Microsoft Entra ID
Connect Microsoft Entra ID to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Microsoft Entra ID to collect identity & sso evidence automatically.
| Category | Identity & SSO |
| Connect with | OAuth, API token |
| What a connection produces | Automated evidence collection |
Connect with OAuth
Before you start, an administrator of Microsoft Entra ID must allow third-party apps:
- If you connect with Safeguard's OAuth sign-in instead, an administrator must grant tenant-wide consent: sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator (Privileged Role Administrator for Microsoft Graph application permissions).
- Browse to Entra ID › Enterprise apps › All applications, search for and select Safeguard's application, select Permissions under Security, review the permissions, and select Grant admin consent.
- Alternatively open https://login.microsoftonline.com/\{tenant-id\}/adminconsent?client_id=\{Safeguard client ID} and approve.
- On Compliance › Connectors, open Microsoft Entra ID, click Connect and choose OAuth.
- Sign in to Microsoft Entra ID and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for
https://graph.microsoft.com/.default,offline_access. - You return to Safeguard, and the card shows Verified once the first check succeeds.
Connect with an API token
-
In Microsoft Entra ID:
- Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) and browse to Entra ID › App registrations, then select New registration.
- Enter a Name (for example Safeguard reader), under Supported account types select Single tenant only - <your tenant>, and select Register.
- On the app's Overview page, record the Application (client) ID.
- Select Certificates & secrets › Client secrets › New client secret, add a description, choose an expiration (24 months at most; Microsoft recommends under 12), and select Add.
- Copy the client secret Value now; it is never displayed again after you leave the page.
- On the app registration, select API permissions under Manage and add the Microsoft Graph application permissions Safeguard needs.
- Select Grant admin consent and confirm. Granting consent for Microsoft Graph application permissions requires a Privileged Role Administrator.
Where to find the other values:
- Application (client) ID: The app registration's Overview page shows the Application (client) ID.
- Directory (tenant) ID: Entra ID › App registrations, select your application: the app's overview page shows the Directory (tenant) ID.
Microsoft Entra ID shows the secret only once, so copy it before you leave the page.
Microsoft Entra ID's public documentation does not cover every step.
Registering the app needs at least the Application Developer role. Microsoft recommends a certificate over a client secret for production; client secrets expire after at most 24 months and collection stops when the secret expires. The exact Add-a-permission dialog labels were not on the fetched pages. The optional Graph access token is short-lived. Verification removed the Directory.Read.All permission name (not on the fetched pages) and sourced the tenant ID location from Microsoft's service principal guide.
Source: learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.
-
On Compliance › Connectors, open Microsoft Entra ID, click Connect, choose API token and fill in:
Field What to enter Directory (tenant) ID Required. Application (client) ID Required. Client secret Required. Stored encrypted and never shown again. Graph access token (optional) Alternative to app credentials: paste a Microsoft Graph token with Directory.Read.All. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Microsoft Entra ID and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.1, A1.2, C1.1, CC2.3, CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC7.3 | 139 |
| ISO/IEC 27001 | Automated tests | A.5.15, A.5.16, A.5.17, A.5.18, A.5.19, A.5.24, A.6.5, A.8.1, A.8.2, A.8.3, A.8.5, A.8.6, A.8.7, A.8.8, A.8.9, A.8.13, A.8.15, A.8.16, A.8.20, A.8.24 | 139 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d), 164.312(e)(1) | 134 |
| PCI DSS | Automated tests | 1.3.1, 2.2.1, 3.5.1, 3.7.4, 4.2.1, 5.2.1, 6.3.3, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.4.1, 8.4.2, 8.6.3, 10.2.1, 10.3.2, 10.4.1, 10.5.1, 11.3.1, 11.5.1, 11.5.2 | 127 |
| NIST CSF 2.0 | Automated tests | DE.CM-01, DE.CM-03, DE.CM-09, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-11, PR.IR-01, PR.PS-01, PR.PS-02, PR.PS-04, RS.CO-02 | 139 |
| CIS Microsoft Azure Foundations Benchmark | Automated tests | 2.1.2, 2.1.9, 2.1.10, 2.1.12, 2.1.13, 2.1.17, 2.1.18, 2.1.19, 2.1.20, 2.1.21, 3.2, 3.3, 3.5, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.16, 4.1.1, 4.1.3, 4.1.4, 4.1.6, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.5.1, 4.5.2, 4.5.3, 5.1.3, 5.1.4, 5.1.5, 5.1.7, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.3.1, 5.5, 6.3, 6.5, 6.6, 7.1, 7.2, 7.3, 7.4, 7.9, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9, 9.10 | 72 |
For a CIS benchmark, the numbers are its recommendations.
These tests are switched on per workspace by the Safeguard team.
Azure Government, Microsoft Azure connect to the same provider as Microsoft Entra ID, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks