Microsoft Entra ID

Connect Agent Identity Security to Microsoft Entra ID to discover users, use it as an identity provider, and receive or transmit security events via the Shared Signals Framework (SSF).

The Microsoft Entra ID integration connects Agent Identity Security to your Entra ID tenant to discover users, authenticate through an identity provider, and exchange security events via the Shared Signals Framework (SSF).

Microsoft Entra ID is the most versatile integration template it supports Identity Provider, SSF Receiver, and SSF Transmitter capabilities in a single instance. Agent Identity Security authenticates using an Azure AD app registration.

Prerequisites

Required credentials
Before you set up the integration in Agent Identity Security, gather the following credentials from your Microsoft Entra ID app registration:
  • Client ID: Also known as the Application ID. Found on the app registration overview page in the Microsoft Entra admin center.
  • Client Secret: The secret key used for authentication. Generated under Certificates & secrets in your app registration.
  • Tenant ID: Your Entra ID tenant identifier (Directory ID). Found on the app registration overview page.

Complete the app registration steps in the next section before configuring the integration in Agent Identity Security.

Application Registration

Phase 1: Register an application in Microsoft Entra ID
  1. Sign in to the Microsoft Entra admin center.

    Use an account with permissions to register applications in your tenant.

  2. Verify that you are working in the correct tenant.

    Check the tenant name displayed in the upper-right corner of the admin center. Switch tenants if needed before proceeding.

  3. Navigate to Microsoft Entra ID > App registrations.
  4. Select + New registration and configure the following settings:
    Table 1. App registration settings
    Setting Value
    Name Enter a descriptive name that identifies this registration. For example: Agent-Identity-Security-Entra-Integration
    Supported account types Select Accounts in this organizational directory only.
  5. Select Register to create the application.
  6. On the application overview page, copy and save the Application (client) ID and Directory (tenant) ID.

    You'll need both values when you configure the integration in Agent Identity Security.

  7. Create a client secret.
    1. In the left navigation, select Certificates & secrets.
    2. Under Client secrets, select + New client secret.
    3. Enter a description and select an appropriate expiration period.
    4. Select Add and immediately copy the secret value.
    Important: The client secret value is displayed only once. Copy and store it securely before navigating away from this page. You cannot retrieve it later.
  8. Grant the required API permissions.
    1. In the left navigation, select API permissions.
    2. Select Add a permission.
    3. Select Microsoft Graph, then select Application permissions.
    4. Under User, select User.Read.All.
    5. Select Add permissions.
    6. Select Grant admin consent for <your organization>.
    7. Select Yes on the confirmation dialog.

    Admin consent is required because User.Read.All is an application permission. Only a Global Administrator or Privileged Role Administrator can grant admin consent.

Configure the Integration in Agent Identity Security

Phase 2: Configure the integration in Agent Identity Security
  1. In Agent Identity Security, go to Integrations and select Add Integration.
  2. In the Integration Catalog, select Microsoft Entra ID.

    The Microsoft Entra ID configuration screen opens.

  3. Under Instance Details, enter the following:
    Table 2. Instance details
    Field Description
    *Instance Name A unique name for this integration instance.
    Description Optional. A description to identify the purpose or environment covered by this instance.
  4. Under Credentials, enter the values you collected during app registration:
    Table 3. Credentials
    Field Description
    *Tenant ID The Azure Active Directory tenant GUID (Directory ID) for the Microsoft 365 tenant where agents operate.
    *Client ID The Application (client) ID of the Azure AD app registration created for Agent Identity Security.
    *Client Secret The client secret value from the Azure AD app registration. Stored encrypted; never displayed after saving.
    * Mandatory fields
  5. Optional: Under SSF Receiver Streams, select Add Receiver Stream to configure receiving security events from Microsoft Entra ID.
  6. Optional: Under SSF Transmitter Streams, select Add Transmitter Stream to configure sending security events to Microsoft Entra ID.
  7. Review the configuration summary and select Test Configuration.

    Agent Identity Security validates the credentials against your Entra ID tenant. A checkmark indicates a successful connection.

  8. Select Create Instance.

    The integration instance is created and the browser redirects to the Integrations list.

Agent Identity Security connects to Microsoft Entra ID as an identity provider and begins discovering users. If SSF streams are configured, security events are received or transmitted according to your stream settings.

Go to Event Logs to verify that event flow is working as expected.