Skip to main content

Azure AD

Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service that provides authentication and authorization for users, applications, devices, and resources. This platform enables organizations to manage identities, control access, and secure their cloud and hybrid environments through centralized identity governance.

CategoryIdentity
DirectionQuery source
Sign-inClient Secret
Query languagesSQLite
Tables31
Query templates112
Websitehttp://azure.com

Before you start​

Huntbase signs in to Azure AD with Client Secret. Create the credential in Azure AD first, then keep it to hand for the Connect step.

  1. In the Microsoft Entra admin center, go to Entra ID › App registrations and select New registration. Enter a name, keep Single tenant only, and select Register.
  2. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
  3. Go to Certificates & secrets › Client secrets › New client secret, add a description and expiry, and select Add. Copy the secret Value right away.
  4. Go to API permissions › Add a permission › Microsoft Graph › Application permissions and add the read permissions listed below.
  5. Select Grant admin consent for <your tenant> and confirm.

Permissions:

  • Application.Read.All
  • AuditLog.Read.All
  • Directory.Read.All
  • Domain.Read.All
  • Group.Read.All
  • IdentityProvider.Read.All
  • Policy.Read.All
  • User.Read.All
Watch out for
  • To add Microsoft Graph application permissions, sign in as at least a Cloud Application Administrator. Only an admin can grant consent.
  • The secret value is never displayed again after you leave the page. Client secrets last 24 months at most, so note the expiry date.

For the vendor's own instructions, see Microsoft Entra app credentials documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Azure AD​

  1. Go to Connections and click New connection, or click New connection on the Azure AD product page.
  2. On Product, pick Azure AD and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Azure AD lives:

FieldRequiredNotes
Azure EnvironmentNoLeave blank for the public cloud. Otherwise use AZURECHINACLOUD or AZUREUSGOVERNMENTCLOUD. One of AZUREPUBLICCLOUD, AZURECHINACLOUD, AZUREUSGOVERNMENTCLOUD, AZUREGERMANCLOUD. Defaults to AZUREPUBLICCLOUD.
Azure Tenant IDYesThe Directory (tenant) ID from the app's Overview page.

Credentials​

The only Method is Client Secret. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
Azure Client IDYesThe Application (client) ID from the app's Overview page. Secret — not shown again after you save it.
Azure Client SecretYesThe secret Value, not the Secret ID. Secret — not shown again after you save it.

Query it​

Once connected, Azure AD can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
SQLiteSQL over the 31 tables listed below, alongside every other connected source.

Example: SQLite​

Azure AD identity providers basic info — List all identity providers registered within Azure Active Directory, assisting in managing access and authentication within the organization.

select
name,
id
from
azuread_identity_provider;

Azure AD ships with 112 query templates. Find them in Library › Queries — see Query templates.

What syncs automatically​

Azure AD comes with a content pack. These queries run on a schedule on each new connection so the entities they find appear in the Activity Feed without you asking. You can turn syncing off from the connection's Synchronisation Settings card.

QueryFinds
Sync users and last sign-inuser
Sync groupsgroup
Sync devicesdevice
Sync group membershipsgroup, user
Sync service principalsapplication
Sync directory role assignmentsauthorization, user

Tables​

Azure AD adds 31 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 31 tables
TableContains
azuread_access_review_schedule_definitionRepresents an access review schedule definition in Azure AD, which defines the settings and scope for recurring access reviews.
azuread_admin_consent_request_policyRepresents the policy for enabling or disabling the Azure AD admin consent workflow.
azuread_applicationRepresents an Azure Active Directory (Azure AD) application.
azuread_application_app_role_assigned_toRepresents an application role granted for a specific application. Includes the users and groups assigned app roles for this application.
azuread_authentication_method_policyRepresents the authentication methods policy for the Microsoft Entra tenant.
azuread_authorization_policyRepresents a policy that can control Azure Active Directory authorization settings.
azuread_conditional_access_named_locationRepresents an Azure Active Directory (Azure AD) Conditional Access Named Location.
azuread_conditional_access_policyRepresents an Azure Active Directory (Azure AD) Conditional Access Policy.
azuread_cross_tenant_access_policyRepresents an Azure Active Directory (Azure AD) Cross-Tenant Access Policy.
azuread_deviceRepresents an Azure AD device.
azuread_device_registration_policyRepresents the Azure Active Directory (Azure AD) device registration policy that manages initial provisioning controls using quota restrictions, additional authentication and authorization checks.
azuread_directory_audit_reportRepresents the list of audit logs generated by Azure Active Directory.
azuread_directory_roleRepresents an Azure Active Directory (Azure AD) directory role.
azuread_directory_role_assignmentRepresents the role assignments for Azure AD resources.
azuread_directory_role_definitionRepresents the role definitions for Azure AD directory resources.
azuread_directory_role_eligibility_schedule_instanceRepresents the schedule instances for role eligibility operations on Azure AD resources.
azuread_directory_role_templateRepresents a directory role template in Azure Active Directory (Azure AD). A directory role template specifies the property values of a directory role.
azuread_directory_settingRepresents the configurations that can be used to customize the tenant-wide and object-specific restrictions and allowed behavior
azuread_domainRepresents an Azure Active Directory (Azure AD) domain.
azuread_external_identity_policyRepresents the tenant-wide external identity policy that controls whether external users can leave a Microsoft Entra tenant via self-service controls.
azuread_groupRepresents an Azure AD group.
azuread_group_app_role_assignmentRepresents an application role assigned to a group.
azuread_identity_providerRepresents an Azure Active Directory (Azure AD) identity provider.
azuread_security_defaults_policyRepresents the Azure Active Directory security defaults policy
azuread_service_principalRepresents an Azure Active Directory (Azure AD) service principal.
azuread_service_principal_app_role_assigned_toRepresents an application role granted for a specific application. Includes the users and groups assigned app roles for this enterprise application.
azuread_service_principal_app_role_assignmentRepresents an application role assigned to a service principal.
azuread_sign_in_reportRepresents an Azure Active Directory (Azure AD) sign-in report.
azuread_userRepresents an Azure AD user account.
azuread_user_app_role_assignmentRepresents an application role assigned to a user. Also includes application role assignments granted to groups that the user is a direct member of.
azuread_user_registration_details_reportRepresents an Azure Active Directory (Azure AD) user-registration-details report.

Next steps​