Skip to main content

​
Overview

The Microsoft Entra AD integration (formerly Azure AD) enables ThreatAware to collect data from your Microsoft Entra environment, providing visibility into identity management, user accounts, and access patterns.
Connection Method: OAuth Authorization Setup Time: 10 minutes Access Required: Global Administrator or Company Administrator account

​
Data collected

The Microsoft Entra AD integration provides:
  • User and identity information
  • Group memberships and organisational structure
  • Device and enrollment status
  • Conditional access policies and security posture

​
Use cases

Identity Management

Monitor user accounts and verify identity configurations in Entra AD

Access Control

Track group memberships and user permissions across your organisation

Compliance Validation

Verify Entra AD configuration meets compliance requirements

Device Management

Monitor device enrollment and compliance status

​
Setup instructions

1

Access ThreatAware Integration Settings

Open ThreatAware and navigate to Integrations > Microsoft Entra AD.
2

Click Authorize Button

Click the Authorize button to initiate the OAuth authorization process.This will redirect you to Microsoft’s authorization page where you’ll grant ThreatAware permission to access your Entra AD environment.
3

Log in with Global Admin Credentials

You will be prompted to log in to your Microsoft account:
  • Use your Global Administrator or Company Administrator credentials
  • Ensure the account you use has sufficient permissions to authorise third-party applications
Only accounts with Global Administrator or Company Administrator permissions can authorise this integration. Using other account types will result in authorization failure.
4

Review and Accept Permissions

On the Microsoft authorization page:
  • Review all requested permissions for ThreatAware
  • Accept the necessary permissions by clicking Accept or Consent
  • You may be asked to consent on behalf of your organisation
5

Verify Authorization Success

After completing authorization:
  • You will be redirected to a ThreatAware page indicating success or failure
  • If successful, the integration is automatically configured
  • Close the page and return to ThreatAware
6

Verify Connection

Confirm the integration is active:
  • Navigate to Integrations in ThreatAware
  • Check that Microsoft Entra AD shows Active status
  • Wait for the initial data synchronization to complete

​
Authorization requirements

Global or Company Administrator AccountOnly accounts with these roles can authorise the integration:
  • Global Administrator: Full permissions across the entire tenant
  • Company Administrator: Tenant-wide administrative permissions
Other roles (such as Directory Readers or User Administrators) do not have sufficient permissions to authorise OAuth applications.
Microsoft Graph API PermissionsThreatAware requests the following permissions:
  • Read user profiles and directory information
  • Read group memberships and organisational structure
  • Read device information (if using device management)
  • Read conditional access policies and security configurations
For detailed information on specific permissions, refer to the Microsoft Graph API Required Permissions Documentation.

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Integrations in ThreatAware
    • Confirm Microsoft Entra AD shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait up to 60 minutes for initial data synchronization
    • Search for known users or groups in ThreatAware
    • Verify the directory information matches your Entra AD environment
  3. Test Queries
    • Create a test query to filter users from Entra AD
    • Verify user and group data is being collected correctly

​
Troubleshooting

Symptoms: Authorization page shows error or closes without completingSolutions:
  • Confirm you are using a Global Administrator or Company Administrator account
  • Check that the account is not restricted by conditional access policies
  • Verify the account is not a guest account in the tenant
  • Try authorization in an incognito/private browser window
  • Check browser cookies and cache aren’t blocking the authorization
Symptoms: Integration shows active but no data appearsSolutions:
  • Verify the admin account had all required permissions when authorising
  • Check that ThreatAware’s registered application has necessary permissions in Entra AD
  • Go to Enterprise Applications in Entra AD and check ThreatAware’s permissions
  • Re-authorise if application permissions were recently changed
  • Review Microsoft Graph API Required Permissions documentation
Symptoms: Integration fails to connect or times outSolutions:
  • Verify your network connectivity is stable
  • Check firewall rules allow access to Microsoft Graph API endpoints
  • Confirm Entra AD service is operational
  • Try re-authorising the integration
  • Check for regional cloud restrictions if using government or sovereign clouds
Symptoms: Integration shows active but no user or directory data appearsSolutions:
  • Verify there are users and groups in Entra AD to collect
  • Check if the authorised admin account was recently removed or disabled
  • Review conditional access policies that might affect the integration
  • Wait for the next sync cycle (typically hourly)
  • Review ThreatAware integration logs for errors

​
Additional resources

Microsoft Graph API Documentation

Official Microsoft Graph API documentation and reference

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Authorization Best Practices
  • Use a dedicated Global Administrator account for authorization if possible
  • Document who authorised the integration and when
  • Periodically review application permissions in Entra AD
  • Ensure the authorising account remains active (don’t disable it afterward)
Security Considerations
  • Verify ThreatAware’s application permissions match minimum required
  • Regularly audit ThreatAware’s access in your Entra AD audit logs
  • Monitor for unauthorized or unusual data access patterns
  • Follow your organisation’s least privilege principles