AZURE + MICROSOFT GRAPH + ENTRA ID
Connecting established enterprise systems to the modern Microsoft cloud.
A secure integration pattern using Azure serverless processing, Blob Storage, Microsoft Graph and Entra ID to automate the movement of trusted business information into cloud identity services.
INTEGRATION ARCHITECTUREBusiness System → Azure → Entra ID
01ExportStructured data
02ProcessAzure Function
03SecureManaged Identity
04UpdateMicrosoft Graph
The challenge
Keep the business system. Modernise the integration.
The organisation maintained employee-related information within an established enterprise application while cloud identity was managed in Microsoft Entra ID.
The requirement was to securely move selected authoritative information from the business environment into Entra ID without embedding cloud credentials in the source application or forcing a large application replacement project.
The design principle
Established applications can participate in modern cloud processes.
Azure provides the secure integration layer between proven business applications and Microsoft's cloud identity platform.
The architecture
A clear separation of business data, cloud processing and identity updates.
Each component has a defined responsibility, creating an integration pattern that is easier to secure, support and extend.
HCL Domino→Azure Blob Storage→Azure Function→Microsoft Graph→Microsoft Entra ID
Enterprise application
The established business system remains the source of relevant employee information and exports structured data for cloud processing.
Azure Blob Storage
A controlled exchange point separates the originating system from downstream Azure processing and provides Azure-native access controls.
Azure Function
Serverless processing validates incoming information, identifies the target user and prepares the required cloud update.
Microsoft Graph & Entra ID
Microsoft Graph provides the governed API layer used to update approved identity attributes in Entra ID.
Secure by design
Enterprise integration without hard-coded credentials.
Security is built into the integration pattern rather than added after the connection works.
Managed Identity
Azure resources can authenticate using their own managed identity rather than stored usernames, passwords or long-lived application secrets.
Role-based access
Azure Storage access is governed through defined roles and least-privilege permissions.
Microsoft Graph permissions
Identity updates use explicitly approved Graph permissions with administrative consent and governance.
Restricted cloud storage
Public access can remain disabled while authorised Azure components communicate using controlled identities.
Private integration path
The architecture supports further hardening through private endpoints and virtual network integration where required.
Traceable processing
Cloud processing can be logged and monitored, providing operational visibility across integration activity.
Production engineering
The details that turn a connection into an enterprise integration.
Building a dependable cloud bridge required work across permissions, authentication, storage configuration, Microsoft Graph, data validation and error handling.
Storage permissions
Role assignments and Azure Storage controls were configured so integration data could be accessed without opening the storage account publicly.
Graph authorisation
Microsoft Graph permissions and administrative consent were aligned with the identity updates the integration needed to perform.
User matching & validation
The cloud processing layer identifies the correct user, validates incoming data and applies only the intended update.
Why this pattern matters
Progressive modernisation instead of forced replacement.
The architecture gives established applications a secure path into Microsoft cloud services while preserving proven business logic and reducing migration risk.
- Employee lifecycle automation
- Identity attribute synchronisation
- Microsoft 365 provisioning scenarios
- Cloud reporting and data exchange
- Integration with additional business systems
- Reusable Azure serverless processing
- Controlled API-based automation
- Future private networking and monitoring
Business outcomes
A secure bridge between established systems and cloud identity.
The result is a reusable integration approach that extends the life and value of existing applications while enabling modern Microsoft cloud processes.
Authoritative business information can automatically maintain selected cloud identity attributes.
Automated integration reduces differences between business-system information and Entra ID.
Managed Identity reduces reliance on embedded application credentials.
Existing applications can participate in cloud workflows without being replaced.
The pattern can be expanded to new attributes, systems and Azure services.
Azure Functions provide a lightweight cloud processing layer without a dedicated application server.
Cloud identity changes are performed through explicit, governed API permissions.
The design supports private endpoints, VNet integration, centralised logging and additional hardening.