What is Microsoft Entra ID?

Microsoft Entra ID is Microsoft's cloud identity and access management service, known as Azure Active Directory until 2023. It stores user accounts, groups and credentials, signs people in to Microsoft 365, Azure and connected applications, and manages the joiner, mover and leaver lifecycle around them.

Does Key2XS replace Entra ID?

No. Key2XS is middleware. Entra ID remains your identity platform and each key system remains your locking system. Key2XS carries decisions from the first to the second and writes the result back.

Which key systems can Entra ID govern through Key2XS?

iLOQ S5 and S50, ASSA ABLOY eCLIQ, PROTEC2 CLIQ, CLIQ Remote and ABLOY PULSE. A single Entra ID group can span several of them at once, and Key2XS is certified by ASSA ABLOY for its locking system integrations.

We synchronize on-premises Active Directory to Entra ID. Does that work?

Yes. Key2XS reads identities and group memberships from Entra ID, so users synchronized from on-premises Active Directory through Microsoft Entra Connect are handled like any other Entra ID identity.

What happens to physical keys when a user is disabled in Entra ID?

Key2XS withdraws the person's key rights in real-time as part of the same flow, across every connected key system. Physical and digital access are revoked together, and the revocation is logged.

What does the integration require inside our tenant?

An application registration with the permissions Key2XS needs on Microsoft Graph, authenticated with OAuth 2.0. There is no agent to deploy and no schema extension to install.

How long does implementation take?

A standard integration is live in under two hours. Key2XS connects to Entra ID and to the key systems through pre-built connectors, so no custom development is required.

Is this suitable for NIS2 and CER compliance?

Yes. Both directives require governed, auditable control over physical access to premises. Key2XS provides the policy enforcement and audit trail that connects the Entra ID lifecycle to physical keys.

Microsoft Entra ID Integration | Physical Access Governance

What Microsoft Entra ID is

Microsoft Entra ID is Microsoft's cloud identity and access management service, renamed from Azure Active Directory in 2023. It holds the accounts, credentials and group memberships that sign people in to Microsoft 365, Azure and the SaaS applications connected to it through single sign-on. For organizations already standardized on Microsoft, it is the default place where identity lives.

The parts that matter for access decisions:

Users and security groups. The working currency of access. Membership is maintained by IT, by dynamic membership rules, or by an HR-driven provisioning flow.
App roles and entitlement management. Access packages bundle what a person needs, with a requester, an approver and an expiry date.
Lifecycle workflows and access reviews. Joiner, mover and leaver events, plus periodic recertification of who still needs what.
Conditional Access. Policy evaluated at sign-in against user, device, location and risk.
Microsoft Entra Connect. Synchronization from on-premises Active Directory, so hybrid estates still present one identity.
Microsoft Graph. The programmable surface over all of it, including change notifications that fire the moment something changes.

Entra ID is deliberately broad on the digital side. What it does not have is a way to reach a mechanical or electronic key.

Where the Entra ID lifecycle stops

Accounts are created when people join, group memberships change when they move, and everything is disabled the moment they leave. That lifecycle governs mail, files and applications reliably. Physical keys sit outside it: the person who blocks a leaver in Entra ID is usually not the person who manages the key cabinet, and the two actions rarely happen on the same day.

Leavers whose account is blocked but whose keys still open every door
Contractors with long-expired engagements holding active keys
Role changes that update application access but not building access
No single place to answer “who can physically enter this location, and why”

For critical entities under NIS2 and the CER Directive, that gap between digital and physical access is exactly what regulators expect you to close.

How Key2XS connects to Entra ID

Key2XS registers as an application against your Entra ID tenant and subscribes to change notifications on the objects that matter. There is no agent to deploy in your tenant and no schema extension to install.

