Microsoft Entra ID
Take read-only snapshots of your Microsoft Entra ID directory and turn them into identity and access evidence, access reviews and SaaS discovery.
At a glance
| Direction | Into Aegis. Read-only: Aegis never changes your directory. |
|---|---|
| What it brings in | Users, groups and group membership, directory role assignments, devices, enterprise applications (service principals), Conditional Access policies and sign-in activity. |
| Where it lands | A snapshot per sync on the connection. Each successful snapshot becomes one Evidence item, mapped to the identity and access controls of your frameworks and approved on creation as trusted connector output (a reviewer may still reject it). Snapshots also feed access reviews, segregation-of-duties checks and the discovered SaaS applications, which you can accept as vendors. |
| Credentials and permissions |
An app registration with a client secret (application permissions,
admin consent).
Directory.Read.All covers users, groups, role
assignments and devices. Add Policy.Read.All for
Conditional Access, Application.Read.All for
applications and AuditLog.Read.All for sign-in
activity; a missing one skips only that part and the snapshot is
marked partial.
|
| Owner of imported records | The evidence belongs to the person who created the connection. A vendor accepted from SaaS discovery and an access review belong to the person who accepted or started it. |
| When it runs |
Every 30 minutes (at :07 and :37), and on demand with
Sync now on the connection row. Access reviews are
checked daily.
|
| Set it up |
/connectors/entraid, by people allowed to configure
connectors, on a plan that includes the connector. The credentials
are tested against Microsoft before they are saved.
|
Good to know
- A failed sync produces no evidence: an outage is not proof of a control.
- This connector is separate from Entra ID single sign-on, which needs no Graph permissions of its own.
- The client secret never leaves the server once saved. When it expires, the connection shows the error; enter a new secret.
Where this connects
Sync-now and segregation-of-duties patterns are explained in Connectors; single sign-on in Connect Microsoft Entra ID.