> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra AD

> Connect ThreatAware to Microsoft Entra AD to monitor identity and access management

## Overview

The Microsoft Entra AD integration (formerly Azure AD) enables ThreatAware to collect data from your Microsoft Entra environment, providing visibility into identity management, user accounts, and access patterns.

<Info>
  **Connection Method**: OAuth Authorization
  **Setup Time**: 10 minutes
  **Access Required**: Global Administrator or Company Administrator account
</Info>

## Data collected

The Microsoft Entra AD integration provides:

* User and identity information
* Group memberships and organisational structure
* Device and enrollment status
* Conditional access policies and security posture

## Use cases

<CardGroup cols={2}>
  <Card title="Identity Management" icon="users">
    Monitor user accounts and verify identity configurations in Entra AD
  </Card>

  <Card title="Access Control" icon="lock">
    Track group memberships and user permissions across your organisation
  </Card>

  <Card title="Compliance Validation" icon="clipboard-check">
    Verify Entra AD configuration meets compliance requirements
  </Card>

  <Card title="Device Management" icon="computer">
    Monitor device enrollment and compliance status
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Access ThreatAware Integration Settings">
    Open ThreatAware and navigate to **Integrations** > **Microsoft Entra AD**.
  </Step>

  <Step title="Click Authorize Button">
    Click the **Authorize** button to initiate the OAuth authorization process.

    This will redirect you to Microsoft's authorization page where you'll grant ThreatAware permission to access your Entra AD environment.
  </Step>

  <Step title="Log in with Global Admin Credentials">
    You will be prompted to log in to your Microsoft account:

    * Use your **Global Administrator** or **Company Administrator** credentials
    * Ensure the account you use has sufficient permissions to authorise third-party applications

    <Warning>
      Only accounts with Global Administrator or Company Administrator permissions can authorise this integration. Using other account types will result in authorization failure.
    </Warning>
  </Step>

  <Step title="Review and Accept Permissions">
    On the Microsoft authorization page:

    * Review all requested permissions for ThreatAware
    * Accept the necessary permissions by clicking **Accept** or **Consent**
    * You may be asked to consent on behalf of your organisation
  </Step>

  <Step title="Verify Authorization Success">
    After completing authorization:

    * You will be redirected to a ThreatAware page indicating success or failure
    * If successful, the integration is automatically configured
    * Close the page and return to ThreatAware
  </Step>

  <Step title="Verify Connection">
    Confirm the integration is active:

    * Navigate to **Integrations** in ThreatAware
    * Check that Microsoft Entra AD shows **Active** status
    * Wait for the initial data synchronization to complete
  </Step>
</Steps>

## Authorization requirements

<AccordionGroup>
  <Accordion title="Required Permissions" icon="shield-check">
    **Global or Company Administrator Account**

    Only accounts with these roles can authorise the integration:

    * **Global Administrator**: Full permissions across the entire tenant
    * **Company Administrator**: Tenant-wide administrative permissions

    Other roles (such as Directory Readers or User Administrators) do not have sufficient permissions to authorise OAuth applications.
  </Accordion>

  <Accordion title="Permission Details" icon="book">
    **Microsoft Graph API Permissions**

    ThreatAware requests the following permissions:

    * Read user profiles and directory information
    * Read group memberships and organisational structure
    * Read device information (if using device management)
    * Read conditional access policies and security configurations

    For detailed information on specific permissions, refer to the [Microsoft Graph API Required Permissions Documentation](https://docs.microsoft.com/en-us/graph/permissions-reference).
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Integrations** in ThreatAware
   * Confirm Microsoft Entra AD shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait up to 60 minutes for initial data synchronization
   * Search for known users or groups in ThreatAware
   * Verify the directory information matches your Entra AD environment

3. **Test Queries**
   * Create a test query to filter users from Entra AD
   * Verify user and group data is being collected correctly

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authorization Failure" icon="triangle-exclamation">
    **Symptoms**: Authorization page shows error or closes without completing

    **Solutions**:

    * Confirm you are using a Global Administrator or Company Administrator account
    * Check that the account is not restricted by conditional access policies
    * Verify the account is not a guest account in the tenant
    * Try authorization in an incognito/private browser window
    * Check browser cookies and cache aren't blocking the authorization
  </Accordion>

  <Accordion title="Permission Errors" icon="ban">
    **Symptoms**: Integration shows active but no data appears

    **Solutions**:

    * Verify the admin account had all required permissions when authorising
    * Check that ThreatAware's registered application has necessary permissions in Entra AD
    * Go to **Enterprise Applications** in Entra AD and check ThreatAware's permissions
    * Re-authorise if application permissions were recently changed
    * Review [Microsoft Graph API Required Permissions](https://docs.microsoft.com/en-us/graph/permissions-reference) documentation
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify your network connectivity is stable
    * Check firewall rules allow access to Microsoft Graph API endpoints
    * Confirm Entra AD service is operational
    * Try re-authorising the integration
    * Check for regional cloud restrictions if using government or sovereign clouds
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no user or directory data appears

    **Solutions**:

    * Verify there are users and groups in Entra AD to collect
    * Check if the authorised admin account was recently removed or disabled
    * Review conditional access policies that might affect the integration
    * Wait for the next sync cycle (typically hourly)
    * Review ThreatAware integration logs for errors
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Microsoft Graph API Documentation" icon="book" href="https://docs.microsoft.com/en-us/graph/">
    Official Microsoft Graph API documentation and reference
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Authorization Best Practices**

  * Use a dedicated Global Administrator account for authorization if possible
  * Document who authorised the integration and when
  * Periodically review application permissions in Entra AD
  * Ensure the authorising account remains active (don't disable it afterward)
</Tip>

<Tip>
  **Security Considerations**

  * Verify ThreatAware's application permissions match minimum required
  * Regularly audit ThreatAware's access in your Entra AD audit logs
  * Monitor for unauthorized or unusual data access patterns
  * Follow your organisation's least privilege principles
</Tip>