Connect Microsoft Entra ID (identity audit)

A read-only, app-only Graph connection focused on the identity layer: MFA enforcement, Conditional Access, admin sprawl, and dormant accounts.

1. 1Set up the Cybermatic Microsoft Entra ID Scanner. This connector uses an app-only Microsoft Graph connection. There is no interactive user login, so the app registration must use Application permissions, not Delegated permissions. Microsoft confirms that application permissions operate without a signed-in user. Values you will collect — keep a secure note open and record these three values: Cybermatic field → Microsoft Entra field Directory Tenant ID → Directory (tenant) ID Application Client ID → Application (client) ID Client Secret → Value from the client secret Do not use: • Object ID • Secret ID • Application object ID
2. 2Step 1 — Sign in to the correct Microsoft tenant. 1. Open the Microsoft Entra admin center. 2. Sign in using either: Global Administrator, or Privileged Role Administrator 3. At the top of the page, select the Settings or directory-switching control. 4. Confirm that the selected tenant is the organization you want Cybermatic to scan. 5. If the wrong tenant is displayed, select Switch directory and choose the correct tenant. Microsoft's current interface places application registrations under Entra ID → App registrations and recommends confirming the active tenant before creating the application. If your administrator role is managed through Privileged Identity Management, activate the role before continuing.
3. 3Step 2 — Create the app registration. 1. In the left menu, select Entra ID. 2. Select App registrations. 3. Select New registration. 4. Enter the following: Name: Cybermatic Entra ID Scanner Supported account types: select Single tenant only default directory Redirect URI: leave this completely blank. 5. Select Register. A redirect URI is unnecessary because Cybermatic uses app-only authentication rather than an interactive user sign-in. Microsoft recommends the single-tenant selection for applications intended for one organization.
4. 4Step 3 — Record the Tenant ID and Client ID. After registration, Microsoft opens the app's Overview page. Copy these two values: 1. Directory (tenant) ID 2. Application (client) ID Record them like this: Tenant ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Client ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Do not copy either of these: Object ID Managed application in local directory The Application (client) ID identifies the application. The Directory (tenant) ID identifies the Microsoft Entra tenant where the app was created.
5. 5Step 4 — Remove the default Delegated permission. 1. In the app's left menu, select API permissions. 2. Look for a permission named: User.Read 3. Check its Type. If it shows Delegated, remove it: 1. Select the permission row or the menu beside it. 2. Select Remove permission. 3. Confirm the removal. New app registrations can receive the delegated User.Read permission by default. This scanner does not need it because it authenticates without a signed-in user.
6. 6Step 5 — Add Microsoft Graph Application permissions. 1. Remain on API permissions. 2. Select Add a permission. 3. Select Microsoft Graph. 4. Select Application permissions. Do not select Delegated permissions. 5. Search for and select each of the following five permissions. Permission 1 — User.Read.All Search for: User.Read.All Expand User, and select: User.Read.All — Read all users' full profiles Cybermatic uses this to read users, account status, user type, guest status, and related profile properties. Permission 2 — Directory.Read.All Search for: Directory.Read.All Expand Directory, and select: Directory.Read.All — Read directory data Cybermatic uses this for directory-wide identity information and administrative-role analysis. Microsoft lists RoleManagement.Read.Directory as the narrower permission for listing directory roles alone. However, use Directory.Read.All here because it is the permission specified by the Cybermatic connector and may support additional related directory checks. Permission 3 — Policy.Read.All Search for: Policy.Read.All Expand Policy, and select: Policy.Read.All — Read your organization's policies Cybermatic uses this to read: • Conditional Access policies • MFA requirements • Legacy-authentication blocking policies • Security Defaults status Microsoft identifies Policy.Read.All as the application permission for reading Conditional Access policies and the Security Defaults policy. Permission 4 — UserAuthenticationMethod.Read.All Search for: UserAuthenticationMethod.Read.All Expand UserAuthenticationMethod, and select: UserAuthenticationMethod.Read.All Cybermatic uses this to determine which users have authentication methods registered. This permission allows app-only retrieval of users' registered authentication methods. It does not give the application permission to change those methods. Permission 5 — AuditLog.Read.All Search for: AuditLog.Read.All Expand AuditLog, and select: AuditLog.Read.All — Read all audit log data Cybermatic uses this with User.Read.All to retrieve sign-in activity and identify inactive accounts. Microsoft requires both AuditLog.Read.All and User.Read.All to access the user sign-in activity used for inactive-account analysis. Add the selected permissions After selecting all five: 1. Select Add permissions. 2. Return to the API permissions page. Your list should now contain: User.Read.All Directory.Read.All Policy.Read.All UserAuthenticationMethod.Read.All AuditLog.Read.All Check the Type column. Every row must show: Application There should be no remaining Delegated permissions.
