diff --git a/app-config.yaml b/app-config.yaml
index 67a55582c8..9a3206026e 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -216,15 +216,6 @@ catalog:
         - Domain
         - Location
 
-  providers:
-    microsoftGraphOrg:
-      default:
-        tenantId: ${AZURE_TENANT_ID}
-        user:
-          filter: accountEnabled eq true and userType eq 'member'
-        group:
-          filter: securityEnabled eq false and mailEnabled eq true and groupTypes/any(c:c+eq+'Unified')
-
   processors:
     ldapOrg:
       ### Example for how to add your enterprise LDAP server
diff --git a/plugins/catalog-backend-module-msgraph/README.md b/plugins/catalog-backend-module-msgraph/README.md
index d9f004af03..a052a80c58 100644
--- a/plugins/catalog-backend-module-msgraph/README.md
+++ b/plugins/catalog-backend-module-msgraph/README.md
@@ -6,15 +6,16 @@ This provider is useful if you want to import users and groups from Azure Active
 
 ## Getting Started
 
-1. Choose your authentication method
+1. Choose your authentication method - all methods supported by [DefaultAzureCredential](https://docs.microsoft.com/en-us/javascript/api/overview/azure/identity-readme?view=azure-node-latest#defaultazurecredential)
 
-   - If you have a
+   - For local dev, use Azure CLI, Azure PowerShell or Visual Studio Code for authentication
+   - If your infrastructure supports Managed Identity, use that
+   - Otherwise use an App Registration
 
-1. Create or use an existing App registration or Managed Identity in the [Microsoft Azure Portal](https://portal.azure.com/).
-   The App registration requires at least the API permissions `Group.Read.All`,
-   `GroupMember.Read.All`, `User.Read` and `User.Read.All` for Microsoft Graph
-   (if you still run into errors about insufficient privileges, add
-   `Team.ReadBasic.All` and `TeamMember.Read.All` too).
+1. If using Managed Identity or App Registration for authentication, grant the following application permissions (not delegated)
+
+   - `GroupMember.Read.All`
+   - `User.Read.All`
 
 1. Configure the entity provider:
 
@@ -28,11 +29,13 @@ catalog:
         authority: https://login.microsoftonline.com
         # If you don't know you tenantId, you can use Microsoft Graph Explorer
         # to query it
-        tenantId: ${MICROSOFT_GRAPH_TENANT_ID}
+        tenantId: ${AZURE_TENANT_ID}
+        # Optional ClientId and ClientSecret if you don't want to use `DefaultAzureCredential`
+        # for authentication
         # Client Id and Secret can be created under Certificates & secrets in
         # the App registration in the Microsoft Azure Portal.
-        clientId: ${MICROSOFT_GRAPH_CLIENT_ID}
-        clientSecret: ${MICROSOFT_GRAPH_CLIENT_SECRET_TOKEN}
+        clientId: ${AZURE_CLIENT_ID}
+        clientSecret: ${AZURE_CLIENT_SECRET}
         # Optional mode for querying which defaults to "basic".
         # By default, the Microsoft Graph API only provides the basic feature set
         # for querying. Certain features are limited to advanced querying capabilities.
@@ -112,8 +115,9 @@ yarn add --cwd packages/backend @backstage/plugin-catalog-backend-module-msgraph
 +    MicrosoftGraphOrgEntityProvider.fromConfig(env.config, {
 +      logger: env.logger,
 +      schedule: env.scheduler.createScheduledTaskRunner({
-+        frequency: { minutes: 5 },
-+        timeout: { minutes: 3 },
++        frequency: { hours: 1 },
++        timeout: { minutes: 50 },
++        initialDelay: { seconds: 15}
 +      }),
 +    }),
 +  );
@@ -165,7 +169,3 @@ export async function myGroupTransformer(
 ```
 
 ## Troubleshooting
-
-### Authentication Errors
-
-If you're having problems authenticating, take a look at (Troubleshooting Azure Identity Authentication Issues)[https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/TROUBLESHOOTING.md]
diff --git a/plugins/catalog-backend-module-msgraph/config.d.ts b/plugins/catalog-backend-module-msgraph/config.d.ts
index 564ccbb10a..8748df5974 100644
--- a/plugins/catalog-backend-module-msgraph/config.d.ts
+++ b/plugins/catalog-backend-module-msgraph/config.d.ts
@@ -50,13 +50,13 @@ export interface Config {
           /**
            * The OAuth client ID to use for authenticating requests.
            */
-          clientId: string;
+          clientId?: string;
           /**
            * The OAuth client secret to use for authenticating requests.
            *
            * @visibility secret
            */
-          clientSecret: string;
+          clientSecret?: string;
 
           // TODO: Consider not making these config options and pass them in the
           // constructor instead. They are probably not environment specific, so
@@ -130,13 +130,13 @@ export interface Config {
             /**
              * The OAuth client ID to use for authenticating requests.
              */
-            clientId: string;
+            clientId?: string;
             /**
              * The OAuth client secret to use for authenticating requests.
              *
              * @visibility secret
              */
-            clientSecret: string;
+            clientSecret?: string;
 
             user?: {
               /**