This connector queries the Microsoft Graph API on the users, devices, and directoryRoles endpoints to generate indicators on users, their logins, their equipment, and the administrators of the Microsoft tenant. Its configuration is intended for pilots in charge of integrations in Tenacy.
This connector retrieves several types of information:
Account indicators: number of active users, active guests, dormant accounts, and number of global administrators.
Device indicators: number of active devices.
Information to configure:
OS version: number of devices by OS.
User groups: number of users in each group.
Adding and configuring the connector
To add this connector, go to Catalog > Connectors > Microsoft Entra ID > Add a connector.
After adding, you need to configure:
Operator perimeter: the perimeter from which the connector is configured, and which applies its own management rules to the retrieved data.
Frequency: frequency of automatic querying of the Microsoft API and frequency of associated indicators. This frequency can be daily, weekly, monthly, semi-annual, or annual.
Once the connector is created, you must then register the Tenacy application in Microsoft by following the procedure for your instance and granting the following permissions to the secret:
Directory.Read.All
AuditLog.Read.All
🔍Procedure to register the application in Microsoft depending on your instance:
Documentation for shared instances
For dedicated environments, the link to follow will be https://yourinstancename.tenacy.io/doc/it-ms-graph
If you're not sure which environment type applies to your organization, Tenacy support can confirm it for you.
You will then need to enter the following information, from the Microsoft application registration, into the connector configuration window:
Application ID
Application Secret
Client ID
Dormant accounts inactivity delay: expressed in days, it lets you configure the delay for detecting an account that hasn't logged in for a certain number of days or more.
⚠️ To obtain the number of dormant accounts, you must have at least a Microsoft Entra ID Premium P1 subscription. Without this subscription, the connector's other indicators remain available as normal.
Running your first test
Once the connector is properly configured, test the integration by running the first execution.
Go to ⚙️ > Connectors > Click on the connector > Run now:
💡 Feel free to contact Tenacy support if you have any questions about this.
FAQ
What happens if I don't have a Microsoft Entra ID Premium P1 subscription?
The connector keeps working normally for all other indicators (active users, active guests, devices, global administrators). Only the dormant accounts indicator requires at least a Premium P1 subscription to be available.
What's the difference between account indicators and device indicators?
Account indicators cover users and administrators of the Microsoft tenant (active, guests, dormant, global admins). Device indicators cover the connected hardware fleet (number of active devices, breakdown by OS).
How do I know which Microsoft procedure to follow to register the application?
It depends on your organization's Tenacy environment type (shared, SNC, or dedicated). The three corresponding links are given earlier in this article; if you're unsure of your environment type, contact Tenacy support.
How often are indicators updated?
It depends on the frequency chosen when configuring the connector: daily, weekly, monthly, semi-annual, or annual.