> For the complete documentation index, see [llms.txt](https://docs.firefly.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.firefly.ai/integrations/data-sources/entra-id.md).

# Entra ID

Firefly integrates with Microsoft Entra ID (formerly Azure AD) to pull in information about your directory resources—including users, groups, service principals, app registrations, credentials, and governance objects—directly into your Firefly Inventory. This gives you a unified view of your identity assets alongside the rest of your cloud infrastructure, so you can govern who and what has access across your environment.

## Prerequisites

* A Microsoft Entra ID tenant.
* Permission to register an application in the tenant.
* Permission to grant admin consent for Microsoft Graph application permissions. This is a tenant-level action and typically requires a Global Administrator or Privileged Role Administrator.

## Setup Procedure

### 1. Register an Application in Entra ID

1. In the Azure Portal, go to [App registrations](https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade).
2. Click **New registration**.
3. Enter a name for the application (for example, `firefly-app`).
4. Leave the default settings and click **Register**.
5. On the application's **Overview** page, copy the following values:
   * **Application (client) ID**
   * **Directory (tenant) ID**

### 2. Grant API Permissions

1. In the application, go to **API permissions**.
2. Click **Add a permission > Microsoft Graph > Application permissions**.
3. Add the `Directory.Read.All` permission.
4. Click **Grant admin consent** for your tenant.

Admin consent is required. Without it, Firefly cannot validate the connection even when the credentials are correct. If you do not hold a Global Administrator or Privileged Role Administrator role, ask someone who does to grant consent before continuing.

### 3. Create a Client Secret

Create the secret once permissions are in place. Its value is shown only once, so it is best generated immediately before you paste it into Firefly.

1. In the application, go to **Manage > Certificates & secrets**.
2. Click **New client secret**.
3. Set an expiry period and click **Add**.
4. Copy the secret **Value** immediately—it is not shown again.

> Copy the secret **Value**, not the Secret ID. These are different, and the Secret ID will not authenticate.

Make a note of the expiry date you set. When a client secret expires, Firefly can no longer scan your tenant—see [Rotating the Client Secret](#rotating-the-client-secret).

### 4. Configure in Firefly

1. In Firefly, go to **Settings > Integrations**.
2. Click **Add New > Entra ID**.
3. Enter your **Tenant ID** (the Directory (tenant) ID from step 1).
4. Enter your **Client ID** (the Application (client) ID from step 1).
5. Paste your **Client Secret** (the secret Value from step 3).
6. Enter an **Integration Name** to customize how this integration appears in Firefly.
7. Click **Next**.
8. Click **Done**.

On save, Firefly validates the credentials against the Microsoft Graph API and displays an error if the credentials are invalid or admin consent has not been granted. Once validated, Firefly triggers an initial scan of your tenant.

## Supported Assets

Firefly supports 22 Entra ID asset types.

### Identity Core

| Asset Type                | Identifier                         |
| ------------------------- | ---------------------------------- |
| Users                     | `azuread_user`                     |
| Groups                    | `azuread_group`                    |
| Group Members             | `azuread_group_member`             |
| Service Principals        | `azuread_service_principal`        |
| Applications              | `azuread_application`              |
| Application Registrations | `azuread_application_registration` |

### Credentials & Access

| Asset Type                                 | Identifier                                          |
| ------------------------------------------ | --------------------------------------------------- |
| Application Passwords                      | `azuread_application_password`                      |
| Application Certificates                   | `azuread_application_certificate`                   |
| Application Federated Identity Credentials | `azuread_application_federated_identity_credential` |
| Service Principal Passwords                | `azuread_service_principal_password`                |
| Service Principal Certificates             | `azuread_service_principal_certificate`             |
| App Role Assignments                       | `azuread_app_role_assignment`                       |

Firefly surfaces credential metadata only, such as expiry dates and identifiers. Secret material is not fetched or stored.

### Ownership

| Asset Type         | Identifier                  |
| ------------------ | --------------------------- |
| Application Owners | `azuread_application_owner` |

### Governance

| Asset Type                  | Identifier                           |
| --------------------------- | ------------------------------------ |
| Conditional Access Policies | `azuread_conditional_access_policy`  |
| Named Locations             | `azuread_named_location`             |
| Directory Roles             | `azuread_directory_role`             |
| Directory Role Assignments  | `azuread_directory_role_assignment`  |
| Custom Directory Roles      | `azuread_custom_directory_role`      |
| Administrative Units        | `azuread_administrative_unit`        |
| Administrative Unit Members | `azuread_administrative_unit_member` |

### Tenant Context

| Asset Type           | Identifier              |
| -------------------- | ----------------------- |
| Domains              | `azuread_domains`       |
| Client Configuration | `azuread_client_config` |

> Asset type identifiers use the `azuread_` prefix, matching the naming used by the underlying Microsoft provider. This is expected and does not indicate a stale or misconfigured integration.

## Discovered Assets

Entra ID assets appear in your Inventory with the **Discovered** status.

Discovered means Firefly has found the asset in your tenant and indexed it, but has not evaluated it against Infrastructure-as-Code. It sits alongside the other inventory states—Managed, Unmanaged, Drifted, and Ghost.

