What NHI monitoring reads and keeps
For a privacy review: what NHI monitoring reads from Microsoft Entra, what it keeps, for how long, and who can see it
This page lists what NHI monitoring reads from Microsoft Entra, what SecureAuth keeps and for how long, and who can see it. Use it for a privacy or security review before you connect a directory.
What SecureAuth reads
SecureAuth reads nothing until you connect a directory, and only after SecureAuth turns on NHI monitoring for your organization. Contact SecureAuth to turn it on. After that, SecureAuth syncs the directory every hour by default.
SecureAuth reads only the fields it needs from each object, through the Microsoft Graph permissions you grant the app registration:
| Permission | What SecureAuth reads |
|---|---|
Application.Read.All | Applications and service principals: names, IDs, owners, tags, created date, whether each is enabled, who can sign in, publisher, and secret and certificate names and expiry dates. Also app role grants and federated credentials. |
AgentIdentityBlueprint.Read.All | Agent identity blueprints: names, descriptions, publisher domain, owners and sponsors |
AgentIdentity.Read.All | Agent identities: names, IDs, the blueprint and app that created each one, owners and sponsors |
User.Read.All | Users and agent users: ID, name, sign-in name, email addresses, whether the account is enabled, created date, and user type |
Directory.Read.All | Your domain names and whether each is verified, and delegated permission grants: which app holds which permission, for everyone or for one user |
AuditLog.Read.All (optional) | Sign-in log entries for the agents SecureAuth found: the user, the app, the time, and the sign-in type |
AuditLogsQuery.Read.All (optional) | Microsoft Purview audit records of Copilot interactions with agent identities |
For owners and sponsors, SecureAuth reads the person's name, sign-in name, email address and whether their account is enabled.
What SecureAuth doesn't read
SecureAuth doesn't read mail, files, Teams, or SharePoint content, or the text of any Copilot conversation. It uses only each secret's and certificate's name and expiry date, never its value.
Purview records
Microsoft Purview keeps an audit log of activity across Microsoft 365, including each time someone uses a Copilot agent.
A Purview audit record can hold more than SecureAuth uses, such as file names or IP addresses. SecureAuth receives the whole record but keeps only three things from it: the agent, the user, and the time.
What SecureAuth creates in your tenant
SecureAuth never changes, disables, or deletes anything in your directory.
To read Purview records, it does create one thing in your tenant, outside the directory: an audit search.
Each search appears in your tenant's audit search history, named SecureAuth NHI agent usage followed by a timestamp.
SecureAuth starts at most one search every six hours, and only when the directory holds agent identities.
Without AuditLogsQuery.Read.All, it starts none.
How SecureAuth protects your client secret
SecureAuth encrypts the client secret you enter for the app registration and binds it to your organization. The console never shows the secret again after you save it. See Security and data handling for how stored credentials are encrypted.
Accounts added to your user list
SecureAuth adds people it finds in the directory to your organization's user list, matched by email address. It skips disabled accounts, people with no email address, and email addresses outside your verified domains, such as guests. It doesn't add agent users.
What SecureAuth keeps, and for how long
| Data | How long SecureAuth keeps it |
|---|---|
| Directory objects SecureAuth read | Until a complete sync no longer finds the object in your directory |
| Findings | Until 120 days after a finding is resolved |
| Agents, and who used each one with first and last seen | While the source stays connected |
Deleting the source deletes all of the data in this table. It doesn't remove the accounts SecureAuth added to your user list, or the audit searches already in your tenant.
Who can see the data
People in your organization see NHI data according to their role:
| Role | Access |
|---|---|
user | No NHI data |
viewer | All NHI data, read-only (view_nhi) |
admin | All NHI data, and can connect sources and triage findings (view_nhi, manage_nhi) |
A custom role can grant view_nhi or manage_nhi too.
Remove a directory
The source is the directory connection you added on the NHI Sources tab.
- Go to Discovery Sources and select the NHI Sources tab.
- Select Delete from the source's menu, then confirm.
- In Microsoft Entra, delete the app registration.