Microsoft Graph Authz

The Microsoft Graph Authz plugin uses Microsoft Graph to look up group membership information from Microsoft Entra ID.

This is primarily intended to work around the Microsoft Entra ID maximum group size limit (see Group overages).

This plugin can be installed using the plugin manager:

sudo bin/elasticsearch-plugin install microsoft-graph-authz

The plugin must be installed on every node in the cluster, and each node must be restarted after installation.

You can also download this plugin for offline install. Download the build that matches the Elasticsearch version you are running.

Download the build for 9.5.5:

https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-9.5.5.zip

To verify the .zip file, use the SHA hash or ASC key.

Replace <SPECIFIC.VERSION.NUMBER> with the Elasticsearch version you are running. For example, you can replace <SPECIFIC.VERSION.NUMBER> with 9.0.0.

  • To download the build for the plugin, use this link:

    https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-<SPECIFIC.VERSION.NUMBER>.zip

  • To download the corresponding SHA hash to verify the .zip file, use this link:

    https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-<SPECIFIC.VERSION.NUMBER>.zip.sha512

  • To download the corresponding PGP signature (.asc) to verify the .zip file, use this link:

    https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-<SPECIFIC.VERSION.NUMBER>.zip.asc

The plugin manager installs plugins on a self-managed cluster. To install this plugin on Elastic Cloud Hosted, Elastic Cloud Enterprise, or Elastic Cloud on Kubernetes, refer to the plugin installation instructions for your deployment type.

The plugin can be removed with the following command:

sudo bin/elasticsearch-plugin remove microsoft-graph-authz

The node must be stopped before removing the plugin.

To learn how to configure the Microsoft Graph Authz plugin, refer to configuration properties.