Connecting Microsoft Azure to ATS for interview scheduling

Deel ATS integrates with your organization’s Microsoft Azure account to make interview scheduling seamless and secure. By connecting Azure, you can centralize scheduling, streamline authentication, and ensure that interview details are managed directly within Deel.

This article explains how clients can connect their organization's Microsoft Azure account to Deel ATS to schedule interviews with candidates.

In this article

Here’s what you’ll find in this article:

• Before you begin
• Step 1. Get a Microsoft Entra client ID and tenant ID
• Step 2. Get a Microsoft Azure private key
• Step 3. Customize API Permissions
• Step 4. (Optional) Prepare the app for automatic secret rotation
• Step 5. Connect your Microsoft Azure account
• Step 6. Allow Deel ATS to attach Microsoft Teams meetings
• Automatic secret rotation

Before you begin

To successfully follow this guide, you’ll need:

• A user with an admin role on Deel
• A user with a Global Administrator role on Microsoft Azure

Step 1. Get a Microsoft Entra client ID and tenant ID

1. On your Microsoft Azure portal, search for Microsoft Entra ID (formerly Azure Active Directory).
   

2. On the Entra ID overview page, click Add > App registration.
   

3. Give your app a name and click Register.

4. On the details page of your newly created app, copy the Application (client) ID and Tenant ID.

Step 2. Get a Microsoft Azure private key

1. On your app’s homepage, go to Certificates & secrets > Client secrets.

2. Click New client secret.

3. Provide a description, customize the expiration date, and click Add.
   

4. Copy the generated client secret.

Step 3. Customize API Permissions

1. Navigate to the API Permissions tab of your app.

2. Remove any default configured permissions.

3. Click Add a permission > Microsoft Graph > Application permissions.

4. Select the required permissions listed below and click Add permissions.

   API	Permission Name	Type	Description
   User	User.Read	Application	Read all users' full profiles
   Calendar	Calendars.ReadWrite	Application	Have full access to user calendars
   Online Meetings	OnlineMeetings.ReadWrite.All	Application	Read and create user's online meetings

    

5. Back on the API permissions page, under Configured permissions, grant admin consent for the default directory.

   

Step 4. (Optional) Prepare the app for automatic secret rotation

Client secrets in Microsoft Entra expire. When the client secret expires, Deel ATS can no longer read calendars or schedule interviews until someone enters a new one.

With automatic secret rotation, Deel creates a replacement client secret before the current one expires and switches to it without interrupting interview scheduling. This step gives your Azure app the access Deel needs to do this.

If you prefer to replace the client secret manually, skip to Step 5.

Step 4a. Grant the rotation permission

Deel creates each replacement secret by calling the Microsoft Graph addPassword API on your app registration. This requires the Application.ReadWrite.OwnedBy application permission.

1. On the app’s API permissions tab, select Add a permission > Microsoft Graph > Application permissions.
2. Add the following permission:

3. Under Configured permissions, select Grant admin consent for your tenant, and confirm that the permission shows as granted.

Step 4b. Make the app an owner of itself

The Application.ReadWrite.OwnedBy permission only lets an app manage app registrations it owns. Granting the permission is not enough on its own: the app’s own service principal must also be an owner of its app registration.

This is the most common reason automatic secret rotation cannot be turned on.

The Owners page in the Azure portal only accepts users, so you must add this owner with the Azure CLI. You need two different object IDs:

1. Sign in to your tenant with the Azure CLI:

az login --tenant <tenantId> --allow-no-subscriptions

2. Add the service principal as an owner of the app registration:

az ad app owner add \
  --id <appRegistrationObjectId> \
  --owner-object-id <servicePrincipalObjectId>

3. Confirm that the service principal is now an owner. The output must include the service principal object ID:

az ad app owner list --id <appRegistrationObjectId> --query "[].id"

Step 4c. Check your tenant’s client secret lifetime policy

Deel creates each replacement secret with a lifetime of about six months. If your tenant has an app management policy that limits client secret lifetimes, the limit must be at least 180 days. Otherwise, Microsoft rejects every replacement secret and rotation cannot succeed.

If such a policy applies to your tenant, do one of the following:

• Exempt this app registration from the policy.
• Raise the limit to at least 180 days.
• Leave automatic secret rotation turned off and replace the client secret manually.

