--- title: Microsoft Entra ID Integration | Physical Access Governance | Key2XS description: What Microsoft Entra ID is, and how Key2XS extends its groups and lifecycle to iLOQ, ASSA ABLOY CLIQ and ABLOY PULSE keys, with an audit trail for NIS2 and CER. image: https://key2xs.com/hubfs/img/og-image.png --- [![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=en) Why Governance? [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) [CER Directive](https://key2xs.com/cer-directive?hsLang=en) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) Industries [Government](https://key2xs.com/sectors/government?hsLang=en) [Utilities](https://key2xs.com/sectors/utilities?hsLang=en) [Water management](https://key2xs.com/sectors/water-management?hsLang=en) [Transport](https://key2xs.com/sectors/transport?hsLang=en) [Telecom](https://key2xs.com/sectors/telecom?hsLang=en) Platform [Product](https://key2xs.com/products?hsLang=en) [How it works](https://key2xs.com/?hsLang=en#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) Partners Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=en) [One Identity](https://key2xs.com/partners/one-identity?hsLang=en) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=en) [Okta](https://key2xs.com/partners/okta?hsLang=en) [OpenText](https://key2xs.com/partners/opentext?hsLang=en) [iLOQ](https://key2xs.com/partners/iloq?hsLang=en) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=en) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=en) Resources [Resource center](https://key2xs.com/resources?hsLang=en) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) [Events](https://key2xs.com/events?hsLang=en) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=en) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=en) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) [FAQ](https://key2xs.com/?hsLang=en#faq) [News](https://key2xs.com/news-archive?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Home](https://key2xs.com?hsLang=en) > Identity platforms # Microsoft Entra ID and Key2XS: one lifecycle, every key system Microsoft Entra ID is the identity platform behind Microsoft 365 and Azure, and for most organizations it is already the system that decides who is allowed what. Key2XS extends that decision to the physical estate, so the groups you maintain in Entra ID govern iLOQ cylinders, ASSA ABLOY CLIQ keys and ABLOY PULSE locks as well as applications. [Request a demo](https://key2xs.com/contact?hsLang=en) ## What Microsoft Entra ID is Microsoft Entra ID is Microsoft's cloud identity and access management service, renamed from Azure Active Directory in 2023. It holds the accounts, credentials and group memberships that sign people in to Microsoft 365, Azure and the SaaS applications connected to it through single sign-on. For organizations already standardized on Microsoft, it is the default place where identity lives. The parts that matter for access decisions: - **Users and security groups.** The working currency of access. Membership is maintained by IT, by dynamic membership rules, or by an HR-driven provisioning flow. - **App roles and entitlement management.** Access packages bundle what a person needs, with a requester, an approver and an expiry date. - **Lifecycle workflows and access reviews.** Joiner, mover and leaver events, plus periodic recertification of who still needs what. - **Conditional Access.** Policy evaluated at sign-in against user, device, location and risk. - **Microsoft Entra Connect.** Synchronization from on-premises Active Directory, so hybrid estates still present one identity. - **Microsoft Graph.** The programmable surface over all of it, including change notifications that fire the moment something changes. Entra ID is deliberately broad on the digital side. What it does not have is a way to reach a mechanical or electronic key. ## Where the Entra ID lifecycle stops Accounts are created when people join, group memberships change when they move, and everything is disabled the moment they leave. That lifecycle governs mail, files and applications reliably. Physical keys sit outside it: the person who blocks a leaver in Entra ID is usually not the person who manages the key cabinet, and the two actions rarely happen on the same day. - Leavers whose account is blocked but whose keys still open every door - Contractors with long-expired engagements holding active keys - Role changes that update application access but not building access - No single place to answer “who can physically enter this location, and why” For critical entities under [NIS2](https://key2xs.com/nis2-directive?hsLang=en) and the [CER Directive](https://key2xs.com/cer-directive?hsLang=en), that gap between digital and physical access is exactly what regulators expect you to close. ## How Key2XS connects to Entra ID Key2XS registers as an application against your Entra ID tenant and subscribes to change notifications on the objects that matter. There is no agent to deploy in your tenant and no schema extension to install. ProtocolMicrosoft Graph API with Graph webhook subscriptions AuthenticationOAuth 2.0 (MSAL) DirectionBidirectional: identities in, provisioning status back SynchronizationReal-time, driven by Graph change notifications ### Connect, map, orchestrate, prove 1. **Connect.** Key2XS connects to your Entra ID tenant over Microsoft Graph and to each key system over its own API. A standard integration is live in under two hours, with no custom development. 2. **Map.** Entra ID groups, roles and access packages are mapped to key rights and lock groups. A security group like “Facilities, Technical Rooms” can correspond to exactly those doors and cylinders, in the same way it would grant an application role. 3. **Orchestrate.