Connect Microsoft Entra ID

Before you start

You need the Microsoft Entra admin rights described below, and in Trusterio the right to manage integrations (owners and admins have it). Anybody else sees the page read-only.

Connect it

1. Open Automation and choose Connect on the Microsoft Entra card. (The link opens the dialog straight away.)
2. Give it a name under What to call it, and read What to grant: every permission and what it is for.
3. Press Add it and enter the credential. You land on the connection’s own page.

In the Entra admin centre

1. Under Entra ID → App registrations, create a new registration, single tenant.
2. Under API permissions, add Microsoft Graph Application permissions (not delegated): User.Read.All, Policy.Read.All and RoleAssignmentSchedule.Read.Directory.
3. Press Grant admin consent, which needs at least a Privileged Role Administrator. Without it every reading is refused.
4. Under Certificates & secrets, create a client secret and copy its value, not its ID.

In Trusterio

Fill in Tenant ID, Client ID (Application ID) and Client Secret, and press Save credentials.

What it reads

Users and whether they are enabled, conditional access policies, the security defaults setting, and privileged role assignments.

Conditional access needs Microsoft Entra ID P1, and the risk policies P2. Without them those checks say they could not read the policies; the others still run.

What it checks

• A conditional access policy exists; MFA enforced for everybody and for admins
• Sign-in and user risk policies; legacy authentication blocked; security defaults
• Guest access reviewed, disabled accounts cleaned up, privileged role assignments reviewed

After it is connected

• Press Sync now for the first reading. The Tests tab shows each check: what it should be, what was found, and what is affected.
• New connections are read by hand until you choose a schedule: in Monitoring, on the Collection tab, pick Every hour, Every 6 hours, Daily or Weekly.
• The page says when it was last read and its health; Sync History keeps every run.

A connection marked Beta on the Automation screen has not been tried on a real account yet: its permission list is our reading of the provider’s documentation. AWS, Azure, Google Cloud and Jira have been. If a permission is wrong, tell us.

Disconnect

On the connection’s page, choose Disconnect. Reading stops and its credentials are deleted; its history, checks and evidence stay. Then remove what you created at the provider:

• Delete the app registration, or at least its client secret.