The Microsoft Outlook email integration requires a limit of at least 184 days, and the Microsoft Azure interview scheduling integration a limit of at least 180 days. If both integrations use the same app registration, allow at least 184 days.

Step 5. Connect your Microsoft Azure account

1. On Deel, go to People > Hiring > Settings.

2. Select Interview settings > Microsoft Azure and click Connect.

3. Enter the private key, client email, and client ID generated in the previous sections.

4. Click Submit.

When Automatic secret rotation is on, Deel verifies your Azure setup before saving the connection. To do this, it creates a temporary client secret named Deel ATS rotation probe and removes it immediately. If the setup is incomplete, the connection is not saved and an error message explains what is missing. See Troubleshooting automatic secret rotation.

Step 6. Allow ATS to attach Microsoft Teams meetings

To enable ATS to automatically attach Microsoft Teams meetings to interviews, you must grant access using PowerShell. You can do this from your local PowerShell CLI or from Azure Cloud Shell.

1. Run the following command to create a Teams Meetings policy, replacing <policy-name> with your chosen policy name and <application-client-id> with the App ID you copied in Step 1.4:

New-CsApplicationAccessPolicy -Identity <policy-name> -AppIds "<application-client-id>" -Description "Teams Meetings Policy"

2. Run the following command to assign the policy globally:

Grant-CsApplicationAccessPolicy -PolicyName "<policy-name>" -Global

Once complete, ATS will be able to generate and attach Microsoft Teams links directly to scheduled interviews.

Automatic secret rotation

Automatic secret rotation is available for both Microsoft integrations in Deel ATS: the Microsoft Outlook email integration and the Microsoft Azure interview scheduling integration. It works the same way for both, but each integration has its own client secret and its own rotation setting.

The actions described below are in the menu on the integration’s card.

How automatic secret rotation works

When automatic secret rotation is on:

• About seven days before the current client secret expires, Deel creates a replacement secret on your app registration. The replacement secret is valid for about six months.
• Deel waits about an hour for the new secret to become active in Microsoft Entra, confirms that it works, and then switches to it. The integration keeps working without interruption.
• Deel does not delete the previous secret. It stays listed under Certificates & secrets until it expires. This is expected.
• The integration’s card shows Auto-rotation on and the expiry date of the current client secret.

When automatic secret rotation is off, ATS admins receive email reminders before the client secret expires, and the integration’s card shows an alert starting 14 days before the expiry date. To avoid interrupting the integration, replace the client secret before the current one expires, as described in Replacing the client secret manually.

Turning automatic secret rotation on or off later

You can turn automatic secret rotation on for an existing connection without disconnecting the integration.

1. Complete Step 4.
2. On the integration’s card, select Enable automatic secret rotation.
3. For the Microsoft Azure interview scheduling integration only, enter the Tenant ID, Client ID, and Client secret again, leave Automatic secret rotation turned on, and select Submit.

For the Microsoft Outlook email integration, Deel verifies your Azure setup using the credentials that are already saved, so you do not need to enter them again. For the Microsoft Azure interview scheduling integration, Deel needs the client secret again to verify your Azure setup.

To verify the setup, Deel creates a temporary client secret named Deel ATS rotation probe and removes it immediately. If the setup is incomplete, rotation stays off and an error message explains what is missing. See Troubleshooting automatic secret rotation.

To turn automatic secret rotation off, select Disable automatic secret rotation on the integration’s card. The current client secret keeps working until it expires.

Replacing the client secret manually

You can replace the client secret at any time without disconnecting the integration:

1. Create a new client secret for your app, as described in Step 2.
2. On the integration’s card, select Update secret.
3. Enter the Tenant ID, Client ID, and the new Client secret, and select Submit.

If automatic secret rotation is paused, entering a new client secret also resumes it.

Do not disconnect the integration to replace the client secret. Disconnecting the Microsoft Azure interview scheduling integration removes all scheduled interviews.

Troubleshooting automatic secret rotation

If Deel cannot rotate the client secret for 48 hours, it pauses automatic secret rotation, emails ATS admins, and the integration’s card shows Auto-rotation paused with the reason. The current client secret keeps working until its expiry date, so fix the issue before then.