Microsoft Entra ID

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Microsoft Entra ID using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules. Compliance checks re-run once a day at 02:00 America/New_York.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Microsoft Entra ID environment.

What DSALTA reads

DSALTA reads the Microsoft Entra ID user roster — names, emails, the Entra account type that fills the role column (Member, Guest or User) and active status, which appear on your Access page. It also reads your directory groups and their members, which populate the Groups tab of your People page.It calls these Microsoft Entra ID endpoints:

/organization
/users
/groups
/groups/{groupId}/members
/reports/authenticationMethods/userRegistrationDetails
/policies/identitySecurityDefaultsEnforcementPolicy
/identity/conditionalAccess/policies

Permissions the checks require: User.Read.All, Group.Read.All, Directory.Read.All, Policy.Read.All, AuditLog.Read.AllEvery request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Microsoft Entra ID environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Microsoft Entra ID card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Microsoft Entra ID. This usually happens when API tokens expire.

Data is not syncing

Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

Microsoft Entra ID offers 2 ways to connect. Microsoft Entra ID SSO is recommended.

Microsoft Entra ID SSO (recommended)
Manual credentials

Enter your Tenant ID, then sign in with Microsoft and approve access as an administrator. DSALTA only reads directory data for compliance. You do not enter a client secret here.Before you begin

Microsoft Entra ID (Azure AD) Global Administrator or Privileged Role Administrator
Permission to grant admin consent for application permissions
If admin consent succeeds in Microsoft but the connection still fails, the problem is on DSALTA’s side, not in your tenant — contact DSALTA support rather than changing anything in Microsoft Entra ID.

You will need:

Field	Where to find it	Example
Tenant ID	Find this in Azure Portal → Microsoft Entra ID → Overview. · Open	`0bf1f4c0-0d4c-405f-839b-b391a5ef0221`

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Microsoft Entra ID, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Integrating Microsoft Entra ID with DSALTA means

DSALTA will read your Microsoft Entra ID (Azure AD) directory to sync users and groups, and to read your Security Defaults setting and Conditional Access policies for compliance monitoring.DSALTA uses read-only permissions and never modifies your directory configuration.

Enter your Tenant ID

Enter your Microsoft Entra ID Tenant ID. You can find it in Azure Portal → Microsoft Entra ID → Overview → Tenant ID.

After you enter your Tenant ID, click Connect and sign in with a Global Administrator (or Privileged Role Administrator) account. Approve access for the DSALTA app.Directory read permissions requested at this sign-in: User.Read, Group.Read.All, Directory.Read.All, RoleManagement.Read.Directory, Policy.Read.All — plus openid, profile and offline_access for the sign-in itself.

You must sign in with a Global Administrator or Privileged Role Administrator account.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Failed to connect. Ensure admin consent was granted.The on-screen message is generic — see Connection error messages.

Register your own app in Microsoft Entra ID, then enter Tenant ID, Application (Client) ID, and the client secret. Use this when your security policy does not allow the Microsoft Entra ID SSO option above.Before you begin

Permission to register applications in Microsoft Entra ID
Permission to grant admin consent for application permissions
Prefer “Microsoft Entra ID SSO” unless your policy requires your own app registration

You will need:

Field	Where to find it	Example
Tenant ID	See the steps below	`0bf1f4c0-0d4c-...`
Application (Client) ID	See the steps below	`4b30d3a0-1956-...`
Client Secret	Azure lists Secret ID (UUID) and Value. Only the Value works. Error AADSTS7000215 = wrong value, expired secret, or Secret ID pasted by mistake.	—

Start in DSALTA

Log in to Azure Portal → Microsoft Entra ID → App registrations → New registration.Enter the name: dsalta-entra-app. Leave supported account types as default. Click Register.Note the Application (Client) ID and Directory (Tenant) ID.

Create Client Secret

Open the app → Certificates & secrets → New client secret.Enter a description (e.g. DSALTA Secret). Set expiry to 24 months. Click Add.Critical: Copy the Value field — the long string Azure shows once. Do not copy the Secret ID (a UUID in the left column). Error AADSTS7000215 (Invalid client secret) almost always means the Secret ID was pasted, the Value expired, or there are extra spaces.

Diary the secret’s renewal. When the client secret expires, every Microsoft Graph call starts failing authentication and the integration goes to Disconnected. DSALTA has no Reconnect button — the only repair is Disconnect and connect again, which permanently deletes the access records and test results collected from Microsoft Entra ID. Renewing the secret in Azure alone does not help, because DSALTA stores the old value.

Configure API permissions

Go to API permissions → Add a permission → Microsoft Graph → Application permissions.Add: User.Read.All, Group.Read.All, Directory.Read.All, Policy.Read.All, AuditLog.Read.All.Click Grant admin consent for Default Directory.Granting admin consent here requires the Privileged Role Administrator role (or Global Administrator). These are Microsoft Graph application permissions, and Microsoft excludes them from what an Application Administrator or Cloud Application Administrator may consent to — “Cloud Application Administrator, AI Administrator, or Application Administrator, for granting consent for apps requesting any permission for any API, except Microsoft Graph app roles (application permissions)”. If the Grant admin consent button is grayed out or errors, this is why.

Two permissions are easy to miss and each breaks something specific. Without Policy.Read.All, the MFA should be enabled for all users check cannot read Security Defaults or your Conditional Access policies and returns a missing-permission result. Without AuditLog.Read.All, the MFA column on the Access page stays Unknown for every user — DSALTA skips the authentication-methods report silently rather than reporting an error.

Enter credentials

Enter the Tenant ID, Application (Client) ID, and Client Secret. Click Connect.

If the connection is rejected. Failed to connect. Verify credentials and admin consent.The on-screen message is generic — see Connection error messages.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
MFA should be enabled for all users	Info	Checks that MFA is enabled for all Microsoft Entra ID users.
User access to Critical System should be valid	Info	Checks that everyone with Microsoft Entra ID access is an active employee on the People page.
Offboarded users should not have active access	High	Checks that offboarded employees no longer have active Microsoft Entra ID access.

Topic	Link
Setup	Microsoft Graph API Permissions
Setup	Register an application
Setup	Microsoft — Grant tenant-wide admin consent to an application
Setup	Microsoft Graph — List userRegistrationDetails
General	Microsoft Entra ID website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting