** as the supported account type. In older views, this option is called **Accounts in this organizational directory only**.
* **Redirect URIs**: Leave this field empty.
{% endstep %}
{% step %}
### Get the client ID and tenant ID
After registration, you are redirected to the overview page of the new application.
Here you can find both the **client ID** (also referred to as **application ID**) and the **tenant ID** (also referred to as **directory ID**). You will need this information later when [adding an identity provider](#adding-an-identity-provider-in-enginsight) in the Enginsight platform.
{% endstep %}
{% step %}
### Create a client secret
1. Create a **client secret** (also referred to as **app secret**) for the new application. For more information, see the [official vendor documentation](https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials?tabs=client-secret).
{% hint style="warning" %}
**Please note**: Enginsight assumes no liability for the content and topicality of third-party documentation.
{% endhint %}
Enter the following values:
* **Description**: The description can be chosen freely.
* **Expires**: Define a lifetime for the client secret. Microsoft Entra ID allows a maximum of 24 months. Choose the longest lifetime permitted by your security policy and note the expiry date.
{% hint style="danger" %}
**Please note**: When the client secret expires, synchronization between the Enginsight SIEM and Entra ID stops with the error `AADSTS7000222` / `invalid_client`. In this case, you need to [replace the client secret](#replacing-an-expired-client-secret).
{% endhint %}
2. Copy the client secret and store it in a secure location.
{% hint style="warning" %}
**Please note**: Use the **value** of the client secret. The **secret ID** does not work here.
{% endhint %}
{% hint style="danger" %}
**Please note**: When you add a client secret in Microsoft Entra ID, it is shown **only once immediately after creation and never again**. Make sure to note the client secret immediately after creating it.
{% endhint %}
{% endstep %}
{% step %}
### Grant API permissions
You now need to grant the new application permissions to **access the Microsoft Graph API**. For more information, see the [official vendor documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis).
{% hint style="warning" %}
**Please note**: Enginsight assumes no liability for the content and topicality of third-party documentation.
{% endhint %}
{% hint style="danger" %}
**Please note**: To grant admin consent for Microsoft Graph application permissions, the Microsoft Entra ID roles **Privileged Role Administrator** or **Global Administrator** are required. The **Application Administrator** and **Cloud Application Administrator** roles are not sufficient for Microsoft Graph application permissions.
{% endhint %}
Follow these steps:
1. Navigate to **API permissions**.
2. Click **Add a permission**.
3. Select **Microsoft Graph**.
4. Select **Application permissions**. Application permissions allow Enginsight to act as a service without a signed-in user.
5. Use the search field and select the following permissions:
| Permission | Required for | Notes |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `User.Read.All` | User replication and connection test in the Enginsight platform | **Required**: Without this permission, the test reports `baseReadable: false` and the Microsoft Graph API responds with `403`. |
| Directory.Read.All
Least-privilege alternative: see step 6
| Showing group memberships and directory roles (for example *Global* *Administrator*) of each replicated user in the Enginsight platform | Recommended: Microsoft documents this permission as the least-privileged application permission for the memberOf call used by synchronization for roles. It also returns full group details.
Without this permission, users are still replicated, but groups and directoryRoles remain empty and the entry receives a groupRoleEnrichmentError.
|
| `User.EnableDisableAccount.All` | Blocking a Microsoft Entra ID ("Azure") user directly from the Enginsight platform | Optional: Together with User.Read.All, Microsoft states that this is the least-privileged combination for changing accountEnabled.
User.ReadWrite.All also works, but is broader.
|
6. Click **Add permissions**.
7. Click **Grant admin consent for \** and confirm with **Yes**.
8. Click **Refresh** and check the **Status** column. Each row must show a green check mark and **Granted for \**. If the button is greyed out, your Microsoft Entra ID account does not have the **Privileged Role Administrator** or **Global Administrator** role.
{% endstep %}
{% step %}
### Optional: Least-privilege alternative to the `Directory.Read.All` API permission
A least-privilege alternative to the `Directory.Read.All` API permission is the permission pair `GroupMember.Read.All` (full group properties) plus `RoleManagement.Read.Directory` (directory roles).
Microsoft lists this permission pair for the group and role endpoints, but not explicitly for the `memberOf` call.
After the first synchronization with the Enginsight platform, therefore check whether the `directoryRoles` information is shown there. If this is not the case, change the API permission to `Directory.Read.All`.
{% endstep %}
{% step %}
### Optional: Additional permissions when using the Enginsight block function for Microsoft Entra ID users
If you want to block a Microsoft Entra ID user with an administrator role from the Enginsight platform using the **Block Azure User** option, Microsoft Graph additionally requires the calling application itself to be assigned a privileged directory role.
Follow these steps:
1. In the Microsoft Entra ID portal, navigate to **Entra ID** → **Roles & admins**.
2. Select the **Privileged Authentication Administrator** role. This role covers all administrator accounts.
3. Click **Add assignments**.
4. Select the [previously created application](#configurations-in-the-microsoft-entra-id-portal) to assign the privileged role to it.
