Microsoft Entra SSO

Record your Microsoft Entra SSO connection as identity & sso evidence. Automated collection is not available for this provider yet.

Connect with OAuth

Before you start, an administrator of Microsoft Entra SSO must allow third-party apps:

• If you connect with Safeguard's OAuth sign-in instead, an administrator must grant tenant-wide consent: sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator (Privileged Role Administrator for Microsoft Graph application permissions).
• Browse to Entra ID › Enterprise apps › All applications, search for and select Safeguard's application, select Permissions under Security, review the permissions, and select Grant admin consent.
• Alternatively open https://login.microsoftonline.com/\{tenant-id\}/adminconsent?client_id=\{Safeguard client ID} and approve.

1. On Compliance › Connectors, open Microsoft Entra SSO, click Connect and choose OAuth.
2. Sign in to Microsoft Entra SSO and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for https://graph.microsoft.com/.default, offline_access.
3. You return to Safeguard, and the card shows Verified once the first check succeeds.

Connect with an API token

1. In Microsoft Entra SSO:

   1. Connect with Safeguard's Microsoft OAuth sign-in, or register an app and create a client secret as below (see also the Microsoft Entra ID connector).
   2. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) and browse to Entra ID › App registrations, then select New registration.
   3. Enter a Name (for example Safeguard reader), under Supported account types select Single tenant only - <your tenant>, and select Register.
   4. On the app's Overview page, record the Application (client) ID.
   5. Select Certificates & secrets › Client secrets › New client secret, add a description, choose an expiration (24 months at most; Microsoft recommends under 12), and select Add.
   6. Copy the client secret Value now; it is never displayed again after you leave the page.
   7. On the app registration, select API permissions under Manage and add the Microsoft Graph application permissions Safeguard needs.
   8. Select Grant admin consent and confirm. Granting consent for Microsoft Graph application permissions requires a Privileged Role Administrator.

   Where to find the other values:

   • Account / Org / Workspace (optional): Your Directory (tenant) ID, shown on the app's overview page (Entra ID › App registrations, select your application).

   Microsoft Entra SSO shows the secret only once, so copy it before you leave the page.

   Microsoft Entra SSO's public documentation does not cover every step.

   This generic token form does not match a Microsoft-issued credential; a Graph access token lasts about an hour, after which collection stops. Prefer OAuth or the Microsoft Entra ID connector's app-credential path. Verification removed the Directory.Read.All permission name and the claim about Microsoft token types (not on the fetched pages) and sourced the tenant ID location from Microsoft's service principal guide.

   Source: learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.

2. On Compliance › Connectors, open Microsoft Entra SSO, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Microsoft Entra SSO yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Identity & SSO connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks