Microsoft 365 / Entra ID

Connect Microsoft 365 and Entra ID to collect identity, MFA, conditional access, audit log and license evidence.

Updated Aug 14, 2026Product 2026.911 minMSP operator, Internal IT

Prerequisites

Global Administrator or Privileged Role Administrator access to the Entra ID tenant
Ability to grant admin consent for application permissions
AssurIQ workspace with the Cloud Connector enabled

Vendor: Microsoft
Category: identity
Connector: Open Integrations

Purpose

The Microsoft 365 / Entra ID integration is the primary identity evidence source in AssurIQ. It powers privileged account inventory, MFA coverage, conditional access posture, legacy authentication detection and directory audit history.

Controls AIQ-ID-001, AIQ-ID-004, AIQ-ID-006 and AIQ-ID-007, along with AIQ-AC-001/002 and AIQ-MO-001, depend on evidence this connector produces. Missing evidence leaves those controls in EVIDENCE GAP rather than FAIL.

Evidence-first

AssurIQ never infers a failing control state from a disconnected integration. It reports the gap explicitly so you can prioritize reconnecting it.

Requirements

Entra ID tenant with Microsoft 365 Business Premium, E3/E5, or standalone Entra ID P1/P2 for conditional access evidence
Global Administrator or Privileged Role Administrator to complete registration and consent
Outbound HTTPS to graph.microsoft.com and login.microsoftonline.com from the AssurIQ Cloud Connector
A decision on Conditional Access / Identity Protection licensing so unlicensed controls are marked NOT APPLICABLE

Permissions

Graph permission	Purpose
Directory.Read.All	Users, groups, roles and directory objects
Policy.Read.All	Conditional access and authentication method policies
AuditLog.Read.All	Sign-in and directory audit logs
Reports.Read.All	Usage and security reports, including MFA registration detail
UserAuthenticationMethod.Read.All	Per-user registered authentication methods
RoleManagement.Read.Directory	Directory role assignments for privileged account detection
SecurityEvents.Read.All	Identity Protection risk detections, where licensed

Admin consent required

These are application permissions, which require tenant-wide admin consent from a Global Administrator. Per-user delegated consent is not sufficient.

Setup

1
Open the connector wizard
In AssurIQ, go to Integrations, select Microsoft 365 / Entra ID, and choose Connect.
2
Sign in as an administrator
Authenticate with a Global Administrator or Privileged Role Administrator account.
3
Review requested permissions
Confirm the application permissions listed above.
4
Grant admin consent
Grant tenant-wide admin consent on the Microsoft consent screen.
5
Select the customer and scope
Map the tenant to exactly one AssurIQ customer record.
6
Confirm the first sync
Wait for the connector status to move to Connected, typically within 15 minutes.

Verification

Connector status shows Connected with a recent last-synced timestamp
Identity Workbench lists users and privileged roles matching the real admin roster
AIQ-ID-004 shows a control state other than EVIDENCE GAP
Evidence Vault has a new hashed evidence record tagged Microsoft 365

Data collected

Directory objects: users, groups, license assignment, enabled state
Directory role assignments, including Global Administrator
Registered authentication methods and MFA registration status
Conditional access policies and their targets
Sign-in logs, including legacy authentication protocol usage
Identity Protection risk detections where licensed

Security model

AssurIQ authenticates with OAuth 2.0 client credentials against a dedicated Entra ID app registration. No password is stored. Every requested scope is read-only; AssurIQ never requests write, mail-send or directory-modify permissions.

Collection runs outbound-only over mutually authenticated TLS from the AssurIQ Cloud Connector. Revoking consent or deleting the app registration stops collection immediately.

Common errors

Code	Title	Fix
AIQ-INT-MS-003	Microsoft permission missing	Grant admin consent for every listed scope, reconnect as Global Administrator, re-run collection.
AIQ-INT-001	Integration disconnected	Refresh token expired or revoked; reconnect from Integrations.

AIQ-INT-MS-003Microsoft permission missing
The Entra ID app registration lacks a required Graph permission, so identity and MFA evidence is incomplete.
AIQ-INT-001Integration disconnected
The connector token expired or was revoked. Data from this system is stale.

Troubleshooting

Incomplete MFA coverage: confirm UserAuthenticationMethod.Read.All was consented.
Conditional Access controls NOT APPLICABLE: confirm Entra ID P1/P2 licensing.
New admins missing: wait for next sync cycle or trigger a manual resync.
Consent granted by a lower-privileged role: re-consent as Global Administrator.

Disconnect

In AssurIQ, open Integrations, select Microsoft 365 / Entra ID, and choose Disconnect.
Optionally remove the AssurIQ enterprise application in the Entra ID admin center to revoke consent immediately.
Dependent identity controls move to EVIDENCE GAP on the next evaluation cycle, not FAIL.
Previously collected evidence remains in the append-only Evidence Vault.

Error codes covered