---
title: "Microsoft Entra"
slug: "microsoft-entra"
updated: 2026-04-28T18:51:49Z
published: 2026-04-28T18:51:49Z
canonical: "docs.databee.buzz/microsoft-entra"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra

Microsoft Entra ID tracks user activity and creates reports that help you understand how your users access and use Entra services.

This integration interacts with directory audits. The directory audit report provides you with access to the history of every task performed in your tenant. The directory audit report provides you with records of system activities for compliance. Amongst others, the provided data enables you to address common scenarios such as:

- Who granted admin group access to a directory user?
- Which users are signing in to a recently acquired app?
- How many passwords resets were made within the directory?

More information can be found at [Microsoft Entra](https://learn.microsoft.com/en-us/graph/api/resources/directoryaudit?view=graph-rest-1.0) Website page.

**Integration Method:** API Ingest

**Tables**: Entity Management (3004), Group Management (3006), Account Change (3001), User Inventory (5003)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Directory Audits | Fetches logs every task performed in your tenant, either by a user or a service. |
| User Group Info | Fetches the list of users in the organization and list of groups each user belongs to |

This integration supports the following versions

| Microsoft Entra API version | V 1.0 |
| --- | --- |

> [!NOTE]
> **Note**:
> 
> Microsoft Entra is a continuously updated cloud service. As of this document preparation, latest release was on Dec 2025.

## Prerequisites

- The user should have access to the [**Azure portal**](https://portal.azure.com/) with an account that has the Global Administrator privileges.
- The user should have access to the **DataBee console.**

## Configuration Overview

1. Create an application with required permissions to fetch the data.
2. Create [Microsoft Entra Data Feed](/user-manual/docs/microsoft-entra#databee-configuration) in the DataBee console with the required Client credentials.

| **DataBee Parameter** | **Azure Parameter** |
| --- | --- |
| Client Key | Application (client) ID |
| Client Secret | Client Secret Value |
| Token URL(<tenant_id>) | Directory (Tenant) ID |

### Azure Configuration

### Create an application

1. Log on to [Azure portal](https://portal.azure.com/) with an account that has the Global Administrator privileges.
2. In the search bar, search for **App Registrations** and select it. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-t927nwgu.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
3. On the “App registrations” page, select **New registration,** the **“**Register an application” window will appear. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-6l0f00dt.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
4. On the “Register an application” window:

Under ‘Name’ enter your Application Name then click on **Register** to create the application.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-2qgdbfzc.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)

1. On the app **Overview** page, copy the **Application (client) ID** and **Directory (tenant) ID** for later use. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-q8g6mvza.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)

### Add Endpoint Access

Once the application is created, two permissions should be provided to fetch data. The appropriate permissions for the application are needed to access these endpoints. The following section details how to configure and add permissions to the required endpoints.

#### Add Permissions

From the **Azure Active Directory portal**:

1. Select the application registered in the previous step.
2. Under **Manage,** click **API Permissions** and then click **Add a Permission,** the **Request API permissions** window will appear. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-6fcqhq6y.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
3. On **Request API permissions** window, Click on **Microsoft APIs** then on **Microsoft Graph.** ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-wxetzlz7.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
4. Click on **Application Permissions.** ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-anhypb4m.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
5. The following permissions need to be granted for the endpoint to function properly:

| Event | Type | Permission |
| --- | --- | --- |
| Directory Audits | Application | AuditLog.Read.All Directory.Read.All |
| User Group Information | Application | User.Read.All, AuditLog.Read.All, Directory.Read.All |

In the **Select permissions** search bar, enter the permission shown above, and check the box to include them.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/entra1.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/entra2.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/entra3(1).png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
6. Click the **Add permissions** button after selecting all required permissions.
7. On the **API permissions** page, click **Grant Admin Consent** **for <tenant>**. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-0h8l2wp2.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
8. Click the **Yes** button on the consent confirmation. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/entra(1).png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
9. The required permissions are now added for the endpoints.

### Create the Client Secret

The final step in accessing the APIs is creating a **Client Secret**. To create it from the Azure Portal:

1. Select the application created above.
2. Under **Manage**, Click **Certificates and Secrets**, and then **Client Secrets**. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-uri1j7zc.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
3. Click **New client secret**. Then **Add a client secret** window appears. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-73lfnk46.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
4. On **Add a client secret** window:
5. Enter a **Description** for this client secret and select the desired expiry period from the **Expires** drop-list.
6. Then click on **Add** to create the client secret. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-241kwgsn.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)

> [!NOTE]
> Note:
> 
> The user needs to re-create the client secret when it expires
7. Copy the **Value** fields for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-cz9j4etu.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-xp95skmy.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
2. Search for the **Microsoft Entra** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-0hz3sskq.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
3. Click on the **API Ingest** option for collection method.

![A screenshot of a computer AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-entra-mar2025-image-vfy211ch.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
4. Enter feed contact information and click **Next.**

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/db1(3).png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)
5. In the configuration page, enter the following:

- Authorization Method: OAuth2
- Client Key: paste the **Application (Client) ID** generated earlier in the Azure portal.
- Client Secret: paste the **Client Secret value** generated earlier in the Azure portal.
- Token URL: replace <tenant_id> with your **Directory (Tenant) ID**.
- Event Types: preselected for all the event types that integration pulls.
- Include Signin Activity: Enable this option to fetch sign-in activity of user for User Group Info event.

> [!WARNING]
> NOTE
> 
> When Include Signin Activity is checked, the AuditLog.Read.All permission must be granted.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/db2(3).png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A51Z&se=2026-11-15T01%3A04%3A51Z&sr=c&sp=r&sig=xyDVUee%2BXzvhaS449HSUVakul17hKvQbH3VIB%2BR08%2F8%3D)

6. Click **Submit.**

## Troubleshooting Tips

- If facing an invalid client or unauthorized client error this might be possibly due to incorrect credentials. Ensure the client key, client secret and Tenant ID are pasted correctly. Since you cannot view the client secret after the 1st time, re-create it, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.
- If facing a 403-response code this might be possibly due to missing permission. Ensure that all the required permissions are granted correctly as per the above-mentioned steps.