Nailing the Security Audit with RRCU

ConductorOne docs

Set up a Microsoft Entra ID connector

ConductorOne provides identity governance and just-in-time provisioning for Entra ID. Integrate your Entra ID instance with ConductorOne to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

Capabilities

  • Sync users and managed identities from Entra ID to ConductorOne

  • Resources supported:

    • Groups
    • Enterprise applications
    • Directory roles
    • Licenses

  • Provisioning supported:

    • Groups (membership and owners)
    • Enterprise applications (assignments and owners)
    • Directory roles

Add a new Entra ID connector

This task requires either the Connector Administrator or Super Administrator role in ConductorOne.

  1. In ConductorOne, click Connectors > Add connector.

  2. Search for Microsoft Entra and click Add.

  3. Choose how to set up the new Entra ID connector:

    • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

    • Add the connector to a managed app (select from the list of existing managed apps)

    • Create a new managed app

  4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

    A Entra ID connector owner must have the following permissions:

    • Connector Administrator or Super Administrator role in ConductorOne
    • Global Administrator in Entra ID
  1. Click Next.

Next steps

  • If you are the connector owner, proceed to Configure your Entra ID connector for instructions on integrating Entra ID with ConductorOne.

  • If someone else is the connector owner, ConductorOne will notify them by email that their help is needed to complete the setup process.

Choose the appropriate set of instructions based on how you want to authenticate to Entra:

Option 1: Integrate your Entra ID instance using an Entra application

Step 1: Create a new Entra application and generate credentials

  1. In Entra admin center, navigate to App registrations.

  2. Click + New registration.

  3. Give the application a name, such as “ConductorOne,” and select the supported account type relevant to your Entra installation. You do not need to set a redirect URL.

  4. Click Register.

  5. The new app is created. Carefully copy and save the Application (client) ID and the Directory (tenant) ID shown on the application summary page. We’ll use these in Step 3.

  6. Next, we’ll generate a client secret for this app. Click Certificates & secrets.

  7. Click + New client secret.

  8. Give the client secret a description and set its expiration.

  9. Click Add.

  10. The client secret is generated. Carefully copy and save the Secret ID. We’ll use it in Step 3.

Step 2: Give the new Entra app API permissions

  1. Click API permissions.

  2. Click + Add permissions > Microsoft Graph.

  3. Click Application permissions. Select each permission in the relevant set below:

    To sync access data:

    Application.Read.All
AppRoleAssignment.ReadWrite.All
AuditLog.Read.All
Directory.Read.All
Group.Read.All
GroupMember.Read.All
MailboxSettings.Read
RoleAssignmentSchedule.Read.Directory
RoleEligibilitySchedule.Read.Directory
RoleManagement.Read.All
RoleManagement.Read.Directory
RoleManagementAlert.Read.Directory
RoleManagementPolicy.Read.AzureADGroup
RoleManagementPolicy.Read.Directory
ServicePrincipalEndpoint.Read.All
User.Read.All
User.ReadBasic.All

    To sync access data and provision access:

    Application.ReadWrite.All
AppRoleAssignment.ReadWrite.All
AuditLog.Read.All
Directory.ReadWrite.All
Group.ReadWrite.All
GroupMember.ReadWrite.All
MailboxSettings.ReadWrite
RoleAssignmentSchedule.Read.Directory
RoleEligibilitySchedule.Read.Directory
RoleManagement.Read.All
RoleManagement.Read.Directory
RoleManagementAlert.Read.Directory
RoleManagementPolicy.Read.AzureADGroup
RoleManagementPolicy.Read.Directory
ServicePrincipalEndpoint.ReadWrite.All
User.ReadWrite.All
User.ReadBasic.All

Step 3: Add your Entra ID credentials to ConductorOne

  1. In ConductorOne, navigate to the Entra ID connector by either:

    • Clicking the Set up connector link in the email you received about configuring the connector.

    • Navigate to Connectors > Entra ID (if there is more than one Entra ID listed, click the one with your name listed as owner and the status Not connected).

  2. Find the Settings area of the page and click Edit.

  3. Select Client secret.

  4. Paste the tenant ID you saved in Step 1 into the Entra tenant ID field.

  5. Paste the client ID you generated in Step 1 into the Entra client ID field.

  6. Paste the client secret you generated in Step 1 into the Entra client ID field.

  7. Optional. Check the box if you want to Skip syncing Active Directory Server groups.

  8. Click Save.

  9. The connector’s label changes to Syncing, followed by Connected. View the logs to ensure that information is syncing.

That’s it! Your Entra ID connector is now pulling access data into ConductorOne.

Option 2: Integrate your Entra ID instance using OAuth

A user with the Connector Administrator or Super Administrator role in ConductorOne and the Global Administrator permission in Entra ID must perform this task.

Step 1: Log in with OAuth

  1. In ConductorOne, navigate to the Entra ID connector by either:

    • Clicking the Set up connector link in the email you received about configuring the connector.

    • Navigate to Connectors > Entra ID (if there is more than one Entra ID listed, click the one with your name listed as owner and the status Not connected).

  2. Select OAuth.

  3. Optional. If necessary, specify the ID of the Entra tenant you’re integrating in the Entra tenant ID field. (It’s most common to leave this blank.)

  4. Optional. Check the box if you want to Skip syncing Active Directory Server groups.

  5. Click Login with OAuth.

  6. Log in and authorize ConductorOne with your Entra ID instance.

    In order for the integration to work properly, you must consent to all permissions:

Step 2: Grant permissions to the ConductorOne app

  1. In the Entra ID control panel, go to Enterprise Applications.

  2. Click the ConductorOne Integration app (not to be confused with the ConductorOne SSO app, which is used to log into ConductorOne, not to synchronize your data).

    If the ConductorOne Integration app doesn’t appear in the list of apps right away, wait a minute and click Refresh.

  1. On the ConductorOne Integration page, click Permissions on the left side.

  2. Click Grant admin consent for … on the ConductorOne Integration app permissions page.

Step 3: Complete the integration

  1. Return to the Entra ID connector setup page in ConductorOne.

  2. Click Login with OAuth a second time to complete the process and authorize ConductorOne to obtain an access token with the permissions you’ve just granted.

That’s it! Your Entra ID connector is now pulling access data into ConductorOne.

Configure the Microsoft Entra ID integration using Terraform

As an alternative to the integration process described above, you can use Terraform to configure the integration between Entra ID and ConductorOne.

See the ConductorOne Entra ID integration resource page in the ConductorOne Terraform registry for example usage and the full list of required and optional parameters.

What’s next?

If Entra ID is your company’s identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in ConductorOne for all of your SCIMed software. Before you move on, review the Create applications page for important information about how to set up integrations with the SCIMed apps.