Microsoft Entra ID

Trustle registers an application in your Microsoft Entra ID (formerly Azure AD) tenant to analyze your Microsoft environment. The app registration lets Trustle analyze user access patterns and manage group memberships across your Microsoft environment.

Note

Microsoft uses a single, unified API. Register Trustle as an application once to connect both Microsoft Entra ID and Azure.

Prerequisites

• Global Administrator access to your Microsoft Entra ID tenant.
• Ability to create an application registration and copy these values for Trustle setup:
  1. The tenant ID
  2. The application (client) ID
  3. The client secret

Configure Microsoft Entra ID

Step 1: Gather your Microsoft environment information

Trustle needs your Microsoft environment structure to configure this integration.

1. Sign in to the Microsoft Entra Admin Center.
   1. Go to https://entra.microsoft.com.
   2. Sign in with your Global Administrator account.
2. Find your tenant ID.
   1. In the left sidebar, click Overview.
   2. Under Basic information, locate the Tenant ID. It has a GUID format, for example 12345678-1234-1234-1234-123456789012.
   3. Copy this ID. You’ll enter it into Trustle.
3. Record your primary domain.
   1. In the same Overview section, note your Primary domain. It looks like yourcompany.onmicrosoft.com or your custom domain.

This information helps Trustle cover all users, groups, and applications in your organization.

Step 2: Create the app registration

Create an app registration for Trustle with the permissions it needs to manage your Microsoft environment.

1. Navigate to app registrations.
   1. In the Entra Admin Center, go to Applications > App registrations.
   2. Click New registration.

1. Configure the basic registration.
   1. Name: enter Trustle-Integration (or a similar descriptive name).
   2. Supported account types: select Accounts in this organizational directory only (single tenant).
   3. Redirect URI: leave this blank. Trustle doesn’t need it.
   4. Click Register.

1. Record the application information.
   1. After creation, the app overview page opens.
   2. Copy and save the Application (client) ID, for example 09e9d206-afc7-4192-8283-697ae865ee00.
   3. Copy and save the Directory (tenant) ID. It should match the tenant ID from step 1.
   4. You’ll enter these values in the Trustle UI.

Note

This app registration has access to your Microsoft environment for IAM purposes only.

Step 3: Create a client secret for authentication

The app registration needs credentials to authenticate with Microsoft APIs.

1. Navigate to certificates and secrets.
   1. In your app registration, click Certificates & secrets in the left menu.
   2. Click New client secret.
2. Configure the secret.
   1. Description: enter Trustle-ClientSecret.
   2. Expires: select 24 months (recommended for stability).
   3. Click Add.
3. Copy the secret value.
   1. Immediately copy the Value field. Don’t copy the Secret ID.
   2. The value looks like abc123def456ghi789~jkl012mno345pqr678.
   3. Trustle shows this value only once. Store it securely.
   4. You’ll enter this value into Trustle along with the client ID.

Caution

You can’t retrieve the client secret after you navigate away from this page. If you lose it, create a new one.

Step 4: Configure required Microsoft Graph API permissions

This step grants the permissions Trustle needs to analyze and manage your Microsoft Entra ID environment.

1. Navigate to API permissions.
   1. In your app registration, click API permissions in the left menu.
   2. Microsoft Graph appears with basic permissions already present.
2. Add Microsoft Graph permissions.
   1. Click Add a permission.
   2. Select Microsoft Graph.
   3. Choose Application permissions. Don’t choose Delegated permissions.

1. Add each required permission. Search for and select these permissions one by one.

   Permission	Purpose
   User.Read.All	Read user profiles and account status.
   Group.Read.All	Read group properties and membership.
   GroupMember.ReadWrite.All	Add and remove group members.
   Application.Read.All	Read app registrations and service principals.
   AppRoleAssignment.ReadWrite.All	Read and manage app role assignments.
   AuditLog.Read.All	Read sign-in logs and audit events.
   Directory.Read.All	Read tenant-level directory data.
   RoleManagement.ReadWrite.Directory	Read and manage Microsoft Entra directory role assignments.

2. Grant admin consent.

   1. After you add all permissions, click Grant admin consent for [Your Organization].
   2. Click Yes to confirm.
   3. Verify all permissions show Granted for [Your Organization] with green checkmarks.

These permissions let Trustle:

• Read user profiles and account status.
• Read and manage group memberships.
• Read app registrations and role assignments.
• Read sign-in logs and audit events for access patterns.
• Read and manage Microsoft Entra directory role assignments.

Step 5 (optional): Test and verify configuration

Confirm everything is configured correctly before you enter credentials into Trustle.

1. Verify the app registration.
   1. In App registrations, confirm your app exists.
   2. Check that all required API permissions are granted with admin consent.
   3. Verify the client secret is created and saved.
2. Test permission access.
   1. In your app registration, go to API permissions.
   2. All permissions should show Granted for [Organization] status.
   3. No permissions should show Not granted or require additional consent.
3. Verify the directory role assignment.
   1. Go to Roles and administrators > Directory Readers.
   2. Confirm your app registration appears in the assignments.

Your app registration now has:

• Read access to users: profile and status information.
• Read and update access to groups: group memberships.
• Read access to applications: service principals and role assignments.
• Audit log access: sign-in patterns and security events.
• Directory information: tenant-level organizational data and directory roles.

If you also want to connect Azure, continue with the Azure-specific setup on that page. It reuses this same app registration.

Connect in Trustle

Once setup is complete, enter this information into Trustle:

1. Tenant ID (Directory ID)
2. Application (Client) ID
3. Client Secret value

Verify

After you connect, Trustle:

1. Imports group memberships and role assignments for all accounts (initial discovery).
2. Analyzes 30 days of activity and identifies unused permissions and users.
3. Populates the IAM dashboard with the findings.
4. Runs periodic imports and analysis to show any changes in these findings (ongoing monitoring).

Troubleshooting

If you run into issues during setup:

• Permission consent errors: use a Global Administrator account.
• Missing client secret: this value only shows once. Recreate it if you lose it.
• API permission: verify all permissions are Application type, granted, and approved.

Contact Trustle technical support with specific error messages. Provide:

• Your tenant ID and application ID for faster troubleshooting.
• Screenshots or audit log samples, if available.
• Error messages or descriptions.