How To Connect Entra ID
Overview
To create a connector for Entra ID in Certero you will need a Client ID, a Client Secret, and an Entra App Registration with the right permissions.
The Certero connector for Entra ID uses the Microsoft Graph APIs to connect to and retrieve data from Entra ID. The APIs use industry standard OAuth 2.0 protocols for authentication and authorization.
In order to create a connector for Microsoft Entra in the Certero, there are several details you will need to enter. These are:
Client Id
Client Secret
The aim of this document is to show the user how to prepare to create these values so they are ready for use when the Certero Microsoft Entra connector is created.
Entra Configuration
Create the App Registration
Log into the Entra Admin Centre by clicking Microsoft Entra admin center
In the portal home page search for 'App Registration'.
Click on the 'App Registrations' link shown.
Click + New registration.
Give the application a meaningful name and select which account types are to be supported (by default Single tenant will be selected):
Click Register at the bottom of the form to register the application.
You can return to the app at any time via App registrations in the menu blade, or by searching for "App registrations" in the main search bar. Clicking the app name reopens the Overview.
Obtaining a Client ID and Secret from an App
Once your app is registered you will automatically be taken to the App registration screen. The top of this screen will show your Application (client) ID.
This is the value we will use in our connector, make a note of it:
From the App Registration screen, click the Client credentials hyperlink shown below:
The Certificates and Secrets section should be displayed:
Click + New client secret.
Enter a description. Select when the secret should expire and click Add:
Your new Client Value and Secret ID will be displayed. Note down the Client Value, this forms your ‘Client Secret’ for the Entra Connector.
IMPORTANT: Copy the secret's Value immediately and store it securely. This is the only time it is shown. Once you navigate away from the page you cannot retrieve it, and you will have to delete the secret and create a new one.
Make a note of when the secret expires — the connector will stop collecting data once it does, and a new secret will need to be created and entered in CerteroX.
Adding API Permissions
Navigate to the app created in the step above and click API permissions from the menu.
Click Add a permission.
Select Microsoft Graph.
Add the following permissions:
AuditLog.Read.All
Directory.Read.All
Group.Read.All
GroupMember.Read.All
Reports.Read.All
User.Read.All
You will also need to grant admin consent. Click the Grant admin consent button and click Yes when prompted.
The resulting permissions should look like what is shown below.
Nothing beyond the permissions mentioned is required. No write permissions are used, and the default delegated User.Read that Entra adds to every new App Registration is not used — it can be removed if your organization requires it.
Connect to CerteroX
With the App Registration in place, the connection can now be created in CerteroX.
Go to CerteroX SaaS Management → Settings → Identity & Connectors.
Click Add a new connection.
In the modal window that appears, select Entra ID.
Enter the App Registration details gathered in the Entra Configuration steps above — a Name for the connection, along with the Tenant ID, Client ID and Client Secret
Press ‘Validate Connection' to confirm a successful connection.
Press ‘Create & Continue’ to add the Entra Connector.