This guide walks you through creating an Entra ID application and service principal, and gathering the configuration needed to create an Entra ID integration.
Before you begin, please make sure your Entra ID tenant has a P1 or P2 premium subscription. If your tenant does not support advanced query capabilities (i.e. Azure AD B2C tenants), filtering related functionality may not work correctly.
The Query Risk Events and Query Risky Users operations surface Microsoft Entra ID Protection data, which requires an Entra ID P2 license on the tenant. Tenants without P2 can still use the rest of this integration; only Query Risk Events and Query Risky Users will return no data.
Follow the microsoft documentation to create a Microsoft Entra application and service principal that can access resources. Since there is no need for users to sign in to this application directly, you can choose ‘Single-page application (SPA)’ for the redirect URI and leave it blank.
Once your Entra ID Application is created you will see your ‘Application (client) ID’ and the ‘Directory (tenant) ID’ on the Overview tab. Copy these values to a safe location.
Navigate to Manage > Certificates and secrets and add a new client secret.
Copy the secret to a safe location beside your client ID and tenant ID. You will not have access the secret value again.
Follow the Microsoft documentation to assign app roles to the application. You will need to grant admin consent before these roles are fully available for use.
Assign these Application permissions in the Microsoft Graph API section. All of the names below are Application permissions (not Delegated).
| Permission | Required for | Notes |
|---|---|---|
Directory.Read.All | Query Users, Get User, Query Groups, Get Group, Query Group Members | Read users, groups, group members, and directory roles. Prefer this over separate User.Read.All / Group.Read.All / GroupMember.Read.All unless you need least-privilege splitting. |
AuditLog.Read.All | Query Audit Log, Query Users, Get User | Covers directory audit logs and sign-in logs. Also required for the Graph signInActivity property returned on Query Users and Get User. |
UserAuthenticationMethod.Read.All | Get User | Read authentication methods returned with the user. Read is enough; write is not used. |
User.ReadWrite.All | Disable User, Enable User, Expire All User Sessions | Account write actions. Sensitive session updates may also require an Entra admin role (for example User Administrator) on the service principal. |
IdentityRiskEvent.Read.All | Query Risk Events | Optional. Requires an Entra ID P2 tenant. Without P2 this operation returns no data. |
IdentityRiskyUser.Read.All | Query Risky Users | Optional. Also used for risk enrichment on Get User. Requires an Entra ID P2 tenant. Without P2 these fields are omitted / return no data. |
Do not assign:
User.Read— that is a Delegated permission and is not valid for this client-credentials integration.Group.ReadWrite.All/GroupMember.ReadWrite.All— the connector only reads groups and members; it does not create, update, or change membership.UserAuthenticationMethod.ReadWrite.All— the connector only reads authentication methods.RoleManagementPolicy.Read— this permission does not exist in Microsoft Graph.
Query Users also requests the Graph signInActivity property, which requires an Entra ID P1 or P2 license on the tenant (see the prerequisites above).
Create your integration by supplying all of the required and any desired optional values.
URL (Optional) Leave this blank to use the default graph URL. If you are using an alternate or special deployment of the Microsoft Graph API, find the correct URL for your deployment. This is the root URL without any paths included. For example 'https://graph.microsoft.com/'.
Tenant ID This is the 'Directory (tenant) ID' gathered in step 1
Token URL (Optional) Leave this blank to use the default login URL. If you are using an alternate or special deployment of the Microsoft Graph API, find the correct URL for your deployment. This is the full token endpoint URL with your tenant ID included. For example 'https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/token'.
Client ID This is the 'Application (client) ID' gathered in step 1
Client Secret This is the client secret gathered in step 2