Azure Active Directory (Entra)

Microsoft Entra (formerly Azure Active Directory) is a cloud-based identity and access management platform that helps organizations securely manage user identities and control access to applications and resources across different environments, including cloud, on-premises, and hybrid.

Two integration types are supported:

1. OAuth2 – Server-to-Server (Two-Legged) - Recommended
2. OAuth2 – App Token

OAuth2 – Server-to-Server (Two-Legged) - Recommended

In order to integrate Azure Active Directory with Relyance AI you will need to create an App in Entra and follow an OAuth2 flow.

In Microsoft Entra:

1. Sign in to the Azure portal and navigate to Microsoft Entra ID › App registrations.
2. Click New registration.
   • Give it a descriptive name (e.g. "Relyance AI Integration").
   • Under Supported account types, select Accounts in this organizational directory only (single tenant).
   • Leave Redirect URI blank - this flow does not use a redirect.
   • Click Register.
3. From the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID. You'll need both later in the Relyance setup.
4. Go to Certificates & secrets › Client secrets and click New client secret.
   • Add a description and expiration, then click Add.
   • Copy the secret's Value immediately - it is only shown once and cannot be retrieved later.
5. Go to API permissions › Add a permission › Microsoft Graph › Application permissions, and add the permissions listed below:

If AI Discovery is enabled, add these as well:

In the Relyance AI application:

1. Login to your Relyance AI account.
2. Navigate to the Settings (bottom-left corner).
3. Select Integrations.
4. Search and locate the Azure Active Directory integration card and click on it.
5. Click on the Add Connection button on the top right.
6. Provide a meaningful name for the integration and click on the Add button.
7. In the Overview section, select the integration features you wish to enable for the integration, review the Scope and Permission, and Endpoint details, and click on Continue. For more details, see

Integration Features 8. In the Connection section, provide the appropriate values and click on Continue, 1. Connection Name: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by Discovery Source across the Inventory, Visual Maps, Assets, and Data Flow Analysis pages. 2. Rescan Frequency: This property allows you to configure how often Relyance executes scans against this Vendor connection. 3. Business Atlas Associations (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the Select Associations dropdown — the wizard will not advance past this step without one. For more details, see Business Atlas. For more details, see

Business Atlas 9. This step applies only if the Data Inspection check box was enabled in Step 7. In the Data Inspection section, provide the appropriate values and click on Continue: 1. Minimum Confidence Level: This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage. 10. In the Authentication section, under Authentication Method select OAuth2 - Server-to-Server (Two Legged) Then provide the following values retrieved from your Azure app registration (see steps above), and click on Continue.

not be redirected to the Azure portal to sign in. This flow authenticates directly using the credentials you provide above, so make sure the Client Secret is copied correctly before continuing - it cannot be retrieved again from Azure once you navigate away. 11. Review the configuration summary from the Completion section and click on Finish. 12. Confirm the integration Status reflects Connected.

OAuth2 – App Token

In order to integrate Azure Active Directory with Relyance AI you will need to follow an OAuth2 flow.

In the Relyance AI application:

1. Login to your Relyance AI account.
2. Navigate to the Settings (bottom-left corner).
3. Select Integrations.
4. Search and locate the Azure Active Directory integration card and click on it.
5. Click on the Add Connection button on the top right.
6. Provide a meaningful name for the integration and click on the Add button.
7. In the Overview section, select the integration features you wish to enable for the integration, review the Scope and Permission, and Endpoint details and click on Continue. For more details, see

Integration Features 8. In the Connection section, provide the appropriate values and click on Continue, 1. Connection Name: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by Discovery Source across the Inventory, Visual Maps, Assets, and Data Flow Analysis pages. 2. Rescan Frequency: This property allows you to configure how often Relyance executes scans against this Vendor connection. 3. Business Atlas Associations (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the Select Associations dropdown — the wizard will not advance past this step without one. For more details, see Business Atlas. For more details, see

Business Atlas 9. In the Authentication section, provide the following information retrieved from the Azure Active Directory section and click on Continue. You will be redirected to the Azure portal. Please sign in using your Azure credentials. 10. This step applies only if the Data Inspection check box was enabled in Step 7. In the Data Inspection section, provide the appropriate values and click on Continue, - Minimum Confidence Level: This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage. 11. Review the configuration summary from the Completion section and click on Finish. 12. Confirm the integration Status reflects Connected

Verify the connection is really working

1. Authenticated but nothing discovered is the admin-consent step. Without it the app registration still issues a token — the client ID and secret are valid — so the connection reports Connected while every Graph call comes back denied. Check API permissions shows "Granted for <organization>" against each permission, not "Not granted".
2. Application permissions, not Delegated. This flow has no signed-in user, so a Delegated grant of the same permission name resolves to nothing. The two are easy to mix up because the permission names are identical in both columns.
3. A connection that worked and then stopped is the client secret expiring. Entra secrets carry a hard expiry, which is why step 4 asks you to set one deliberately: record that date in the connection's Credentials expiry field and Relyance warns you before it lapses instead of after.
4. Partial results after enabling AI Discovery. AiEnterpriseInteraction.Read.All and Application.Read.All are separate grants that also need admin consent — adding them without re-consenting leaves the new scans empty while the directory scan keeps working, which makes it look like a product problem rather than a permission one.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

OAuth (browser authorization)

The OAuth (browser authorization) method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (terraform import relyance_integration_connection.example azure_active_directory/<connection_id>) or reading it with the relyance_integration_connection data source.

OAuth client credentials

resource "relyance_integration_connection" "azure_active_directory_1" {
  vendor = "azure_active_directory"
  name   = "<your connection name>"

  auth = {
    method = "oauth-client-credentials"
    params = {
      tenant_id = "<tenant_id>"
      client_id = "<client_id>"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      client_secret = var.azure_active_directory_client_secret
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}