** When a user is added to or removed from a mapped group, or their account is disabled, Key2XS applies the change to their key rights in real-time. Blocking a leaver in Entra ID withdraws their physical access in the same movement. 4. **Prove.** Every key right traces back to an identity, a group and a moment in time, in one tamper-evident audit trail. ### What moves between Microsoft Entra ID and Key2XS | From Microsoft Entra ID | To your key systems via Key2XS | | --- | --- | | Users (joiners, movers, leavers) | Key holders created, updated or deactivated | | Group, role and access package membership | Key rights and access to lock groups | | Account disablement and expiration | Immediate withdrawal of key rights | | Assignment history | Documented authorization behind every key | ## One source of truth, every key system The point of connecting Entra ID to Key2XS is not a single lock brand. Entra ID becomes the one place where physical access is decided, and Key2XS carries that decision to whichever key systems your sites actually run. Most organizations have more than one: a digital locking system at the head office, electronic keys on the network, mechanical high-security cylinders on the perimeter. | Key system under governance | How Key2XS drives it | | --- | --- | | **iLOQ S5 and S50** Self-powered digital cylinders (S5) and Bluetooth/NFC phone keys (S50). | REST API. Key holders, key rights and key validity provisioned per person, with 29 independent sync operations. | | **ASSA ABLOY eCLIQ** Electronic cylinders, padlocks and programmable keys. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | | **ASSA ABLOY PROTEC2 CLIQ** High-security locking combining rotating disc technology with electronic identification. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | | **ASSA ABLOY CLIQ Remote** Remote key updates through wall programmers, desktop units or the CLIQ Connect Bluetooth app, so keys never have to come back to a desk. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Validity windows refreshed in the field. | | **ABLOY PULSE** Self-sustaining locks that harvest their energy from key insertion. No batteries, no wiring. | SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch. | Key2XS is **certified by ASSA ABLOY** for its locking system integrations. One mapping in Entra ID can therefore span brands: a single role or group grants the iLOQ cylinders in one building and the eCLIQ padlocks on a remote site, revoked together the moment Entra ID says so. The same holds on the identity side. Key2XS also connects to SailPoint Identity Security Cloud, Okta, One Identity Manager and OpenText Identity Manager, and to any system that can speak SCIM 2.0, so a landscape with more than one identity platform still resolves to one physical access model. See the [integrations overview](https://key2xs.com/integrations?hsLang=en) for the full picture. ## Built for critical environments Key2XS is used where physical access affects public safety, service continuity or regulatory compliance: utilities, government, transport, healthcare and industry. - **NIS2 and CER ready.** A continuous, tamper-evident audit trail links every physical access right to an identity and a policy decision. - **Built for continuity.** The Key2XS platform is engineered for 99.99% availability, matching the uptime expectations of critical infrastructure operations. - **Security by design.** Traffic between Key2XS, Entra ID and every connected key system is encrypted in transit with TLS 1.3, and data at rest is protected with AES-256. - **Non-disruptive.** Key2XS orchestrates rights through each system's own management interface. Your Entra ID configuration stays as it is, and so do your locking plans, locks and keys. ## Why not build this on Graph yourself? Microsoft Graph is well documented and the key systems have APIs too, so a custom integration is technically possible. In practice it means owning connector code against several evolving APIs at once, building your own audit layer, handling every edge case in the joiner-mover-leaver flow, and maintaining it for years while it quietly becomes critical infrastructure. Key2XS delivers this as a maintained platform: - **Live in under 2 hours.** A standard Entra ID integration is up and running in under two hours, not weeks or months - Maintained connectors that absorb API changes on the identity side and on every key system - Purpose-built audit and reporting for physical access governance - Certified by ASSA ABLOY for its locking system integrations, and a certified SailPoint Technology Alliance Partner on the IAM side - One platform across identity platforms and key system brands, so your architecture is not locked to a single vendor pairing ## Frequently asked questions Microsoft Entra ID and Key2XS, answered. What is Microsoft Entra ID? Microsoft Entra ID is Microsoft's cloud identity and access management service, known as Azure Active Directory until 2023. It stores user accounts, groups and credentials, signs people in to Microsoft 365, Azure and connected applications, and manages the joiner, mover and leaver lifecycle around them. Does Key2XS replace Entra ID? No. Key2XS is middleware. Entra ID remains your identity platform and each key system remains your locking system. Key2XS carries decisions from the first to the second and writes the result back. Which key systems can Entra ID govern through Key2XS? iLOQ S5 and S50, ASSA ABLOY eCLIQ, PROTEC2 CLIQ, CLIQ Remote and ABLOY PULSE. A single Entra ID group can span several