Connect Microsoft Entra ID

Imports users, groups, devices, sign-in logs, privileged accounts, conditional-access policies and Entra ID Protection risks from your Microsoft directory via the Microsoft Graph API.

For the general flow of adding a source, see Connect Data Sources.

Before you start

To configure the data source, you can use your M365 interface or use the full PowerShell script that we provide.

Prerequisites

• Azure account with Global Administrator or Privileged Role Administrator role — an Application Administrator can create the App Registration but cannot grant admin consent to Microsoft Graph application permissions

• An active Microsoft Entra ID tenant

• Entra ID P1 for signin, signin_service_principal, conditional_access_policy, named_location and the sign-in dates in user; Entra ID P2 for risky_user and risk_detection (empty without the licence) and for the PIM roles in privileged_account (without the licence every active assignment shows as permanent); Entra ID P2 / Governance for access_review

Setup

Step 1 — Create an App Registration

1. Sign in to portal.azure.com

2. Search for App registrations → New registration

3. Name: HARVEN, type: Single tenant

4. Click Register

5. Note the Application (client) ID and Directory (tenant) ID

Step 2 — Configure API permissions

API permissions → Add a permission → Microsoft Graph → Application permissions

⚠️ Click Grant admin consent to activate permissions.

Connector created before a permission joined this list? Add it and click Grant admin consent again (or re-run the PowerShell script). Meanwhile, only the tables and columns that need the missing permission are unavailable.

Step 3 — Create a Client Secret

1. Left menu: Certificates & secrets

2. New client secret → choose a duration (24 months recommended)

3. Copy the value immediately — it is only shown once

Step 4 — Remediation actions (optional)

Only required for HARVEN to act on accounts itself, from the Actions or Remediation pages. Add the Graph permission (Application) of each action you want, then Grant admin consent:

• Suspend / Reactivate a user (accountEnabled) — User.EnableDisableAccount.All (or User.ReadWrite.All)

• Force a password change at next sign-in — User-PasswordProfile.ReadWrite.All (or User.ReadWrite.All)

• Require MFA (per-user MFA) — Policy.ReadWrite.AuthenticationMethod

Without the permission, HARVEN shows the steps to grant it when you launch the action. The PowerShell script's -IncludeEntraIdWrite option adds only the Suspend / Reactivate permission: add the other two by hand.

Fields to fill in HARVEN

Collected data

• user — Entra ID users: Identity (userid, name, email), Security (directory_roles: direct roles only, see privileged_account) (user_type, account_enabled, directory_roles, password_policies), Activity (sign-in dates: Entra ID P1 licence) (last_successful_signin, last_interactive_signin, last_non_interactive_signin, last_password_change), Organization (department, job_title, company_name, groups)

• device — Registered devices: Hardware (name, manufacturer, model, os, osversion), Compliance (is_compliant, is_managed, trust_type)

• signin — Sign-in logs: Connection (status, date, application, ip_address), Security (risk_level, risk_state, conditional_access_status, applied_conditional_access_policies)

• group — Groups: Identity (id, name, type, description, mail), Kind (visibility, is_m365, is_dynamic, has_team, security_enabled, mail_enabled), Governance (0 owners = orphaned group) (is_assignable_to_role, owner_count, guest_member_count), Lifecycle (created_datetime, renewed_datetime, expiration_datetime, assigned_labels)

• access_review — Entra ID access reviews (guest-account coverage). Requires an Entra ID P2 / Governance licence: Review (review_id, review_name, instance_status), Decision (reviewed_user_id, decision, decision_applied_date)

• registration — User MFA registration details (Graph userRegistrationDetails report): MFA (is_mfa_registered, is_mfa_capable, methods_registered), Methods (is_passwordless_capable, is_sspr_registered, default_mfa_method)

• directory_role — Activated directory (admin) roles: Role (id, name, description)

• group_role_assignment — Directory roles assigned to groups; join to user groups for inherited rights: Assignment (group_id, role_id, role_name, scope)

• privileged_account — Reference definition of an administrator: direct roles, roles inherited from a group, and PIM roles. For standing administrators, filter on assignment_type = permanent: Account (principal_id, principal_type, principal_name, user_principal_name), Role (role_id, role_name, scope), Origin (direct, group, registration) (assignment_path, via_group_id, via_group_name), PIM: permanent, activated or eligible (empty without RoleManagement.Read.Directory) (assignment_type, start_datetime, end_datetime)

• conditional_access_policy — Conditional-access policies: how MFA is enforced. Requires Policy.Read.All and Entra ID P1: Policy (policy_id, display_name, state, is_enforced, is_report_only), Targets and exclusions (JSON) (include_users, exclude_users, include_groups, include_roles, include_applications, include_locations), Controls (grant_controls, session_controls, authentication_strength_name), Summary (requires_mfa, blocks_access, targets_all_users, targets_legacy_authentication)

• named_location — Named locations referenced by conditional-access policies. Requires Policy.Read.All and Entra ID P1 (empty without the licence): Location (location_id, display_name, location_type, is_trusted), Scope (ip_ranges, countries, include_unknown_countries)

• tenant_policy — Tenant security defaults and authentication methods policy. Requires Policy.Read.All: Security defaults (exclusive of conditional access) (security_defaults_enabled), Methods (JSON) (authentication_methods, enabled_authentication_methods), Authenticator registration campaign (registration_campaign_state, registration_campaign_snooze_days)

• risky_user — Risky users (Entra ID Protection). Open risk: risk_state = atRisk or confirmedCompromised. Requires IdentityRiskyUser.Read.All and Entra ID P2: User (user_id, user_principal_name, user_display_name), Risk (risk_level, risk_state, risk_detail, risk_last_updated_datetime)

• risk_detection — Risk detections, including offline ones (leaked credentials…). Requires IdentityRiskEvent.Read.All and Entra ID P2: Detection (detection_id, user_id, user_principal_name), Risk (risk_event_type, risk_level, risk_state, source, activity), Context (ip_address, location_country, activity_datetime, detected_datetime)

• signin_service_principal — Preview (Graph beta API): sign-ins of applications authenticating as themselves, absent from signin. Requires Entra ID P1/P2: Application (service_principal_id, service_principal_name, app_id), Sign-in (date, status, error_code, client_credential_type), Context (resource_display_name, ip_address, location_country)

PowerShell script

Create the App Registration, assign the permissions and generate the secret in one command, with our PowerShell script.

Download the script

How to run it:

Windows — Right-click the file, Run with PowerShell — or in a terminal:

powershell -ExecutionPolicy Bypass -File .\setup-microsoft-connector.ps1

macOS / Linux — Install PowerShell 7 then run the script:

brew install powershell
pwsh ./setup-microsoft-connector.ps1

Arguments (optional) — Without any argument, the script is fully interactive.

• -Connector <entraid|intune|defender|mdca|azure> — Connector to configure. Omitted: the script asks in a menu.

• -AppName <name> — Name of the App Registration to create (default: HARVEN-<connector>).

• -SubscriptionId <id> — Required for azure: target subscription for the Reader role.

• -IncludeEntraIdWrite — entraid only: adds the remediation permission User.EnableDisableAccount.All.

• -Yes — Non-interactive: skips confirmations and installs missing modules automatically.

The script offers to install the missing modules automatically.

Official documentation

• Azure App Registration

• Microsoft Graph Permissions

• Update user (remediation)

Need help? Contact [email protected].