Microsoft Entra
Connect a Microsoft Entra tenant so SecureAuth reads its app registrations and agent identities and flags risky ones
App registrations and agent identities in Microsoft Entra often hold long-lived secrets and broad Graph permissions that nobody reviews. Connect the tenant as an NHI source, and SecureAuth reads those identities every hour and raises a finding for each one that breaks a rule. It only reads the directory and never changes it. To read Microsoft Purview audit records, it does start audit searches in your tenant, outside the directory: see What NHI monitoring reads and keeps.
Before you begin
- The NHI feature is turned on per organization. Contact SecureAuth to turn it on.
- Connecting a source needs the
manage_nhipermission.
Register an application
Register an application in your tenant. Grant it these Microsoft Graph application permissions, with admin consent:
| Permission | SecureAuth reads |
|---|---|
Application.Read.All | Applications, service principals, owners and app roles |
AgentIdentityBlueprint.Read.All | Agent identity blueprints |
AgentIdentity.Read.All | Agent identities |
User.Read.All | Users and agent users |
Directory.Read.All | Delegated permission grants |
AuditLog.Read.All (optional) | Sign-in logs, which show who each agent signed in as and in which mode. Needs Microsoft Entra ID P1 or P2. |
AuditLogsQuery.Read.All (optional) | Microsoft Purview audit records of Copilot interactions with agent identities |
When you add or edit a source, SecureAuth checks the required permissions and names any that are missing. If a required permission is removed later, the next sync stops at the first type of object it can't read, such as permission grants. The source then shows Error and the Findings tab stays empty.
The two audit log permissions are optional. Without either one, the sync still succeeds, but agents show no new usage from either log. The sign-in log also needs Microsoft Entra ID P1 or P2. See How each agent is used.
SecureAuth added Directory.Read.All to the required permissions after the first release.
If you connected a directory before then, add the permission to the app registration and grant admin consent again.
Until you do, each sync of that directory stops and the source shows Error.
Connect the tenant
- Navigate to Setup › Discovery Sources and open the NHI Sources tab
- Select Add NHI source and pick Microsoft Entra
- Enter the Directory (tenant) ID and Application (client) ID, both copied from the app registration
- Enter a Client secret, created under Certificates & secrets. Entra shows this value only once.
After you connect, the source shows as Authenticated or Error. To re-validate its credentials, select Check now from its menu.
Next steps
Your tenant's app registrations and agent identities now sync every hour, and each one that breaks a rule becomes a finding. Read what each finding means and how to triage it in Non-human identities.
- Discovery Sources overview – the other kind of source, coding agent telemetry