Microsoft Entra ID integration

Integrate Identity Security Posture Management (ISPM) with your Microsoft Entra ID (formerly known as Azure Active Directory) tenant by completing the following tasks in order. You can use the app that you integrate to retrieve data from Microsoft Entra ID.

Before you begin

  • Sign in to the Microsoft Entra ID portal using an admin account.
  • To allow ISPM to discover AI agents for Microsoft Copilot Studio, your org needs at least one qualifying Microsoft Agent 365 license. See Microsoft Agent 365.

Copy your tenant name

  1. Sign in to the Microsoft Entra ID portal using an admin account.
  2. If you have more than one Microsoft Entra ID tenant, open your profile dropdown menu and click Switch directory to switch your portal session to the desired Microsoft Entra ID.
  3. In the left-hand navigation pane, select the Microsoft Entra ID service.
  4. On the Overview page of Microsoft Entra ID, the Primary domain field displays your tenant name.
  5. Copy the tenant name and store it somewhere securely.

Register the ISPM app

  1. In the Microsoft Entra ID portal, go to Manage > App registrations.
  2. Click + New registration. The Register an application page opens.
  3. Complete the following fields:
    1. Name: Enter an app name. For example, Identity Security Posture Management app.
    2. Supported account types: Select Accounts in this organizational directory only (Default Directory only - Single tenant).
    3. Redirect URI: Select Web.
  4. Click Register.

Copy the application ID

  1. Go to the Overview page.
  2. Copy the Application (client) ID value and store it somewhere securely.

Copy the client secret

  1. Go to Manage > Certificates & secrets > Client secrets.
  2. Click New client secret.
  3. Enter a description and select 24 months as the expiration.
  4. Click Add.
  5. Copy the Value that appears and store it somewhere securely.

Select app permissions

  1. Go to API permissions.

  2. Click + Add a permission and select Microsoft Graph.

  3. Select Application permissions as the permission type.

  4. In the Application permissions section, select the following permissions:

    • AuditLog.Read.All

    • Directory.Read.All

    • IdentityProvider.Read.All

    • MailboxSettings.Read

    • Policy.Read.All

    • Reports.Read.All

    • RoleManagement.Read.All

    • User.Read.All

    • UserAuthenticationMethod.Read.All

    • Domain.Read.All

  5. Optional. To discover AI agents in ISPM, select the following permissions in the Application permissions section:

    • AgentInstance.Read.All

    • AgentCardManifest.Read.All

    • AgentCollection.Read.All

    • AgentIdentity.Read.All

    • AgentIdentityBlueprint.Read.All

    • AgentIdentityBlueprintPrincipal.Read.All

    • CopilotPackages.Read.All

  6. Click Add permissions.

  7. On the API permissions page, click Grant admin consent for {tenant}.

  8. Click Yes to grant consent for the requested permissions for all users in the tenant.

Allow ISPM to discover AI agents

Configure the following additional permissions and settings to allow ISPM to discover AI agents that were built in Microsoft Copilot Studio. Complete these steps after you finish selecting app permissions in the Register the ISPM app section.

Add Dataverse permissions

  1. Click + Add permissions.

  2. Click APIs my organization uses.

  3. Search for Dataverse.

  4. Ensure that Delegated permissions is selected.

  5. Select the user_impersonation checkbox.

  6. Click Add permissions.

  7. On the API permissions page, click Grant admin consent for {tenant}.

  8. Click Yes to grant consent for the requested permissions for all users in the tenant.

Add app to Dataverse

Repeat these steps for each environment that you want to connect to ISPM.

  1. Navigate to the Power Platform admin center.

  2. Go to Manage > Environments and select an environment.

  3. Click Settings.

  4. Go to Users + Permissions > Application Users.

  5. Click + New App User.

  6. In the App field, select the Application ID that you created earlier.

  7. Select the appropriate business unit.

  8. Assign the built-in role Service Reader.

  9. Click Create.

Enable automatic agent identity for Microsoft Copilot Studio

  1. In the Power Platform admin center, go to Copilot > Settings

  2. From the Copilot Studio section, select Connected agents Copilot Studio.

  3. Select the environment you want to connect to ISPM and click Edit.

  4. On the Entra Agent Identity for Copilot Studio panel, select the On checkbox and click Save.

Share the parameters with ISPM

  1. In the Identity Security Posture Management console, go to Settings > Integration gallery.

  2. Select Microsoft Entra ID .
  3. Enter the following parameters:
    • Tenant name - tenant primary domain
    • Application (client) ID
    • Client secret
  4. Click Submit.

Additional configuration options