Connect Microsoft Entra ID

Imports users, groups, devices, and sign-in logs from your Microsoft directory via the Microsoft Graph API.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• Azure account with Global Administrator or Application Administrator role

• An active Microsoft Entra ID tenant

Step 1 — Create an App Registration

1. Sign in to portal.azure.com

2. Search for App registrations → New registration

3. Name: HARVEN, type: Single tenant

4. Click Register

5. Note the Application (client) ID and Directory (tenant) ID

Step 2 — Configure API permissions

API permissions → Add a permission → Microsoft Graph → Application permissions

• User.Read.All — Users

• Group.Read.All — Groups

• Device.Read.All — Devices

• AuditLog.Read.All — Sign-in logs

• Directory.Read.All — Directory roles

• AccessReview.Read.All — Access reviews (guest-account coverage)

⚠️ Click Grant admin consent to activate permissions.

Step 3 — Create a Client Secret

1. Left menu: Certificates & secrets

2. New client secret → choose a duration (24 months recommended)

3. Copy the value immediately — it is only shown once

Step 4 — Remediation actions (optional)

Only required to disable / re-enable a user (accountEnabled) from HARVEN. Add the Graph permission (Application) User.ReadWrite.All (or User.EnableDisableAccount.All), then Grant admin consent.

What to enter in HARVEN

• Tenant ID — Your Azure AD tenant identifier (App Registration → Directory (tenant) ID)

• Client ID — Application identifier (App Registration → Application (client) ID)

• Client Secret — Secret created in Step 3 (Certificates & secrets → Value)

What HARVEN reads

• user — Entra ID users: identity (userid, name, email), security (mfa_enabled, entraid_admin, local_admin), activity (last_successful_signin, account_enabled), organization (department, job_title, groups)

• device — Registered devices: hardware (name, manufacturer, model, os, osversion), compliance (is_compliant, is_managed, trust_type)

• signin — Sign-in logs: connection (status, date, application, ip_address), security (risk_level, conditional_access_status, mfa_detail)

• group — Groups: identity (id, name, type)

• access_review — Entra ID access reviews (guest-account coverage). Requires an Entra ID P2 / Governance licence: review (review_id, review_name, instance_status), decision (reviewed_user_id, decision, decision_applied_date)

• registration — User MFA registration details (Graph userRegistrationDetails report): MFA (is_mfa_registered, is_mfa_capable, methods_registered), methods (is_passwordless_capable, is_sspr_registered, default_mfa_method)

• directory_role — Activated directory (admin) roles: role (id, name, description)

• group_role_assignment — Directory roles assigned to groups; join to user groups for inherited rights: assignment (group_id, role_id, role_name, scope)

Official documentation

• Azure App Registration

• Microsoft Graph Permissions

• Update user (remediation)

Need help? Contact [email protected].