Providers
Microsoft Entra ID
Connect Microsoft Entra ID: delegated Graph scopes with admin consent, the user, group, policy, and sign-in data Noru reads, and what the People directory gets from it.
- Authentication
- OAuth
- Categories
- Identity, Security
- Sync cadence
- Daily by default (hourly, weekly, or monthly on request)
- Requested access
https://graph.microsoft.com/User.Readhttps://graph.microsoft.com/User.Read.Allhttps://graph.microsoft.com/ProfilePhoto.Read.Allhttps://graph.microsoft.com/Group.Read.Allhttps://graph.microsoft.com/RoleManagement.Read.Directoryhttps://graph.microsoft.com/Policy.Read.Allhttps://graph.microsoft.com/Policy.Read.ConditionalAccesshttps://graph.microsoft.com/AuditLog.Read.Allhttps://graph.microsoft.com/Application.Read.Allhttps://graph.microsoft.com/UserAuthenticationMethod.Read.Allhttps://graph.microsoft.com/DeviceManagementManagedDevices.Read.Alloffline_accessopenidprofile
Microsoft Entra ID is the identity connector for Microsoft tenants. It feeds the People directory, MFA status, group and role evidence, conditional access policy evidence, sign-in logs, and Intune-managed devices as assets.
What Noru collects
| Object | Source call | What it feeds |
|---|---|---|
| Users | Graph /users filtered to userType eq 'Member': id, UPN, display name, given name, surname, mail, job title, department, office, phones, account enabled, created, last password change, assigned licenses, sign-in activity when licensed | People directory, access-review evidence |
| Authentication methods | /users/id/authentication/methods per user | MFA status |
| Groups and members | /groups and members | Group evidence, identity metadata |
| Directory roles | /directoryRoles | Privileged-access evidence |
| MFA configuration | Conditional access policies, authentication methods policy, security defaults, per-user MFA | MFA policy evidence |
| Applications | /applications with owners | SSO configuration evidence |
| Sign-in logs | /auditLogs/signIns for a recent window | Sign-in monitoring evidence |
| Managed devices | Intune managed devices | Assets |
What Noru does not collect
- Mailbox, OneDrive, SharePoint, or Teams content. No mail or file scope is requested.
- Passwords or authentication secrets.
- Guest users. The Member filter excludes them.
- OAuth permission grants and app role assignments.
Application.Read.Allis granted but Noru does not readoauth2PermissionGrants, so Connected apps is populated from Google Workspace only today. - Noru never writes to Entra ID.
Before you connect
- A tenant administrator to grant consent: Global Administrator, Privileged Role
Administrator, or Cloud Application Administrator. Every
.Allscope is delegated and needs admin consent for the tenant. - Entra ID P1 or P2 if you want sign-in activity and sign-in logs. Without it those calls are skipped.
- Intune if you want managed devices as assets.
- Popups allowed for the app domain.
Connect
Open
/data-sources and click Connect Data Source.Pick Microsoft Entra ID (Azure AD) under Identity. The Connect Microsoft Entra ID dialog opens with the caption "Authorize Noru to collect identity and access management evidence from Microsoft Entra ID."
Enter a Connection name (placeholder "My Microsoft Entra ID Integration").
Click Connect Microsoft Entra ID. A popup opens at
login.microsoftonline.com/organizations with prompt=consent.Sign in as an admin, tick consent on behalf of the organization, and accept. The dialog completes and the first sync starts.
All collection options default to on.
After connecting
- People directory rows: email (mail, falling back to UPN), display name, status from account enabled, MFA true when any authentication method is registered, role from job title, department, and groups. For department and role, Entra ID ranks below HaileyHR and above Google Workspace, and it is an authoritative MFA source.
- Evidence maps to IAM and security-governance controls.
- The privacy data map's workforce skeleton refreshes, then grant attribution proposals and drift detection run.
- Managed devices appear under assets.
Permissions in detail
| Scope | Why Noru asks | What it could technically allow |
|---|---|---|
User.Read | Identify the connecting user | Read the signed-in user's profile |
User.Read.All | Full user list with attributes | Read all user profiles |
ProfilePhoto.Read.All | Directory photos | Read every user's photo |
Group.Read.All | Groups and memberships | Read all groups |
RoleManagement.Read.Directory | Directory role assignments | Read role definitions and assignments |
Policy.Read.All | Authentication methods policy, security defaults | Read all tenant policies |
Policy.Read.ConditionalAccess | Conditional access policies | Read CA policies |
AuditLog.Read.All | Sign-in logs | Read sign-in and directory audit logs |
Application.Read.All | Applications and owners for SSO evidence | Read all app registrations and service principals, including grants Noru does not fetch |
UserAuthenticationMethod.Read.All | MFA registration per user | Read every user's registered methods |
DeviceManagementManagedDevices.Read.All | Intune devices | Read managed device inventory |
offline_access, openid, profile | Refresh tokens and sign-in identity | Standard OpenID Connect |
Every Graph scope is a delegated read scope. The consent text in the app says "Noru requests delegated read-only Microsoft Graph scopes only".
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| 403 during sync after connecting | Admin consent was not granted for the tenant. Reconnect as an admin and consent for the organization |
Authentication_RequestFromNonPremiumTenantOrB2CTenant | The tenant has no P1 or P2 licence. Users are fetched without sign-in activity and sign-in logs are skipped; everything else proceeds |
| No devices in assets | Intune is not licensed or no devices are enrolled |
| "No Microsoft Entra ID data collected - please check your configuration and permissions" | All collection calls failed, usually consent. Check the sync log for the first 403 |
| A guest account is missing from the directory | Expected; only Member users are read |
| Popup blocked | Allow popups for the app and retry |
Related
- How syncs run
- Permissions and security
- Troubleshooting data sources
- People directory
- Connected apps (Google Workspace only for now)
- Data map
- Microsoft Azure and Microsoft SharePoint and OneDrive
Last updated on
Microsoft Azure
Connect Microsoft Azure: the Cloud Shell setup script, federated workload identity with Reader and Security Reader, what Noru reads from ARM, and the legacy secret path.
Microsoft SharePoint and OneDrive
Connect Microsoft SharePoint and OneDrive: delegated Graph scopes, the site and library you choose, the file metadata Noru reads, and the reach of Files.Read.All.