7. 7Step 6 — Grant administrator consent. Adding permissions does not activate them. You must grant consent for the organization. 1. On the API permissions page, select: Grant admin consent for [Your Organization] 2. Review the permissions in the confirmation window. 3. Select Yes. 4. Select Refresh if the page does not immediately update. Confirm that every permission shows a green status similar to: Granted for [Your Organization] Because these are Microsoft Graph Application permissions, a Privileged Role Administrator or Global Administrator should perform the consent. Cloud Application Administrator and Application Administrator cannot generally grant Microsoft Graph application permissions. If the consent button is disabled, check the following: 1. Confirm you are in the correct tenant. 2. Confirm your Global Administrator or Privileged Role Administrator role is active. 3. If you use PIM, activate the role and reload the page. 4. Sign out and back in after activating the role. 5. Return to: Entra ID → App registrations → Cybermatic Entra ID Scanner → API permissions Do not continue until all five permissions show Granted.
8. 8Step 7 — Create the client secret. 1. In the app's left menu, select Certificates & secrets. 2. Select the Client secrets tab. 3. Select New client secret. 4. For Description, enter: Cybermatic Entra ID connection 5. Under Expires, choose 730 days (24 months). A practical choice is 24 months, provided you create a reminder to rotate the secret before it expires. 6. Select Add. A new row appears. Immediately copy the Value — copy the content under: Value Do not copy: Secret ID Record it securely: Client secret Value: ____________________________________ The secret Value is displayed only once. After you leave or refresh the page, Microsoft will no longer display it. If you already left the page — the existing secret cannot be revealed again: 1. Delete the unusable secret. 2. Select New client secret. 3. Create another secret. 4. Copy the new Value immediately. Microsoft recommends certificates or federated credentials over client secrets for production applications. Cybermatic currently requires the secret-based fields described here, so protect the secret carefully and rotate it before expiration.
9. 9Step 8 — Connect Microsoft Entra ID in Cybermatic. 1. Sign in to Cybermatic. 2. Open Connections. 3. Locate Connect a cloud or SaaS account. 4. Select: Microsoft Entra ID 5. Enter the values as follows: Directory (tenant) ID — paste the Directory (tenant) ID Application (client) ID — paste the Application (client) ID Client secret — paste the Client secret Value 6. Check for accidental spaces before or after each value. 7. Select Connect. Do not paste the Object ID or Secret ID into any Cybermatic field.
10. 10What Cybermatic checks. • MFA enforcement: whether security defaults or a Conditional Access policy actually requires MFA — and flags a Critical finding if nothing does. • Legacy authentication: whether IMAP/POP/ActiveSync-style protocols that bypass MFA are blocked. • Administrator sprawl: Global Administrator count against Microsoft's fewer-than-five guidance, plus every privileged account without a registered MFA method (Critical). • MFA registration coverage across all users. • Guest accounts accumulating in the directory. • Enabled accounts with no sign-in for 90+ days (requires Entra ID P1 sign-in activity; skipped quietly on Free tier). Everything is read-only — this app cannot change a single setting in your tenant.
11. 11Troubleshooting. "Entra ID auth failed: 401" — the client secret is wrong or expired, or the Secret ID was pasted instead of the Value. Create a fresh secret and update the connection (Connections → Update credentials). "Entra ID auth failed: 400" — the Tenant ID or Client ID is malformed; re-copy both from the app's Overview page. Findings seem incomplete — confirm admin consent shows Granted on all five permissions; the scanner skips checks it lacks permission for rather than failing. Already connected Microsoft 365? Keep both: the M365 connector audits your tenant's collaboration surface (mailboxes, sharing, devices), while this one audits the identity layer's own controls in depth. They complement, not duplicate.

Tip: The single highest-value check here is MFA enforcement — if security defaults are off and no Conditional Access policy requires MFA, nothing does, and that's the finding to fix the same day.