.

2. Note that the mapping only applies to the first time the user logs in. If permissions change later in Azure AD they are not reflected in Quiq. The changes must be made manually in the Quiq Admin interface.

3. Example mapping:

a. Azure AD Group ID, Quiq Role, Quiq Permission
   5de9ec64-08ed-442a-ad4f-dbd6eb710a84, bpoTeam1Support, agent
   4de9ec64-08ed-442a-ad4f-dbd6eb710a85, bpoTeam2Support, agent
   3de9ec64-08ed-442a-ad4f-dbd6eb710a86, bpoManagers, manager
   2de9ec64-08ed-442a-ad4f-dbd6eb710a87, csAdmins, admin