# Azure Active Directory (Entra)

![entralogo.png](https://assets.relyanceuat.xyz/images/docs/34544631146637/34544662330765.png)
Microsoft Entra (formerly Azure Active Directory) is a cloud-based identity and access management platform that helps organizations securely manage user identities and control access to applications and resources across different environments, including cloud, on-premises, and hybrid.

**Two integration types are supported:**

1. [**OAuth2 – Server-to-Server (Two-Legged)** - *Recommended*](#h_01KY5JBEM0CDFJ8VZ36JA9DXAK)
2. [**OAuth2 – App Token**](#h_01KY5JCJ4JRPBVEBR16YFDR6S6)

#### **OAuth2 – Server-to-Server (Two-Legged)** - *Recommended*

In order to integrate Azure Active Directory with Relyance AI you will need to create an App in Entra and follow an **OAuth2** flow.

**In Microsoft Entra:**

1. Sign in to the [Azure portal](https://portal.azure.com) and navigate to **Microsoft Entra ID › App registrations**.
2. Click **New registration**.
    - Give it a descriptive name (e.g. "Relyance AI Integration").
    - Under **Supported account types**, select **Accounts in this organizational directory only** (single tenant).
    - Leave **Redirect URI** blank - this flow does not use a redirect.
    - Click **Register**.
3. From the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. You'll need both later in the Relyance setup.
4. Go to **Certificates & secrets › Client secrets** and click **New client secret**.
    - Add a description and expiration, then click **Add**.
    - Copy the secret's **Value** immediately - it is only shown once and cannot be retrieved later.
5. Go to **API permissions › Add a permission › Microsoft Graph › Application permissions**, and add the permissions listed below:

| Permission | Description |
| --- | --- |
| Directory.Read.All | Read directory data |
| ConsentRequest.Read.All | Read all consent requests |

If AI Discovery is enabled, add these as well:

| Permission | Description |
| --- | --- |
| Application.Read.All | Grants permission to read all applications and service principals within an organization's Azure AD. |
| Directory.Read.All | Allows the app to read all directory data, including users, groups, and organizational information. |
| AiEnterpriseInteraction.Read.All | Allows the app to read enterprise AI interaction data across the organization. | AI Discovery is only available for the Server-to-Server (Two Legged) authentication method, and requires an AI Governance license.
6. Click **Grant admin consent for [your organization]** and confirm. This step is required - without it, Relyance's connection will authenticate but will not be able to read any data.

#### **In the Relyance AI application:**

![Screenshot 2025-11-07 150106.png](https://assets.relyanceuat.xyz/images/docs/34544631146637/40947193941389.png)

![Screenshot 2025-11-07 150147.png](https://assets.relyanceuat.xyz/images/docs/34544631146637/40947193942285.png)
1. Login to your Relyance AI account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Azure Active Directory** integration card and click on it.
5. Click on the **Add Connection** button on the top right.
6. Provide a meaningful name for the integration and click on the **Add** button.
7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scope and Permission**, and **Endpoint** details, and click on **Continue**. For more details, see

Integration Features
8. In the **Connection** section, provide the appropriate values and click on **Continue**,
    1. **Connection Name**: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by **Discovery Source** across the **Inventory**, **Visual** **Maps**, **Assets**, and **Data Flow Analysis** pages.
    2. **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    3. **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/). For more details, see

Business Atlas
9. This step applies only if the **Data Inspection** check box was enabled in Step 7. In the Data Inspection section, provide the appropriate values and click on **Continue**:
    1. **Minimum Confidence Level**: This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.
10. In the **Authentication** section, under **Authentication Method** select **OAuth2 - Server-to-Server (Two Legged)** Then provide the following values retrieved from your Azure app registration (see steps above), and click on **Continue**.

