Open-source tool · Entra Helpdesk

Entra Helpdesk Portal

Keep Tier 1 and Tier 2 support out of the Entra admin portals.

Entra Helpdesk Portal lets helpdesk staff do daily identity tasks, such as password resets, MFA clean-up and group changes, without access to the Azure or Entra admin portals. The portal does the work through one scoped service principal. Every write action needs an ITSM ticket number and is logged to a local audit database.

View on GitHub ↗Quick start

Edition: Community
Sign-in: Microsoft SSO + allowlist
Stack: Python 3.11, Flask, MSAL, SQLite
Runs on: Docker, x86_64 and ARM64

Why it exists

Questions it answers

How do I give the helpdesk access without admin roles?

Staff use the portal; only its service principal talks to Microsoft Graph.

Who reset that password, and for which ticket?

Every write action needs a ticket number and is logged with time, admin, action, target and result.

Can I limit what the helpdesk can do?

Feature flags turn off user deletion, password resets, MFA management, groups or apps.

Who can sign in?

Anyone authenticates with Microsoft SSO, but only UPNs in ALLOWED_ADMINS are let in.

Features

What it does

Users

Create users with a 16-character temporary password
Reset passwords and force a change at next sign-in
Revoke all sessions for a compromised account
Last 5 sign-ins with location, IP and failure reason

MFA and groups

View and delete registered methods to force re-registration
Create security and Microsoft 365 groups
View, add and remove group members

Apps and recovery

List app registrations and enterprise apps
Inspect an app's requested API permissions
Rotate client secrets
Export users to CSV, restore soft-deleted users, groups and apps

Dashboard and settings

Sign-in analytics from the last 100 events
Light and dark mode
Upload your own logo
In-memory caching for fast Graph reads

How it fits together

Architecture

01Helpdesk technician
02Reverse proxy with TLS
03Entra Helpdesk Portal container
04Ticket check + audit log
05Microsoft Graph via a scoped service principal

Quick start

Try it

Run with Docker Compose

git clone https://github.com/jahmed-cloud/entra-helpdesk.git
cd entra-helpdesk
# set TENANT_ID, CLIENT_ID, CLIENT_SECRET, BASE_URL and ALLOWED_ADMINS
docker compose up -d

The full setup guide is in the README on GitHub.

Before you start

Graph application permissions

Users and passwords	User.ReadWrite.All
Groups and members	Group.ReadWrite.All
Apps and secret rotation	Application.ReadWrite.All
MFA methods	UserAuthenticationMethod.ReadWrite.All
Sign-in diagnostics, domains	AuditLog.Read.All, Domain.Read.All

Good to know

Unlike ARG and EntraGuard, which are read-only, this portal changes your tenant, and its service principal holds write permissions. Keep the client secret safe, publish the portal only behind a TLS reverse proxy, keep ALLOWED_ADMINS short, and turn off features your delegation model does not need. Add a web redirect URI ending in /getAToken to the app registration.