Skip to main content

Microsoft Entra ID - User Guide

In this article, you will understand step by step how to easily integrate with Microsoft Entra ID

Microsoft Entra ID is Microsoft's cloud identity and access management service - formerly Azure Active Directory - that manages users, groups, applications, conditional access policies, multi-factor authentication, and directory role assignments across Microsoft 365 and Azure.

Microsoft 365 and Microsoft Entra ID users can connect using Azure AD

Required Permissions

  • read: User.Read.All

  • read: Group.Read.All

  • read: Policy.Read.All

  • read: Application.Read.All

  • read: UserAuthenticationMethod.Read.All

  • read: RoleManagement.Read.Directory

Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.

Note: Connecting an Azure subscription is required to retrieve MFA configuration data for users.

How to Connect

  1. In Scytale, go to 'Integrations'.

  2. Search for Microsoft Entra ID and select 'Connect'.

  3. Paste your directory (tenant) ID, application (client) ID & client secret value, and optionally your scoping group ID.

  4. Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.

You have now successfully connected to Microsoft Entra ID.

How to Generate Credentials in Microsoft Entra ID

  1. Log in to the Azure portal and go to Microsoft Entra ID.

  2. In the left menu, select 'App registrations' and then 'New registration'.

  3. Enter a name for the application — for example, scytale-azure-integration — set the supported account types to 'Accounts in this organizational directory only (Single tenant)', and then select 'Register'.

    Note: If you already registered an application for another Microsoft integration with Scytale, you can reuse it. Only the API permissions differ.

  4. On the application's 'Overview' page, copy the application (client) ID and the directory (tenant) ID.

  5. In the application, go to 'Certificates & secrets' and select 'New client secret'.

  6. Set an expiry — 24 months is recommended — and then select 'Add'.

  7. Copy the secret 'Value', not the 'Secret ID'.

    Note: The secret value is displayed only once. Be sure to copy it before leaving the page.

  8. Go to 'API permissions', select 'Add a permission', choose 'Microsoft Graph', and then select 'Application permissions'.

  9. Add all six permissions listed under Required Permissions above, and then select 'Grant admin consent for Default Directory'.

    Note: Without admin consent, Graph calls fail with HTTP 403.

  10. Optionally, to surface only users in a specific Entra ID group rather than the whole tenant, go to Microsoft Entra ID, select 'Groups', open the relevant group, and copy its object ID from the 'Overview' page.

Related Articles
Did this answer your question?