Vault Authentication Module Not Syncing Groups or Members

Problem

The Vault authentication module is not syncing groups or members when using Microsoft Entra ID as the primary authentication method.

Cause

The sync error could be caused by missing application permissions or revoked/expired admin consent in the Microsoft Entra ID application.

Resolution

1. Navigate to the appropriate App Registration in Azure.

2. Go to API Permissions and confirm that the following Microsoft Graph Application permissions are configured:

   • User.Read.All
   • Group.Read.All
   • GroupMember.Read.All

3. Click Grant admin consent for your tenant.

4. Return to IDE Services and click Try again.

For additional guidance, see refer to the Azure AD authentication module documentation.