Entra ID

Firefly integrates with Microsoft Entra ID (formerly Azure AD) to pull in information about your directory resources—such as users, service principals, and app registrations—directly into your Firefly Inventory. This gives you a unified view of your identity assets alongside the rest of your cloud infrastructure, so you can govern who and what has access across your environment.

Prerequisites

• A Microsoft Entra ID tenant.

• Permission to register an application in the tenant.

• Permission to grant admin consent for Microsoft Graph application permissions. This is a tenant-level action and typically requires a Global Administrator or Privileged Role Administrator.

Setup Procedure

1. Register an Application in Entra ID

1. In the Azure Portal, go to App registrations.

2. Click New registration.

3. Enter a name for the application (for example, firefly-app).

4. Leave the default settings and click Register.

5. On the application's Overview page, copy the following values:

   • Application (client) ID

   • Directory (tenant) ID

2. Grant API Permissions

1. In the application, go to API permissions.

2. Click Add a permission > Microsoft Graph > Application permissions.

3. Add the Directory.Read.All permission.

4. Click Grant admin consent for your tenant.

Admin consent is required. Without it, Firefly cannot validate the connection even when the credentials are correct. If you do not hold a Global Administrator or Privileged Role Administrator role, ask someone who does to grant consent before continuing.

3. Create a Client Secret

Create the secret once permissions are in place. Its value is shown only once, so it is best generated immediately before you paste it into Firefly.

1. In the application, go to Manage > Certificates & secrets.

2. Click New client secret.

3. Set an expiry period and click Add.

4. Copy the secret Value immediately—it is not shown again.

Copy the secret Value, not the Secret ID. These are different, and the Secret ID will not authenticate.

Make a note of the expiry date you set. When a client secret expires, Firefly can no longer scan your tenant—see Rotating the Client Secret.

4. Configure in Firefly

1. In Firefly, go to Settings > Integrations.

2. Click Add New > Entra ID.

3. Enter your Tenant ID (the Directory (tenant) ID from step 1).

4. Enter your Client ID (the Application (client) ID from step 1).

5. Paste your Client Secret (the secret Value from step 3).

6. Enter an Integration Name to customize how this integration appears in Firefly.

7. Click Next.

8. Click Done.

On save, Firefly validates the credentials against the Microsoft Graph API and displays an error if the credentials are invalid or admin consent has not been granted. Once validated, Firefly triggers an initial scan of your tenant.

Supported Assets

Firefly currently discovers three Entra ID asset types:

Asset Type	Identifier	Description
Users	azuread_user	Entra ID user accounts
Service Principals	azuread_service_principal	Service principal objects in the tenant
App Registrations	azuread_application	Applications registered in the tenant

Additional Entra ID resource types—covering identity, credentials, ownership, and governance objects—are planned.

Asset type identifiers use the azuread_ prefix, matching the naming used by the underlying Microsoft provider. This is expected and does not indicate a stale or misconfigured integration.

Discovered Assets

Entra ID assets appear in your Inventory with the Discovered status.

Discovered means Firefly has found the asset in your tenant and indexed it, but has not evaluated it against Infrastructure-as-Code. It sits alongside the other inventory states—Managed, Unmanaged, Drifted, and Ghost.

Because Discovered assets are not evaluated against IaC, these fields are intentionally empty for them:

• Drift status

• IaC type

• VCS repository and stack

Empty drift, IaC, and VCS fields on Entra ID assets are expected behavior, not a data problem.

Configuration Details

• Firefly scans your Entra ID tenant on a scheduled interval, and your inventory stays updated automatically.

• Only one integration per Entra ID tenant is supported for each Firefly account. Connecting the same tenant twice is rejected.

• Credentials are encrypted at rest.

Scanning On Demand

To scan your integration for changes and discover new assets on demand:

1. Go to Settings > Integrations > Entra ID.

2. Find the integration you want to scan.

3. On the integration menu, select Scan Assets.

4. View changes in the Inventory after several minutes.

Rotating the Client Secret

Client secrets in Entra ID expire based on the expiry period set when they were created. When a secret expires, Firefly can no longer authenticate and scans will begin to fail.

To rotate the secret:

1. In the Azure Portal, open the same app registration and go to Manage > Certificates & secrets.

2. Click New client secret, set an expiry, and click Add.

3. Copy the new secret Value.

4. In Firefly, go to Settings > Integrations > Entra ID.

5. On the integration menu, select Edit.

6. Paste the new secret and click Save.

Set a reminder ahead of your client secret's expiry date. Firefly cannot scan your tenant with an expired secret.

Limitations

• Three asset types are supported today—users, service principals, and app registrations. Other directory objects are not yet discovered.

• No drift detection for Entra ID assets. They are indexed for visibility and governance but are not evaluated against IaC.

• No codification of Entra ID assets.

• One tenant per integration. Connect additional tenants as separate integrations.

Troubleshooting

Symptom	Resolution
Credentials rejected on save	Confirm you pasted the secret Value and not the Secret ID. Confirm the Tenant ID is the Directory (tenant) ID and the Client ID is the Application (client) ID—these are easy to transpose.
Credentials appear correct but validation fails	Confirm Grant admin consent was clicked for the tenant after adding Directory.Read.All.
Integration worked previously and is now failing	The client secret has most likely expired. See Rotating the Client Secret.
Connected successfully but no assets appear	Confirm Directory.Read.All was both added and consented, then allow a few minutes for the first scan to complete.
Duplicate tenant rejected	An Entra ID integration already exists for that tenant in this Firefly account. Check your existing integrations.
Drift, IaC, or VCS columns are empty	Expected behavior—see Discovered Assets.

Additional Resources

• Microsoft Entra ID Documentation — Official Microsoft documentation

• Register an application with Microsoft Entra ID — Microsoft app registration guide

• Cloud Asset Inventory — How Firefly classifies and displays discovered assets