Overview
Tierity connects to Microsoft Entra ID (formerly Azure AD) through Microsoft Graph with an app registration, syncs every 6 hours, and raises findings such as admins without MFA, leavers who are still enabled, risky users and non-compliant devices. See Identity providers for everything that’s synced and checked.Prerequisites
- A Global Administrator or Privileged Role Administrator to grant admin consent
- Manage access (or higher) in Tierity
Credentials required
Setup
1
Register an app
In the Microsoft Entra admin center, go to App registrations → New registration. Name it
Tierity, leave the defaults, and register it. Copy the Application (client) ID and Directory (tenant) ID from the overview page.2
Add Microsoft Graph permissions
Under API permissions → Add a permission → Microsoft Graph → Application permissions, add:
Optional:
Then click Grant admin consent.
3
Create a client secret
Under Certificates & secrets → New client secret, add a secret and copy its Value (not the secret ID).
4
Connect in Tierity
Go to Config → Integrations → Microsoft Entra ID, enter the tenant ID, client ID and secret, and click Test connection. The first sync starts straight away.
What Entra ID adds
- MFA strength from each user’s registered authentication methods, with FIDO2 keys, passkeys and Windows Hello as phishing-resistant
- Directory roles, including Global Administrator and other privileged roles
- Device compliance from Intune when the optional permission is granted; otherwise directory devices
- Risky users from Identity Protection when the optional permission is granted
- Guest accounts, so you can see external users with access