Microsoft Entra ID

Trustle reads users, groups, group members, directory roles, app roles, service principals, audit logs, and the apps each user consented to from Microsoft Entra ID. Trustle can add and remove group members, directory roles, and app roles, delete users, and revoke apps that a user consented to.

Prerequisites

• A Microsoft Entra account with the Global Administrator or Privileged Role Administrator role. Only these roles can grant admin consent for Microsoft Graph application permissions.
• Microsoft Entra ID P1 or P2, only for last-used dates. Without it, Trustle cannot read sign-in logs.
• To read Azure subscriptions too, use this app registration and this connection. Do the extra steps on the Azure page. Do not create a second app registration.

Configure Microsoft Entra ID

Step 1: Register an app

1. In the Microsoft Entra admin center, go to Applications → App registrations.

2. Click New registration.

   

3. Enter a Name, for example Trustle.

4. In Supported account types, select Accounts in this organizational directory only (single tenant).

5. Leave Redirect URI empty. Click Register.

   

6. The app Overview page opens. It shows the Application (client) ID and the Directory (tenant) ID. You need both in Step 4.

   

Step 2: Create a client secret

1. In the app, go to Certificates & secrets.
2. Click New client secret.
3. Enter a Description, for example Trustle. Select an expiry in Expires, for example 24 months.
4. Click Add.
5. Copy the Value column, not the Secret ID.

Caution

Entra shows the secret value once. If you lose it, create a new secret. When the secret expires, the sync fails.

Step 3: Grant permissions

1. In the app, go to API permissions. Click Add a permission.

2. Select Microsoft Graph, then Application permissions. Do not select Delegated permissions.

   

3. Search for and select each permission:

   Permission	Required	What Trustle does with it
   User.Read.All	Yes	Imports users and deleted users. Test Connection uses it.
   Group.Read.All	Yes	Imports groups.
   GroupMember.ReadWrite.All	Yes	Imports group members. Adds people to groups and removes them.
   Application.Read.All	Yes	Imports service principals and their app roles.
   AppRoleAssignment.ReadWrite.All	Yes	Imports app role assignments. Assigns and removes app roles.
   RoleManagement.ReadWrite.Directory	Yes	Imports directory role members. Adds people to directory roles and removes them.
   AuditLog.Read.All	Yes	Imports directory audit logs. With Entra ID P1 or P2, also reads sign-in logs for last-used dates. The first sync reads the last 30 days.
   Directory.Read.All	Optional	Imports the apps each user consented to. Without it, Trustle shows no consented apps.
   User.ReadWrite.All	Optional	Deletes users. Without it, Trustle cannot delete a user.
   DelegatedPermissionGrant.ReadWrite.All	Optional	Revokes an app that a user consented to. Without it, the revoke fails.
   Synchronization.ReadWrite.All	Optional	Writes group member changes to Active Directory at once. See Active Directory groups. Without it, the change reaches Active Directory on the next Cloud Sync cycle.

4. Click Grant admin consent for your organization. Click Yes.

5. Check that each permission shows Granted for your organization.

   

The app needs no Entra directory role, such as Directory Readers. The application permissions are enough.

Active Directory groups

This section applies only if you use Microsoft Entra Cloud Sync to write groups back to Active Directory.

Trustle adds and removes members in Entra ID. Cloud Sync then writes the change to Active Directory on its next cycle, about every 20 minutes. With Synchronization.ReadWrite.All, Trustle asks Cloud Sync to write the change at once. Trustle also uses Application.Read.All to find the Cloud Sync job.

• The group must have its source of authority in the cloud. Trustle cannot change a group that Active Directory owns.
• The user must come from Active Directory.
• Cloud Sync skips a disabled user.
• Cloud Sync licensing applies. Microsoft Entra ID P1 covers the first two new Entra-to-Active Directory configurations in a tenant. Configurations 3 to 20 need Microsoft Entra ID Governance.

Step 4: Collect the values for Trustle

Trustle field	Where to find it in Entra ID	Example
Client ID	App Overview → Application (client) ID	abcdef12-3456-7890-abcd-ef1234567890
Client Secret	The Value from Step 2	abc8Q~…
Tenant ID	App Overview → Directory (tenant) ID	12345678-1234-1234-1234-123456789012

Connect in Trustle

1. In Trustle, go to Connections.
2. Under Identity Providers, find Entra ID and click Connect.
3. Enter a Connection Name, for example Entra ID production. Description is optional.
4. Enter the values from Step 4. Leave Workspace ID (Optional) empty. Trustle does not use it.
5. Select Use as Identity Provider if Entra ID is the source of your users. Trustle allows one identity provider at a time.
6. Click Test Connection.
7. After the test passes, click Save Connection.

Note

Test Connection checks that Trustle can sign in and read one user. It does not check every permission. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the Entra ID connection.
2. Wait for the first sync to finish.
3. Check that the user count and the group count match Entra ID.

If something is missing, see Troubleshooting.

Security notes

Note

• Use a dedicated app registration for Trustle only.
• Grant only the permissions for the features you use.
• Store the client secret in a secret manager. Never commit it to a repository.
• Before the secret expires, create a new one. Then paste the new value into the Trustle connection.

Troubleshooting

Test Connection fails

• Tenant ID: use the Directory (tenant) ID of the tenant where you registered the app.
• Client ID: use the Application (client) ID, not the Object ID.
• Client Secret: paste the secret Value, not the Secret ID. Check that the secret has not expired.
• Admin consent: User.Read.All must show Granted for your organization.

Test Connection passes, but the sync fails

A required permission from Step 3 is missing or has no admin consent. Test Connection checks only User.Read.All. Grant the missing permission and its admin consent. Then run the sync again.

Saving fails with “Organization already has an identity provider”

Trustle allows one identity provider at a time. Clear Use as Identity Provider, or remove the other identity provider connection first.

Consented apps or last-used dates are missing

• Consented apps: grant Directory.Read.All.
• Last-used dates: grant AuditLog.Read.All. Your tenant also needs Microsoft Entra ID P1 or P2.

Trustle shows the data after the next sync.

Trustle cannot delete a user

Grant User.ReadWrite.All and its admin consent.

Trustle cannot revoke an app that a user consented to

Grant DelegatedPermissionGrant.ReadWrite.All and its admin consent.

A group change takes up to 20 minutes to reach Active Directory

Grant Synchronization.ReadWrite.All and its admin consent. Without it, the change waits for the next Cloud Sync cycle. See Active Directory groups.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the Directory (tenant) ID and the Application (client) ID. Never send a secret, key, or token.