| Field | Description | Where to find it in Azure |
| --- | --- | --- |
| **Tenant ID** | Azure AD Tenant ID | App registration › Overview › Directory (tenant) ID |
| **Client ID** | Azure AD Client ID | App registration › Overview › Application (client) ID |
| **Client Secret**| Azure AD Client Secret | App registration › Certificates & secrets › Client secret  **Value** |
| **Subscription ID (Optional)** | Microsoft Subscription ID | Azure portal › Subscriptions | Unlike the OAuth2 / App Token method, you will

not be redirected to the Azure portal to sign in. This flow authenticates directly using the credentials you provide above, so make sure the Client Secret is copied correctly before continuing - it cannot be retrieved again from Azure once you navigate away.
11. Review the configuration summary from the **Completion** section and click on **Finish**.
12. Confirm the integration **Status** reflects **Connected**.

#### **OAuth2 – App Token**

In order to integrate Azure Active Directory with Relyance AI you will need to follow an **OAuth2** flow.

#### **In the Relyance AI application:**

1. Login to your Relyance AI account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Azure Active Directory** integration card and click on it.
5. Click on the **Add Connection** button on the top right.
6. Provide a meaningful name for the integration and click on the **Add** button.
7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scope and Permission**, and **Endpoint** details and click on **Continue**. For more details, see

Integration Features
8. In the **Connection** section, provide the appropriate values and click on **Continue**,
    1. **Connection Name**: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by **Discovery Source** across the **Inventory**, **Visual** **Maps**, **Assets**, and **Data Flow Analysis** pages.
    2. **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    3. **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/). For more details, see

Business Atlas
9. In the **Authentication** section, provide the following information retrieved from the **Azure Active Directory** section and click on **Continue**. You will be redirected to the **Azure portal**. Please sign in using your **Azure credentials**.
10. This step applies only if the **Data Inspection** check box was enabled in Step 7. In the Data Inspection section, provide the appropriate values and click on **Continue**,
    - **Minimum Confidence Level:** This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.
11. Review the configuration summary from the **Completion** section and click on **Finish.**
12. Confirm the integration Status reflects **Connected**

![Screenshot 2025-11-07 150234.png](https://assets.relyanceuat.xyz/images/docs/34544631146637/40947181511053.png)

![Screenshot 2025-11-07 150424.png](https://assets.relyanceuat.xyz/images/docs/34544631146637/40947193942925.png)

![Screenshot 2025-11-07 150512.png](https://assets.relyanceuat.xyz/images/docs/34544631146637/40947193943309.png)

### Verify the connection is really working

1. **Authenticated but nothing discovered** is the admin-consent step. Without it
   the app registration still issues a token — the client ID and secret are
   valid — so the connection reports **Connected** while every Graph call comes
   back denied. Check **API permissions** shows "Granted for <organization>"
   against each permission, not "Not granted".
2. **Application permissions, not Delegated.** This flow has no signed-in user, so
   a Delegated grant of the same permission name resolves to nothing. The two are
   easy to mix up because the permission names are identical in both columns.
3. **A connection that worked and then stopped** is the client secret expiring.
   Entra secrets carry a hard expiry, which is why step 4 asks you to set one
   deliberately: record that date in the connection's **Credentials expiry** field
   and Relyance warns you before it lapses instead of after.
4. **Partial results after enabling AI Discovery.** `AiEnterpriseInteraction.Read.All`
   and `Application.Read.All` are separate grants that also need admin consent —
   adding them without re-consenting leaves the new scans empty while the directory
   scan keeps working, which makes it look like a product problem rather than a
   permission one.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

### OAuth (browser authorization)

The **OAuth (browser authorization)** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example azure_active_directory/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### OAuth client credentials

```hcl
resource "relyance_integration_connection" "azure_active_directory_1" {
  vendor = "azure_active_directory"
  name   = "<your connection name>"

  auth = {
    method = "oauth-client-credentials"
    params = {
      tenant_id = "<tenant_id>"
      client_id = "<client_id>"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      client_secret = var.azure_active_directory_client_secret
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->