{% endstep %}
{% endstepper %}
***
## Adding an identity provider in Enginsight
After you completed all settings in the Microsoft Entra ID portal, you can add a new identity provider in the Enginsight platform.
Follow these steps:
{% stepper %}
{% step %}
In the Enginsight platform, navigate to **SIEM** → [Identity Provider](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/identity-providers) and click [Add Identity Provider](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/identity-providers/add-identity-provider) in the upper-right corner of the view.
{% endstep %}
{% step %}
Give the new identity provider a descriptive **Name**, for example *Microsoft Entra ID \*.
{% endstep %}
{% step %}
Select the checkbox next to **Enabled** to enable the identity provider.
{% endstep %}
{% step %}
In the **Source** field, select **Microsoft Entra-ID**.
{% endstep %}
{% step %}
In the **Authentication Method** field, select **Secret-Based Authentication**.
{% endstep %}
{% step %}
Enter the **Tenant ID**, **Client ID**, and the **Client Secret** associated with the client ID that you [previously created in Microsoft Entra ID](#create-a-client-secret).
{% endstep %}
{% step %}
Click **Test Connection** in the upper-right corner of the view.
A successful test returns the following:
```
{ "ok": true, "error": null, "details": { "bind": true, "baseReadable": true, "userCount": } }
```
Here, `bind: true` means that the token was issued and that the tenant ID, client ID, and client secret are correct. `baseReadable: true` means that the `User.Read.All` API permission has been granted and admin consent has been given.
{% endstep %}
{% step %}
If the test is successful, select the checkbox next to **Replication** and save the settings by clicking **Add Identity Provider**.
{% hint style="danger" %}
**Please note**: If you leave this view without saving, all settings you have configured will be lost and cannot be restored!
{% endhint %}
{% endstep %}
{% step %}
In the identity provider overview, you can now view the replication status, the time of the last synchronization, and the number of replicated users.
* Click **Replication** in the upper-right corner of the view to show a list of all replicated users and see whether they are active or blocked.
* Click a replicated user to view additional details about that user as stored in Microsoft Entra ID.
{% endstep %}
{% endstepper %}
***
## Replacing an expired client secret
{% hint style="info" %}
We recommend that you set up up a calendar reminder a few weeks before the client secret expires. The Microsoft Entra ID portal shows the expiry date in the client secrets list and marks expired secrets in red.
{% endhint %}
If the client secret has expired, follow these steps:
{% stepper %}
{% step %}
Create a new client secret for the affected application in the Microsoft Entra ID portal.
{% endstep %}
{% step %}
In the Enginsight platform, navigate to **SIEM** → **Identity Provider** and click the affected identity provider.
{% endstep %}
{% step %}
Paste the new **Client Secret**.
{% endstep %}
{% step %}
Click **Test Connection** in the upper-right corner of the view.
{% endstep %}
{% step %}
Click **Save Changes** if the test was successful. Wait until synchronization between Microsoft Entra ID and Enginsight has completed successfully.
{% endstep %}
{% step %}
Navigate back to the Microsoft Entra ID portal and delete the old client secret.
{% endstep %}
{% endstepper %}
***
## Troubleshooting
| Symptom / error text | Cause | Fix |
| ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `AADSTS7000215: Invalid client secret provided` | The client secret is incorrect. This can happen, for example, if the **Secret ID** was copied instead of the **Value**. | Create a new client secret and copy the correct value. |
| `AADSTS7000222: ... client secret keys are expired` | The client secret has expired. | Replace the client secret [as described above](#replacing-an-expired-client-secret). |
| `AADSTS700016: Application ... was not found in the directory/tenant` | The client ID does not belong to this tenant, or the tenant ID is incorrect. | Check the tenant ID and client ID again in the Microsoft Entra ID portal. |
| `AADSTS90002: Tenant ... not found` | The tenant ID is incorrect or the tenant domain name was used. | Check the tenant ID again in the Microsoft Entra ID portal. |
| Test shows `bind: true`, `baseReadable: false` or Graph `403 Authorization_RequestDenied` | The `User.Read.All` API permission is missing, was added as a **delegated permission** instead of an **application permission**, or admin consent has not been granted. | Complete the [Grant API permissions](#grant-api-permissions) step and check the green status **Granted for \**. |
| Users are replicated, but groups / `directoryRoles` remain empty and `groupRoleEnrichmentError` is set | The `Directory.Read.All` API permission or the least-privilege permission pair is missing. | Complete the [Grant API permissions](#grant-api-permissions) step. The fields will be populated during the next synchronization. |
| The user blocking function in Enginsight fails with `403` | The `User.EnableDisableAccount.All` API permission is missing or the target user has an administrator role. | Complete the steps [Grant API permissions](#grant-api-permissions) and [Optional: Additional permissions when using the block function](#optional-additional-permissions-when-using-the-enginsight-block-function-for-microsoft-entra-id-user). |
| Test runs into a timeout / `ENOTFOUND login.microsoftonline.com` | Outbound HTTPS connections are blocked (on-premises). | Allow
login.microsoftonline.com and graph.microsoft.com in the firewall or proxy.
|
***