ProtocolMicrosoft Graph API with Graph webhook subscriptions

AuthenticationOAuth 2.0 (MSAL)

DirectionBidirectional: identities in, provisioning status back

SynchronizationReal-time, driven by Graph change notifications

Connect, map, orchestrate, prove

Connect. Key2XS connects to your Entra ID tenant over Microsoft Graph and to each key system over its own API. A standard integration is live in under two hours, with no custom development.
Map. Entra ID groups, roles and access packages are mapped to key rights and lock groups. A security group like “Facilities, Technical Rooms” can correspond to exactly those doors and cylinders, in the same way it would grant an application role.
Orchestrate. When a user is added to or removed from a mapped group, or their account is disabled, Key2XS applies the change to their key rights in real-time. Blocking a leaver in Entra ID withdraws their physical access in the same movement.
Prove. Every key right traces back to an identity, a group and a moment in time, in one tamper-evident audit trail.

What moves between Microsoft Entra ID and Key2XS

From Microsoft Entra ID	To your key systems via Key2XS
Users (joiners, movers, leavers)	Key holders created, updated or deactivated
Group, role and access package membership	Key rights and access to lock groups
Account disablement and expiration	Immediate withdrawal of key rights
Assignment history	Documented authorization behind every key

One source of truth, every key system

The point of connecting Entra ID to Key2XS is not a single lock brand. Entra ID becomes the one place where physical access is decided, and Key2XS carries that decision to whichever key systems your sites actually run. Most organizations have more than one: a digital locking system at the head office, electronic keys on the network, mechanical high-security cylinders on the perimeter.

Key system under governance	How Key2XS drives it
iLOQ S5 and S50 Self-powered digital cylinders (S5) and Bluetooth/NFC phone keys (S50).	REST API. Key holders, key rights and key validity provisioned per person, with 29 independent sync operations.
ASSA ABLOY eCLIQ Electronic cylinders, padlocks and programmable keys.	SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch.
ASSA ABLOY PROTEC² CLIQ High-security locking combining rotating disc technology with electronic identification.	SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch.
ASSA ABLOY CLIQ Remote Remote key updates through wall programmers, desktop units or the CLIQ Connect Bluetooth app, so keys never have to come back to a desk.	SOAP API through CLIQ Web Manager, secured with mutual TLS. Validity windows refreshed in the field.
ABLOY PULSE Self-sustaining locks that harvest their energy from key insertion. No batteries, no wiring.	SOAP API through CLIQ Web Manager, secured with mutual TLS. Full lifecycle, event-driven and batch.

Key2XS is certified by ASSA ABLOY for its locking system integrations. One mapping in Entra ID can therefore span brands: a single role or group grants the iLOQ cylinders in one building and the eCLIQ padlocks on a remote site, revoked together the moment Entra ID says so.

The same holds on the identity side. Key2XS also connects to SailPoint Identity Security Cloud, Okta, One Identity Manager and OpenText Identity Manager, and to any system that can speak SCIM 2.0, so a landscape with more than one identity platform still resolves to one physical access model. See the integrations overview for the full picture.

Built for critical environments

Key2XS is used where physical access affects public safety, service continuity or regulatory compliance: utilities, government, transport, healthcare and industry.

NIS2 and CER ready. A continuous, tamper-evident audit trail links every physical access right to an identity and a policy decision.
Built for continuity. The Key2XS platform is engineered for 99.99% availability, matching the uptime expectations of critical infrastructure operations.
Security by design. Traffic between Key2XS, Entra ID and every connected key system is encrypted in transit with TLS 1.3, and data at rest is protected with AES-256.
Non-disruptive. Key2XS orchestrates rights through each system's own management interface. Your Entra ID configuration stays as it is, and so do your locking plans, locks and keys.

Why not build this on Graph yourself?

Microsoft Graph is well documented and the key systems have APIs too, so a custom integration is technically possible. In practice it means owning connector code against several evolving APIs at once, building your own audit layer, handling every edge case in the joiner-mover-leaver flow, and maintaining it for years while it quietly becomes critical infrastructure. Key2XS delivers this as a maintained platform:

Live in under 2 hours. A standard Entra ID integration is up and running in under two hours, not weeks or months
Maintained connectors that absorb API changes on the identity side and on every key system
Purpose-built audit and reporting for physical access governance
Certified by ASSA ABLOY for its locking system integrations, and a certified SailPoint Technology Alliance Partner on the IAM side
One platform across identity platforms and key system brands, so your architecture is not locked to a single vendor pairing

Microsoft Entra ID and Key2XS: one lifecycle, every key system