of them at once, and Key2XS is certified by ASSA ABLOY for its locking system integrations. We synchronize on-premises Active Directory to Entra ID. Does that work? Yes. Key2XS reads identities and group memberships from Entra ID, so users synchronized from on-premises Active Directory through Microsoft Entra Connect are handled like any other Entra ID identity. What happens to physical keys when a user is disabled in Entra ID? Key2XS withdraws the person's key rights in real-time as part of the same flow, across every connected key system. Physical and digital access are revoked together, and the revocation is logged. What does the integration require inside our tenant? An application registration with the permissions Key2XS needs on Microsoft Graph, authenticated with OAuth 2.0. There is no agent to deploy and no schema extension to install. How long does implementation take? A standard integration is live in under two hours. Key2XS connects to Entra ID and to the key systems through pre-built connectors, so no custom development is required. Is this suitable for NIS2 and CER compliance? Yes. Both directives require governed, auditable control over physical access to premises. Key2XS provides the policy enforcement and audit trail that connects the Entra ID lifecycle to physical keys. ## See Entra ID governing your keys Get a guided walkthrough of how groups, lifecycle events and physical keys come together in one auditable flow. [Request a demo](https://key2xs.com/contact?hsLang=en) [See all integrations](https://key2xs.com/integrations?hsLang=en) ### Contact us [Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag) Kraanspoor 50, 1033 SE Amsterdam, The Netherlands [info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180) ### Platform - [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) - [Product](https://key2xs.com/products?hsLang=en) - [Integrations](https://key2xs.com/integrations?hsLang=en) - [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) ### Compliance - [CER Directive](https://key2xs.com/cer-directive?hsLang=en) - [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) - [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) ### Company - [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=en) - [Resource center](https://key2xs.com/resources?hsLang=en) - [Events](https://key2xs.com/events?hsLang=en) - [News](https://key2xs.com/news-archive?hsLang=en) - [Contact](https://key2xs.com/contact?hsLang=en) [![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=en) --- ![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) Key2XS, pronounced “key to access” © 2026 Key2XS B.V. All rights reserved [Privacy](https://key2xs.com/privacy-statement?hsLang=en) Cookie Preferences Patent Pending Nr: 2040721 & 2041284 Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V. ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Microsoft Entra ID is Microsoft's cloud identity and access management service, known as Azure Active Directory until 2023. It stores user accounts, groups and credentials, signs people in to Microsoft 365, Azure and connected applications, and manages the joiner, mover and leaver lifecycle around them." }, "name" : "What is Microsoft Entra ID?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Key2XS is middleware. Entra ID remains your identity platform and each key system remains your locking system. Key2XS carries decisions from the first to the second and writes the result back." }, "name" : "Does Key2XS replace Entra ID?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "iLOQ S5 and S50, ASSA ABLOY eCLIQ, PROTEC2 CLIQ, CLIQ Remote and ABLOY PULSE. A single Entra ID group can span several of them at once, and Key2XS is certified by ASSA ABLOY for its locking system integrations." }, "name" : "Which key systems can Entra ID govern through Key2XS?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Key2XS reads identities and group memberships from Entra ID, so users synchronized from on-premises Active Directory through Microsoft Entra Connect are handled like any other Entra ID identity." }, "name" : "We synchronize on-premises Active Directory to Entra ID. Does that work?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Key2XS withdraws the person's key rights in real-time as part of the same flow, across every connected key system. Physical and digital access are revoked together, and the revocation is logged." }, "name" : "What happens to physical keys when a user is disabled in Entra ID?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "An application registration with the permissions Key2XS needs on Microsoft Graph, authenticated with OAuth 2.0. There is no agent to deploy and no schema extension to install." }, "name" : "What does the integration require inside our tenant?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A standard integration is live in under two hours. Key2XS connects to Entra ID and to the key systems through pre-built connectors, so no custom development is required." }, "name" : "How long does implementation take?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Both directives require governed, auditable control over physical access to premises. Key2XS provides the policy enforcement and audit trail that connects the Entra ID lifecycle to physical keys." }, "name" : "Is this suitable for NIS2 and CER compliance?" } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://key2xs.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://key2xs.com/integrations", "name" : "Integrations", "position" : 2 }, { "@type" : "ListItem", "name" : "Microsoft Entra ID", "position" : 3 } ] } ```