---
title: "Orleans.Lattice.Membership.Entra.Graph configuration"
url: "https://nsta1.github.io/Orleans.Lattice/docs/lattice.membership.entra.graph/configuration.html"
source: "https://github.com/NSTA1/Orleans.Lattice/blob/release/9.9/docs/lattice.membership.entra.graph/configuration.md"
package: "Orleans.Lattice.Membership.Entra.Graph"
version: "9.9.0"
documents: "Orleans.Lattice 9.9.0 (release line 9.9)"
built: "2026-10-04"
all-pages: "https://nsta1.github.io/Orleans.Lattice/llms.txt"
bundle: "https://nsta1.github.io/Orleans.Lattice/docs/lattice.membership.entra.graph/llms-full.txt"
---
# Orleans.Lattice.Membership.Entra.Graph configuration

Part of the [Membership.Entra.Graph documentation](README.md).

The package has one public options type, `LatticeEntraGraphOptions`, which configures the Microsoft Graph-backed group resolver: the Entra application credentials it authenticates with, the Graph scopes it requests, and how it shapes the transitive-group query. It is bound by the `AddEntraGraphGroupResolver` registration extension. The app-only access token is acquired and refreshed transparently, so operators never manage a Graph token directly.

Two mutually exclusive authentication modes are supported. By default the resolver uses the confidential-client path, authenticating app-only with the `TenantId`, `ClientId`, and `ClientSecret` triple. Alternatively, supplying a `Credential` selects a secret-less path where the resolver authenticates app-only with that token credential (for example a federated managed identity) and no client secret is used. Supplying both a `Credential` and a `ClientSecret` is rejected as ambiguous.

## `LatticeEntraGraphOptions`

Bind it through `AddEntraGraphGroupResolver(configure)`. The registration validates the options immediately, before it registers anything, and throws `OptionsValidationException` listing every violation: no authentication mode, or an incomplete one (a `ClientSecret` without `TenantId` or `ClientId`), a `Credential` combined with a `ClientSecret`, an empty `Scopes` list or a blank scope, or a negative `TokenRefreshSkew`.

### Constants

| Constant | Type | Value | Meaning |
|---|---|---|---|
| `DefaultAuthorityHost` | `string` | `"https://login.microsoftonline.com"` | The default Entra login host used to build the token authority. |
| `DefaultScope` | `string` | `"https://graph.microsoft.com/.default"` | The default Graph scope for app-only access. |

### Properties

| Property | Type | Default | Meaning |
|---|---|---|---|
| `TenantId` | `string` | `""` (empty) | The tenant id the app-only Graph token is issued for. Required for the confidential-client (client-secret) path; ignored when `Credential` is set. |
| `ClientId` | `string` | `""` (empty) | The Entra application (client) id used to acquire the Graph token. Required for the confidential-client path; ignored when `Credential` is set. |
| `ClientSecret` | `string` | `""` (empty) | The Entra application client secret used to acquire the Graph token. Required for the confidential-client path; must be left unset when `Credential` is used. |
| `Credential` | `TokenCredential?` | `null` | An optional Azure token credential that selects the secret-less authentication path. When set, the resolver authenticates app-only with this credential (for example `DefaultAzureCredential` or a `ManagedIdentityCredential`) and no `ClientSecret` is used. Mutually exclusive with the client-secret path. `null` selects the confidential-client path. |
| `AuthorityHost` | `string` | `DefaultAuthorityHost` | The Entra login host, combined with `TenantId` to form the MSAL authority. Used only on the confidential-client path. |
| `Scopes` | `IList<string>` | `["https://graph.microsoft.com/.default"]` (the single `DefaultScope`) | The Graph scopes requested for the app-only token, on either authentication path. Must contain at least one scope, and no null or empty entry. Populate the collection in place. |
| `SecurityEnabledOnly` | `bool` | `false` | Whether the transitive-group query returns only security-enabled groups. `false` returns all groups and directory roles. |
| `TokenRefreshSkew` | `TimeSpan` | `5 minutes` | How long before the token's actual expiry it is proactively refreshed, so a call never uses a token that expires mid-flight. Must not be negative. Applies to the confidential-client path; with `Credential` set, token lifetime is left to that credential. |
| `DirectorySubjectIdSource` | `EntraDirectorySubjectIdSource` | `ObjectId` | Which Entra identifier the Graph-backed identity directory records as a directory principal id, so directory validation matches the active authenticator's subject claim. `ObjectId` (the `oid`) aligns with a typical Entra deployment whose subject claim resolves to the object id; `UserPrincipalName` records a user's user principal name instead (a group always records its object id, and so does a user that has no user principal name). |

### Methods

| Method | Returns | Meaning |
|---|---|---|
| `ResolveAuthority()` | `string` | The MSAL authority, `AuthorityHost` joined to `TenantId`; an empty string when either is missing. |