Because Discovered assets are not evaluated against IaC, the following information is hidden for them:

* Drift status
* IaC type
* VCS repository and stack

> Missing drift, IaC, and VCS information on Entra ID assets is expected behavior, not a data problem.

Discovered does not restrict what you can do with the asset. Entra ID assets support codification, including advanced codification—see [Codification](#codification).

## Codification

Firefly supports codification for Entra ID assets across all supported asset types, using the same flow as any other provider. Select the asset in your Inventory and choose **Codify** to generate IaC for it.

Both codification modes are available:

* **Basic codification** generates a resource definition for the selected asset.
* **Advanced codification** generates modularized IaC—module creation and module calls—rather than flat configurations.

Learn more in [Codification](/detailed-guides/codification.md).

## Applications

Entra ID assets can be added to Applications, so identity objects are grouped and managed together with the infrastructure they support.

1. In the Inventory, filter to your Entra ID assets and select the ones you want to add.
2. Click **Application**, then choose one of:
   * **New Application** — create a new application from the selected assets.
   * **Assign to Existing** — add the selected assets to an application you already have.

Creating a new application walks through four steps:

| Step                  | What you do                                                                                                                                                                                                                           |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Application Scope** | Name the application, select **Entra ID** as the platform it runs on, and choose the Entra ID **Account**—your integration. Optionally narrow the scope by asset type. The assets you selected appear under **Added from Inventory**. |
| **Discovery**         | Review the resources Firefly found for the application, grouped by asset type.                                                                                                                                                        |
| **Resilience**        | Enable **Protect this application**, then set the protection level and the recovery point objective (RPO).                                                                                                                            |
| **Completion**        | Review the summary and click **Create**.                                                                                                                                                                                              |

For Entra ID, **Configuration Backup** is the only available protection level—scheduled snapshots of the application's configuration for point-in-time restore. **Recovery Automation**, which rebuilds an application into a target account, is not available for Entra ID, and the wizard says so when you reach the Resilience step.

Entra ID assets are also supported by **Group by** in the Inventory.

Learn more in [Applications Backup & DR](/key-features/backup-and-dr.md).

## Configuration Details

* Firefly scans your Entra ID tenant on a scheduled interval, and your inventory stays updated automatically.
* Only one integration per Entra ID tenant is supported for each Firefly account. Connecting the same tenant twice is rejected.
* Credentials are encrypted at rest.

## Managing the Integration

To manage an existing integration, go to **Settings > Integrations > Entra ID** and open the integration menu:

* **Edit** — update the integration's credentials or name in place, without disconnecting the tenant.
* **Delete** — remove the integration. Its assets are removed from your Inventory.

## Scanning On Demand

To scan your integration for changes and discover new assets on demand:

1. Go to **Settings > Integrations > Entra ID**.
2. Find the integration you want to scan.
3. On the integration menu, select **Scan Assets**.
4. View changes in the Inventory after several minutes.

## Rotating the Client Secret

Client secrets in Entra ID expire based on the expiry period set when they were created. When a secret expires, Firefly can no longer authenticate and scans will begin to fail.

To move to a new secret:

1. In the Azure Portal, open the same app registration and go to **Manage > Certificates & secrets**.
2. Click **New client secret**, set an expiry, and click **Add**.
3. Copy the new secret **Value**.
4. In Firefly, go to **Settings > Integrations > Entra ID**.
5. On the integration menu, select **Edit**.
6. Paste the new secret and click **Save**.

Firefly re-validates the credentials on save and resumes scanning your tenant.

> Set a reminder ahead of your client secret's expiry date. Firefly cannot scan your tenant with an expired secret.

## Limitations

* **No drift detection** for Entra ID assets. They are indexed for visibility and governance but are not evaluated against IaC.
* **No automated recovery** for Entra ID applications. Configuration Backup is available; Recovery Automation is not—see [Applications](#applications).
* **One tenant per integration.** Connect additional tenants as separate integrations.

## Troubleshooting

| Symptom                                          | Resolution                                                                                                                                                                                          |
| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Credentials rejected on save                     | Confirm you pasted the secret **Value** and not the Secret ID. Confirm the Tenant ID is the *Directory (tenant) ID* and the Client ID is the *Application (client) ID*—these are easy to transpose. |
| Credentials appear correct but validation fails  | Confirm **Grant admin consent** was clicked for the tenant after adding `Directory.Read.All`.                                                                                                       |
| Integration worked previously and is now failing | The client secret has most likely expired. See [Rotating the Client Secret](#rotating-the-client-secret).                                                                                           |
| Connected successfully but no assets appear      | Confirm `Directory.Read.All` was both added and consented, then allow a few minutes for the first scan to complete.                                                                                 |
| Duplicate tenant rejected                        | An Entra ID integration already exists for that tenant in this Firefly account. Check your existing integrations.                                                                                   |
| Drift, IaC, or VCS information is missing        | Expected behavior—see [Discovered Assets](#discovered-assets).                                                                                                                                      |

## Additional Resources

* [Microsoft Entra ID Documentation](https://learn.microsoft.com/en-us/entra/identity/) — Official Microsoft documentation
* [Register an application with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) — Microsoft app registration guide
* [Cloud Asset Inventory](/key-features/cloud-asset-inventory.md) — How Firefly classifies and displays discovered assets


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.firefly.ai/integrations/data-sources/entra-id.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.