Overview
The Microsoft Entra ID integration (formerly Azure Active Directory) monitors your organization’s user directory, MFA registration, conditional access policies, application assignments, and sign-in logs. LowerPlane uses read-only Microsoft Graph API access.Authentication
Microsoft Entra ID uses OAuth 2.0 via the Microsoft identity platform. You can connect using either:- OAuth (Recommended)
- App Registration (Manual)
Click Connect in LowerPlane and authorize with a Global Administrator or Security Reader account. LowerPlane handles the app registration automatically.
How to Find Your Tenant ID
1
Sign in to Azure Portal
Go to the Azure Portal and sign in with your admin account.
2
Open Microsoft Entra ID
Under Azure Services on the home page, select Microsoft Entra ID. If you don’t see it, search for “Microsoft Entra ID” in the top search bar.
3
Copy Tenant ID
In the Overview section, find the Basic Information panel. Your Tenant ID is displayed there — copy it.
4
Enter in LowerPlane
Paste the Tenant ID into the LowerPlane integration settings when connecting.
Required Permissions (Microsoft Graph)
All permissions are read-only (
.Read.All). LowerPlane never modifies users, groups, policies, or any other directory data.What LowerPlane Collects
User Directory
All Entra ID users with profile data: name, email, department, job title, account status, creation date, and last sign-in.
MFA Registration
Per-user authentication method registration: Microsoft Authenticator, FIDO2 keys, phone, email, and Windows Hello.
Conditional Access
Conditional access policies including MFA requirements, location-based access, device compliance, and risk-based policies.
Sign-In Logs
Sign-in activity including successful and failed authentications, locations, device info, and risk levels.
Groups & Roles
Security groups, Microsoft Office 365 groups, and directory role assignments for access certification.
Enterprise Applications
Registered enterprise applications and service principals with user assignments.
Security Tests
LowerPlane runs automated tests against your Entra ID tenant:Cross-IdP MFA Passthrough
When Entra ID enforces MFA via conditional access policies, LowerPlane automatically passes MFA-related tests for downstream services authenticated via Microsoft SSO (e.g., GitHub Enterprise, Slack, Salesforce).Connecting
1
Navigate to Integrations
Go to Settings > Integrations and find Microsoft Entra ID under Identity Providers.
2
Click Connect
Click the Connect button. You will be redirected to Microsoft’s authorization page.
3
Authorize
Sign in with a Global Administrator or Security Reader account. Review the requested permissions and click Accept.
4
Initial Sync
LowerPlane syncs your user directory, MFA registration, conditional access policies, and sign-in logs. This typically takes 2-5 minutes.
Evidence Artifacts
Compliance Mapping
Data Access
Troubleshooting
MFA status shows unregistered but users have MFA
MFA status shows unregistered but users have MFA
Entra ID distinguishes between MFA registration (the user has set up a factor) and MFA enforcement (a conditional access policy requires it). LowerPlane checks registration status via the
authenticationMethods API. If users authenticate via a federated IdP (e.g., Okta SSO into M365), their Entra ID MFA registration may be empty because MFA is handled by the federated IdP.Sign-in logs are empty or incomplete
Sign-in logs are empty or incomplete
Sign-in logs require Microsoft Entra ID P1 or P2 (Premium). Free and Office 365 tiers only retain sign-in logs for 7 days and may not expose them via the API.
Sync fails with 'insufficient privileges'
Sync fails with 'insufficient privileges'
Verify the app registration has the correct API permissions and that admin consent has been granted. Check API permissions in the app registration — the status column should show “Granted for [tenant]”.