> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

> Sync users, MFA methods, directory roles, devices and risky users from Microsoft Entra ID through Microsoft Graph.

## Overview

Tierity connects to Microsoft Entra ID (formerly Azure AD) through Microsoft Graph with an app registration, syncs every 6 hours, and raises findings such as admins without MFA, leavers who are still enabled, risky users and non-compliant devices. See [Identity providers](https://docs.tierity.com/integrations/identity.md) for everything that's synced and checked.

## Prerequisites

* A Global Administrator or Privileged Role Administrator to grant admin consent
* Manage access (or higher) in Tierity

## Credentials required

| Field | Description |
| - | - |
| **Tenant ID** | Your Directory (tenant) ID |
| **Application (client) ID** | The ID of the app registration you create below |
| **Client secret** | A client secret for that app registration |
| **Employment status attribute** | Optional. The attribute your HR sync writes employment status to. Leave blank to detect it automatically; Entra ID's own leave date is always used when set. |

## Setup

**1. Register an app**

In the Microsoft Entra admin center, go to **App registrations → New registration**. Name it `Tierity`, leave the defaults, and register it. Copy the **Application (client) ID** and **Directory (tenant) ID** from the overview page.

**2. Add Microsoft Graph permissions**

Under **API permissions → Add a permission → Microsoft Graph → Application permissions**, add:

| Permission | Used for |
| - | - |
| `User.Read.All` | Users and their status |
| `AuditLog.Read.All` | Last sign-in and failed sign-ins |
| `UserAuthenticationMethod.Read.All` | MFA methods |
| `RoleManagement.Read.Directory` | Directory roles (admins) |
| `Device.Read.All` | Registered devices |
| `Application.Read.All` | App assignments |
| `User-LifeCycleInfo.Read.All` | Employee leave date |

Optional:

| Permission | Used for |
| - | - |
| `DeviceManagementManagedDevices.Read.All` | Intune device compliance |
| `IdentityRiskyUser.Read.All` | Risky users (requires Entra ID P2) |

Then click **Grant admin consent**.

**3. Create a client secret**

Under **Certificates & secrets → New client secret**, add a secret and copy its **Value** (not the secret ID).

**4. Connect in Tierity**

Go to **Config → Integrations → Microsoft Entra ID**, enter the tenant ID, client ID and secret, and click **Test connection**. The first sync starts straight away.

> [!WARNING]
>
> Client secrets expire. Note the expiry date and rotate the secret in Tierity before it lapses, or use a [secret reference](https://docs.tierity.com/features/secret-references.md) to a vault you already rotate.

## What Entra ID adds

* MFA strength from each user's registered authentication methods, with FIDO2 keys, passkeys and Windows Hello as phishing-resistant
* Directory roles, including Global Administrator and other privileged roles
* Device compliance from Intune when the optional permission is granted; otherwise directory devices
* Risky users from Identity Protection when the optional permission is granted
* Guest accounts, so you can see external users with access

## Disconnecting

Go to **Config → Integrations → Microsoft Entra ID** and click **Disconnect**, then delete the app registration or its secret in Entra.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.