--- title: Microsoft Entra ID slug: microsoft-entra-id description: The Microsoft Entra ID integration checks whether flagged credentials are still active in Entra ID and links to the affected user. It requires an app registration with directory read permissions. docTags: createdAt: 2025-04-12T01:21:20.697Z --- Flare connects to Microsoft Entra ID through an App Registration within your tenant, allowing you to check if credentials that Flare has flagged as potentially compromised remain active in your Entra ID system. If a credential is confirmed to be active, Flare provides **a direct link** to the corresponding user to mitigate potential security risks. ![](https://api.archbee.com/api/optimize/Q93vb8vwhK8JH38_YYNjh-7s-fGsaFr8tWaglfiCDYp-20250618-135043.png) # Required Permissions As currently implemented, the Microsoft App Registration used for the Entra ID integration must include Microsoft Graph API application permissions to read directory information. At a minimum, the following permission is required: - **Directory.Read.All** — allows reading basic directory information across the tenant. This permission enables the integration to retrieve user and directory data, enrich identity profiles, and support credential validation. ::::ExpandableHeading # StoryLane Demo :::Iframe{iframeHeight="0" code="
"} ::: :::: # Configuration :::::ExpandableHeading ## Microsoft-Side: App Registrations ::::WorkflowBlock :::WorkflowBlockItem Navigate to the [Microsoft Entra ID configuration blade](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) within your Azure Portal. In the left-hand sidebar, under the *Manage* section, select **App registrations**. ::: :::WorkflowBlockItem Click **New registration** in the top action bar. ::: :::WorkflowBlockItem Provide a descriptive and meaningful name for your new App Registration, such as **“Flare Entra ID Connector.”** ::: :::WorkflowBlockItem Select the first option, **Single tenant**, to restrict access to accounts within your organization only. ::: :::WorkflowBlockItem Click **Register** to create the application registration. ::: :::WorkflowBlockItem Copy the **Application (client) ID** value, as you will need it for the “Entra Client ID” field in Flare’s Entra ID configuration. Ensure that you keep this value *confidential*. ::: :::WorkflowBlockItem Copy the **Directory (tenant) ID value**, as you will need it for the “Entra ID Tenant ID” field in Flare’s Entra ID configuration. Ensure that you keep this value *confidential*. ::: :::WorkflowBlockItem In the left-hand menu, under the **Manage** section, click **API permissions**. ::: :::WorkflowBlockItem Click **Add a permission **to grant the App Registration the required permissions. ::: :::WorkflowBlockItem For each of the following [required permissions](https://docs.flare.io/microsoft-entra-id#dxKGW), select **Microsoft Graph** as the API and choose **Application permissions** as the permission type. If admin consent is required, ensure that it is granted. - **Directory.Read.All** ::: :::WorkflowBlockItem In the left-hand menu, under the **Manage** section, click **Certificates & secrets**. ::: :::WorkflowBlockItem In the **Client secrets** section, click **New client secret**. ::: :::WorkflowBlockItem Provide a clear and descriptive name for the new client secret to indicate its purpose. ::: :::WorkflowBlockItem Set the expiration period for the client secret according to your organization’s security requirements. ::: :::WorkflowBlockItem Click **Add** to create the client secret. ::: :::WorkflowBlockItem Copy the secret ***value***, as you will need for the “Entra ID Client Secret” field in Flare’s Entra ID configuration. Ensure that you keep this value *secure* and *confidential*. ::: :::: ::::: ## Microsoft-Side: Enterprise apps ::::WorkflowBlock :::WorkflowBlockItem Navigate to the [Microsoft Entra ID configuration blade](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) within your Azure Portal. In the left-hand sidebar, under the *Manage* section, select **Enterprise applications**. ::: :::WorkflowBlockItem Select the app you just configured in the list of all applications. ::: :::WorkflowBlockItem Select “Permissions” from the “Security” section of the menu. ::: :::WorkflowBlockItem Click on the “Grand admin consent” button. ::: :::WorkflowBlockItem In the popup, confirm your account then review the requested permissions. Click “Accept” to grant them. ::: :::: :::::ExpandableHeading ## Flare-Side ::::WorkflowBlock :::WorkflowBlockItem In the left-hand sidebar, under the **Configure** section, click **Integrations**. ::: :::WorkflowBlockItem Click **Add Integration** in the top-right corner. ::: :::WorkflowBlockItem Select **Microsoft Entra ID** as the Integration Type. ::: :::WorkflowBlockItem Enter a name for the integration, for example, Entra ID. ::: :::WorkflowBlockItem Enter the **Application (client) ID** obtained from the Microsoft Entra ID configuration steps into the “Entra ID Client ID” field. ::: :::WorkflowBlockItem Enter the secret ***value*** obtained from the Microsoft Entra ID configuration steps into the “Entra ID Client Secret” field. ::: :::WorkflowBlockItem Enter the **Directory (tenant) ID** obtained from the Microsoft Entra ID configuration steps into the “Entra ID Tenant ID” field. ::: :::WorkflowBlockItem Enable the associated Automated and Manual permissions (note: Make sure you setup the proper permissions in Entra ID for each permission). Optional: Flare offers the ability to restrict remediation to specific Entra ID groups. Enter a Group ID to limit that remediation scope to just that group. ::: :::WorkflowBlockItem Click **Test Integration** to validate the information entered is correct. ::: :::WorkflowBlockItem Click **Save** to apply your configuration changes. ::: :::: ::::: :::::ExpandableHeading # Usage ::::WorkflowBlock :::WorkflowBlockItem The validation and remediation feature is accessible through the **Credentials Browser**. ::: :::WorkflowBlockItem Ensure that you select the **Tenant Feed**, as this feature is only available on a tenant basis. ::: :::WorkflowBlockItem Select a credential entry from the list to open the **Details** view. ::: :::WorkflowBlockItem In the **Details** view, click **Validate** to initiate the validation process. ::: :::WorkflowBlockItem The system will perform the validation and display the status. You’re all set! ::: :::: ::::: # Related Articles :::CtaButton{label="Splunk Integration" docId="ca9Opdt4_IFgL1pu8HBSU" openInNewTab="true"} ::: :::CtaButton{label="Jira Integration" docId="KxvmCnotECpsBlK_YPofr" openInNewTab="true"} :::