How contact sources are defined
Entra ID group configuration.
Enterprise Contacts uses Entra ID security groups as its configuration layer. Two group types are involved: one config group that names your prefix, and one source group per contact source.
The configuration group
Create a single security group named exactly App_EnterpriseContacts_Config in your Entra ID tenant. The app looks for this group to read your chosen group prefix.
Group name must match exactly: use App_EnterpriseContacts_Config. The lookup is not case-sensitive, but the expected group name is exactly this. The config group does not need any members — its description is all that matters.
Set the group Description to this JSON, replacing Your_Prefix_Here_ with your chosen prefix:
{"groupPrefix":"Your_Prefix_Here_"}
Example — if your organisation is Contoso and you want prefix EC_Contoso_:
{"groupPrefix":"EC_Contoso_"}
Source group name format
Each contact source visible in the app is backed by one Entra ID security group. The group name must start with your chosen prefix:
Name: {YourPrefix}{SourceLabel}
Example: EC_Contoso_CompanyContacts
Group description fields
The group description must be a valid JSON object. The web admin writes this for you — only hand-edit if creating groups manually in the Azure portal.
| Field | Type | Values | Description |
|---|
name | string | Any | Display name shown in the app. Required. |
description | string | Any | Short subtitle shown when adding the source manually. |
autoLoad | boolean | true / false | true = added automatically on first launch. false = only via the + button. |
deleteable | boolean | true / false | true = user can remove the source from the app. |
type | integer | 0, 1, 2 | 0 = Exchange mailbox, 1 = Entra ID group, 2 = My Contacts. Required. |
primaryId | string | See reference | Mailbox UPN for type 0, Object ID (GUID) for type 1, and me for type 2. Required. |
secondaryId | string | Folder ID | Type 0 only. Exchange contact folder ID. |
Type 0 — Exchange shared mailbox
Syncs contacts from a shared Exchange mailbox contact folder. Good for curated company address books.
Name: EC_Contoso_SharedMailbox
Description:
{
"name": "Shared Mailbox",
"description": "Reception desk contacts",
"autoLoad": false,
"deleteable": true,
"type": 0,
"primaryId": "reception@contoso.com",
"secondaryId": "<exchange-folder-id>"
}
Mailbox read access required. Enterprise Contacts uses delegated permissions — it can only read what the signed-in user is already allowed to access. For type 0, each user must have at least Reviewer permission on the relevant contact folder in Exchange. Grant access via Exchange Admin Center or PowerShell: Add-MailboxFolderPermission.
Type 1 — Entra ID security group
Syncs the profile contact card for each group member. Good for department or team directories.
Type 1 uses two separate Entra ID groups:
- Access group — the group you create with your prefix (e.g.
EC_Contoso_CompanyContacts). Members control who can see this source. This group carries the config JSON in its description. - Contact group — an existing Entra ID group whose members become the synced contacts. Its Object ID goes in
primaryId.
These are two different groups. A user in the access group sees the source. The contacts they see are the members of the contact group.
── Group 1 — Access group (you create this) ──
Name: EC_Contoso_CompanyContacts
Members: Sales Team, HR Team, ...
Description:
{
"name": "Company Contacts",
"description": "All company contacts",
"autoLoad": true,
"deleteable": false,
"type": 1,
"primaryId": "7e2d4f1a-9b3c-5e6d-7f8a-1b2c3d4e5f6a"
}
── Group 2 — Contact group (existing or new) ──
Name: All-Employees
Object ID: 7e2d4f1a-9b3c-5e6d-7f8a-1b2c3d4e5f6a ← goes in primaryId
Type 2 — Personal Exchange contacts
Syncs the signed-in user's own personal Exchange contacts folder.
Name: EC_Contoso_MyContacts
Description:
{
"name": "My Contacts",
"description": "Personal Exchange contacts",
"autoLoad": true,
"deleteable": true,
"type": 2,
"primaryId": "me"
}
primaryId reference by type
| Type | primaryId value | secondaryId |
|---|
| 0 — Mailbox | User UPN, e.g. john@contoso.com | Exchange folder ID (required) |
| 1 — Entra ID group | Object ID (GUID) of the contact source group — the group whose members become contacts. Not the access group itself. | Not used — omit |
| 2 — My Contacts | Always me. This tells the app to use the signed-in user's own contacts folder. | Not used — omit |
Limitations
Hybrid Exchange is not supported. On-premises (hybrid) Exchange mailboxes are not reachable through Microsoft Graph and cannot be used as contact sources. Entra ID group sources (type 1) work regardless of your Exchange configuration.