EN
Microsoft Entra ID
Provider Setup

Connect Microsoft Entra ID

ConfigTrace connects to a Microsoft Entra ID tenant using app-only Microsoft Graph authentication and monitors identity lifecycle, privileged access, applications, Conditional Access, and authentication configuration.

ℹ
Entra ID vs. Azure: These are separate ConfigTrace integrations. Azure covers infrastructure configuration — IAM, networking, storage, Key Vault. Microsoft Entra ID covers identity, application access, Conditional Access, privileged roles, and OAuth consent. Connect both if you need full coverage of your Microsoft estate.
On this page
  1. Prerequisites
  2. Step 1 — Register an app for Graph access
  3. Step 2 — Grant Microsoft Graph permissions
  4. Step 3 — Connect Entra ID in ConfigTrace
  5. Step 4 — Run your first sync
  6. What ConfigTrace monitors
  7. Security Findings
  8. What ConfigTrace never reads
  9. Known limitations
  10. Troubleshooting

Prerequisites

  • →A Microsoft Entra ID tenant on the global commercial cloud
  • →Permission to register an application and grant admin consent in Entra ID (Application Administrator or Global Administrator)
  • →A ConfigTrace workspace (owner or admin role)

Step 1 — Register an app for Graph access

ConfigTrace authenticates to Microsoft Graph using app-only authentication — a tenant ID, client ID, and client secret — not a signed-in user. Register a dedicated application in Entra ID:

  1. 1
    Register an application
    In the Entra admin center, go to Identity → Applications → App registrations → New registration. Name it something like ConfigTrace (read-only).
  2. 2
    Create a client secret
    Under Certificates & secrets, create a new client secret and copy the value immediately — it is only shown once.
  3. 3
    Note your tenant ID and client ID
    Both are shown on the app registration's Overview page.

Step 2 — Grant Microsoft Graph permissions

Under API permissions, add the following Application (not Delegated) Microsoft Graph permissions, then click Grant admin consent:

  • →User.Read.All, Group.Read.All — users, groups, and memberships
  • →Application.Read.All — applications, service principals, and app-role assignments
  • →Policy.Read.All — Conditional Access policies, authentication strengths, and authentication methods policy
  • →RoleManagement.Read.Directory — directory role assignments
  • →DelegatedPermissionGrant.Read.All — OAuth2 delegated permission grants
⚠
Grant only *.Read.All application permissions. ConfigTrace does not need write permissions of any kind, and admin consent must be granted by a Global Administrator or Privileged Role Administrator.

Step 3 — Connect Entra ID in ConfigTrace

  1. 1
    Open Integrations
    In the ConfigTrace sidebar, click Integrations, then click Connect on the Microsoft Entra ID card.
  2. 2
    Enter tenant ID, client ID, and client secret
    Paste the three values from Step 1. ConfigTrace encrypts the client secret before storage and never displays it again.
  3. 3
    Save integration
    Click Save integration. ConfigTrace performs a read-only Graph API validation call to confirm access and consented permissions.

Step 4 — Run your first sync

Click Sync Now. The first sync captures users, groups, applications, service principals, Conditional Access policies, and directory role assignments as a baseline snapshot — this becomes the reference point for all future diffs.

What ConfigTrace monitors

✓ Reads (configuration metadata)
  • ✓Users, groups, and direct (Member/Guest) memberships
  • ✓Applications, service principals, and app / app-role assignments
  • ✓Microsoft Graph application permissions and OAuth2 delegated permission grants
  • ✓Conditional Access policies
  • ✓Authentication strengths and authentication methods policy
  • ✓Directory role assignments and derived privileged identity / group / service-principal posture
✕ Never reads
  • ✕Client secret values (used only to authenticate, stored encrypted)
  • ✕Sign-in logs or Identity Protection risk events
  • ✕Mailbox, file, or Teams content
  • ✕Per-user authentication-method enumeration

Security Findings

Beyond drift, ConfigTrace evaluates Entra configuration against provider-specific Security Findings rules — for example, a Global Administrator role assignment, a high-risk Graph application permission granted to a service principal, or a Conditional Access policy change that weakens MFA enforcement. Findings represent current risky configuration posture, not a confirmed compromise. See the risk classification section for how findings are prioritized.

What ConfigTrace never reads

⚠
ConfigTrace monitors configuration, not runtime sign-in activity. It does not ingest Entra sign-in logs, does not consume Identity Protection risk events, and cannot simulate the exact Conditional Access outcome for a specific sign-in — it reads the policy definitions themselves.

For a full breakdown across all providers, see the Data Access & Permissions reference.

Known limitations

  • →PIM not modeled: Privileged Identity Management eligible-role schedules are not observed — only active directory role assignments are monitored
  • →No runtime sign-in monitoring or Identity Protection incident ingestion
  • →No per-user authentication-method enumeration or exact per-user Conditional Access policy simulation
  • →No nested / transitive group membership flattening — direct memberships only
  • →Commercial cloud only: GCC High, DoD, and China (21Vianet) national clouds are not supported
  • →Certificate-based app authentication is not supported — client secret authentication only

Troubleshooting

  • →"Insufficient privileges" on save: Admin consent has not been granted for one or more permissions. Return to API permissions in the app registration and click Grant admin consent.
  • →"Invalid client secret": Client secrets expire. Generate a new secret under Certificates & secrets and update the integration in ConfigTrace.
  • →Conditional Access section is empty: Confirm the Policy.Read.All permission was granted and consented, and that your tenant has Conditional Access policies configured (requires Entra ID P1/P2).
  • →To revoke access: In the Entra admin center, delete the app registration or remove its client secret. ConfigTrace stops reading immediately.

For other issues, see the general Troubleshooting guide.