ConnectorsAzure AD / Entra ID
Azure AD / Entra ID
Connect Microsoft Azure AD (Entra ID) to Compass for identity and access analysis.
The Azure AD connector integrates with Microsoft Entra ID (formerly Azure Active Directory) to pull identity, access, and security metrics.
Prerequisites
- An Azure AD tenant with at least P1 licensing (P2 recommended for full metrics)
- An App Registration with the required API permissions
- Admin consent granted for the app
Setup
1. Create an App Registration
- Go to Azure Portal > Azure Active Directory > App registrations
- Click New registration
- Name it "Compass IAM Discovery" (or similar)
- Set the redirect URI to
https://app.usecompass.io/callback(or leave blank for client credentials) - Click Register
2. Configure API Permissions
Add the following Application permissions (not Delegated):
| Permission | Purpose |
|---|---|
Directory.Read.All | Read users, groups, roles, and directory objects |
AuditLog.Read.All | Read sign-in and audit log data |
User.Read.All | Read user profiles and properties |
Group.Read.All | Read group memberships and structures |
Policy.Read.All | Read conditional access and security policies |
IdentityRiskyUser.Read.All | Read risky user detections (P2 required) |
Click Grant admin consent after adding all permissions.
3. Create a Client Secret
- Go to Certificates & secrets > New client secret
- Set an appropriate expiry (12 months recommended)
- Copy the secret value immediately — it won't be shown again
4. Add to Compass
- Go to Settings > Connectors in Compass
- Click Add Connector > Azure AD / Entra ID
- Enter:
- Tenant ID — Found on the App Registration overview page
- Client ID — The Application (client) ID
- Client Secret — The secret you just created
- Click Test Connection
- Save
Metrics Collected
| Category | Metrics |
|---|---|
| Users | Total count, active vs inactive, guest users, stale accounts (90+ days) |
| Groups | Total count, dynamic vs assigned, empty groups, nesting depth |
| MFA | Enrollment rate, methods distribution, users without MFA |
| Sign-ins | Success/failure rates, risky sign-ins, conditional access impact |
| Privileged Access | Global admin count, PIM usage, standing vs eligible assignments |
| Applications | App count, apps with excessive permissions, stale app registrations |
Troubleshooting
"Insufficient privileges" error
Ensure admin consent was granted for all permissions. Check the Enterprise applications section in Azure AD to verify consent status.
Missing sign-in data
Sign-in logs require Azure AD P1 or higher. If you're on a free or O365 basic tier, sign-in metrics will be unavailable.
Stale data
Azure AD logs have a retention period based on your licence tier (7 days free, 30 days P1/P2). Compass can only access what Azure retains.