> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Entra AD

> Connect ThreatAware to Entra AD to monitor directory services and enterprise applications

## Overview

The Entra AD integration enables ThreatAware to collect read-only data from your Azure AD/Entra AD directory, providing comprehensive visibility into identity management, enterprise applications, and access control configurations.

<Info>
  **Connection Method**: OAuth Authorization
  **Setup Time**: 15 minutes
  **Access Required**: Global Administrator or Company Administrator account
</Info>

## Data collected

The Entra AD integration provides:

* User and group directory information
* Enterprise application registrations and configurations
* Conditional access policies and security settings
* Device enrollment and compliance status
* Directory role and permission assignments

## Use cases

<CardGroup cols={2}>
  <Card title="Application Management" icon="cube">
    Monitor enterprise applications registered in Entra AD
  </Card>

  <Card title="Identity Governance" icon="users">
    Track users, groups, and permission assignments
  </Card>

  <Card title="Security Policy Validation" icon="shield">
    Verify conditional access and security policies are properly configured
  </Card>

  <Card title="Compliance Assurance" icon="clipboard-list">
    Demonstrate compliance with identity management controls
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Azure AD Portal">
    Access the [Azure AD Portal](https://aad.portal.azure.com) using an account with **Global Administrator** or **Company Administrator** permissions.
  </Step>

  <Step title="Review Enterprise Applications">
    Verify your Entra AD environment:

    * Navigate to **Enterprise Applications** in the Azure AD Portal
    * Check if **ThreatAware Azure Connector** is already registered (if upgrading from existing integration)
    * If not present, you will register it during the authorization process
  </Step>

  <Step title="Return to ThreatAware">
    In ThreatAware:

    * Navigate to **Integrations** and select **Entra AD**
    * Click the **Authorize** button to begin the integration process
  </Step>

  <Step title="Complete OAuth Authorization">
    Follow the authorization flow:

    * You will be redirected to Azure AD to confirm permissions
    * Log in using your **Global Administrator** or **Company Administrator** account
    * Review the permissions being requested by ThreatAware
    * Click **Accept** to authorise ThreatAware to access your Entra AD
    * You will be redirected back to ThreatAware after successful authorization

    <Warning>
      Only Global Administrators or Company Administrators can authorise this integration. Using other account types will result in authorization failure.
    </Warning>
  </Step>

  <Step title="Verify Successful Integration">
    After authorization completes:

    * ThreatAware will notify you of successful integration
    * Check that **ThreatAware Azure Connector** now appears in your Enterprise Applications
    * The integration should automatically begin collecting data
  </Step>

  <Step title="Monitor Initial Data Sync">
    Allow time for data collection:

    * Wait 60 minutes for the first data synchronization cycle
    * Navigate to **Integrations** in ThreatAware to verify **Active** status
    * Confirm directory and application data is appearing in ThreatAware
  </Step>
</Steps>

## Required permissions

<AccordionGroup>
  <Accordion title="Administrator Account Requirements" icon="lock-admin">
    **Global Administrator or Company Administrator**

    Only the following roles can authorise this integration:

    * **Global Administrator**: Full tenant-wide permissions
    * **Company Administrator**: Tenant-wide administrative access

    These permissions are necessary to consent to application permissions on behalf of your organisation.
  </Accordion>

  <Accordion title="Application Permissions" icon="shield-check">
    **ThreatAware Azure Connector Permissions**

    After authorization, ThreatAware's registered application will have the following permissions in Entra AD:

    * Read user profiles and directory information
    * Read group memberships and organisational structure
    * Read enterprise application information
    * Read conditional access policies
    * Read device and compliance information

    You can review these permissions at any time in **Enterprise Applications** > **ThreatAware Azure Connector**.
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Integrations** in ThreatAware
   * Confirm Entra AD shows **Active** status
   * Check the last sync timestamp

2. **Verify in Azure Portal**
   * Log in to the [Azure AD Portal](https://aad.portal.azure.com)
   * Go to **Enterprise Applications** and search for **ThreatAware Azure Connector**
   * Verify the application is present and enabled

3. **Verify Data Collection**
   * Wait up to 60 minutes for initial data synchronization
   * Search for known users or applications in ThreatAware
   * Verify the directory information matches your Entra AD environment

4. **Test Queries**
   * Create test queries to filter users or applications from Entra AD
   * Verify identity management data is being collected correctly

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authorization Failure" icon="triangle-exclamation">
    **Symptoms**: Authorization page shows error or does not complete

    **Solutions**:

    * Confirm you are using a Global Administrator or Company Administrator account
    * Verify the account has not been restricted by conditional access policies
    * Check that the account is an owner or member (not a guest) in the tenant
    * Try authorization in a private/incognito browser window
    * Clear browser cookies and cache before retrying
    * Check if your organisation has disabled third-party application consent
  </Accordion>

  <Accordion title="Permission Errors After Authorization" icon="ban">
    **Symptoms**: Integration shows active but no directory data appears

    **Solutions**:

    * Verify the admin account had appropriate permissions when authorising
    * In the [Azure AD Portal](https://aad.portal.azure.com), go to **Enterprise Applications**
    * Search for and select **ThreatAware Azure Connector**
    * Check that the application permissions are present and not restricted
    * Re-authorise the integration if permissions were recently modified
    * Review [Azure AD Permissions Documentation](https://docs.microsoft.com/en-us/azure/active-directory/) for details
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify your network connectivity is stable and allows access to Azure
    * Check firewall rules allow HTTPS (443) traffic to Microsoft Graph API
    * Confirm Entra AD service is operational and not under maintenance
    * Try re-authorising the integration
    * Check if your region has specific cloud restrictions (government or sovereign cloud)
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no user or application data appears

    **Solutions**:

    * Verify there are users and applications in Entra AD to collect
    * Check if the authorised admin account was recently disabled or removed
    * Review conditional access policies that might affect the integration
    * Verify the ThreatAware connector application hasn't been removed from Enterprise Applications
    * Wait for the next sync cycle (typically hourly)
    * Review ThreatAware integration logs for error messages
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Azure AD Portal" icon="link" href="https://aad.portal.azure.com">
    Access your Azure AD Portal
  </Card>

  <Card title="Azure AD Permissions Documentation" icon="book" href="https://docs.microsoft.com/en-us/azure/active-directory/">
    Official Azure AD documentation and permissions reference
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Authorization Best Practices**

  * Use a dedicated Global Administrator account for authorization if possible
  * Document who authorised the integration and when it was authorised
  * Periodically review ThreatAware's application permissions in Enterprise Applications
  * Monitor ThreatAware access in your Azure AD audit logs
  * Do not disable the admin account used for authorization after completing setup
</Tip>

<Tip>
  **Security Considerations**

  * Verify ThreatAware's permissions match the minimum required for your use case
  * Regularly audit ThreatAware's data access in Azure AD activity logs
  * Monitor for unusual or unauthorized data access patterns
  * Use Azure AD conditional access policies to restrict ThreatAware access if needed
  * Follow your organisation's least privilege principles for application permissions
</Tip>