Microsoft Entra ID
Microsoft Entra ID (formerly Azure AD) connects your directory, devices and user accounts, into Navigator.
At a glance
| Data provided | Devices, Users |
| Authentication | OAuth2 client credentials (Azure app registration) |
| Where to configure | Connectors → Add a Connector → Microsoft Entra ID |
Required permissions
Create (or reuse) an Azure app registration, then grant it these Microsoft Graph Application permissions (not delegated) with admin consent:
| Permission | Why it’s needed |
|---|---|
User.Read.All | Read user accounts |
Device.Read.All | Read device records |
Setup
- In the Azure Portal, go to Entra ID → App registrations and create a new app registration (or reuse an existing one).
- Under API permissions, add the Microsoft Graph Application permissions listed above, then click Grant admin consent.
- Under Certificates & secrets, create a new client secret and copy its value immediately. It’s only shown once.
- Note your Tenant ID, the app registration’s Client ID, and the client secret you just created.
- In Navigator, go to Connectors → Add a Connector → Microsoft Entra ID.
- Enter the Tenant ID, Client ID, and Client Secret.
- Save. Navigator validates the credentials and enqueues a first sync immediately.
Vendor documentation
Microsoft’s own instructions: Register an application with the Microsoft identity platform for the app registration steps, and the Microsoft Graph permissions reference for what User.Read.All and Device.Read.All grant.
What data this connector provides
- Users: directory accounts via Microsoft Graph.
- Devices: manufacturer, model, OS platform/version, but no IP address or disk-encryption data (see Intune for that).
Known limitations
- Entra reports macOS devices with the platform value
"Mac", while Intune and Defender both report"macOS"for the same real device. This is a known, cosmetic inconsistency in the underlying data, not a matching error. - This connector doesn’t report IP addresses or encryption status. Connect Intune or Defender alongside it for that data.
Related connectors
Entra ID, Intune, and Defender are independent connectors that can each use their own Azure app registration, or share one. See the Connectors overview.