Azure AD
Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service that provides authentication and authorization for users, applications, devices, and resources. This platform enables organizations to manage identities, control access, and secure their cloud and hybrid environments through centralized identity governance.
| Category | Identity |
| Direction | Query source |
| Sign-in | Client Secret |
| Query languages | SQLite |
| Tables | 31 |
| Query templates | 112 |
| Website | http://azure.com |
Before you start
Huntbase signs in to Azure AD with Client Secret. Create the credential in Azure AD first, then keep it to hand for the Connect step.
- In the Microsoft Entra admin center, go to Entra ID › App registrations and select New registration. Enter a name, keep Single tenant only, and select Register.
- On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
- Go to Certificates & secrets › Client secrets › New client secret, add a description and expiry, and select Add. Copy the secret Value right away.
- Go to API permissions › Add a permission › Microsoft Graph › Application permissions and add the read permissions listed below.
- Select Grant admin consent for <your tenant> and confirm.
Permissions:
Application.Read.AllAuditLog.Read.AllDirectory.Read.AllDomain.Read.AllGroup.Read.AllIdentityProvider.Read.AllPolicy.Read.AllUser.Read.All
- To add Microsoft Graph application permissions, sign in as at least a Cloud Application Administrator. Only an admin can grant consent.
- The secret value is never displayed again after you leave the page. Client secrets last 24 months at most, so note the expiry date.
For the vendor's own instructions, see Microsoft Entra app credentials documentation.
Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.
Connect Azure AD
- Go to Connections and click New connection, or click New connection on the Azure AD product page.
- On Product, pick Azure AD and choose the Owner.
- On Details, give the connection a Name and, optionally, a Description.
- On Connect, fill in the settings and credentials described below.
- On Verify, review the summary and click Create & check.
For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.
Settings
Where your Azure AD lives:
| Field | Required | Notes |
|---|---|---|
| Azure Environment | No | Leave blank for the public cloud. Otherwise use AZURECHINACLOUD or AZUREUSGOVERNMENTCLOUD. One of AZUREPUBLICCLOUD, AZURECHINACLOUD, AZUREUSGOVERNMENTCLOUD, AZUREGERMANCLOUD. Defaults to AZUREPUBLICCLOUD. |
| Azure Tenant ID | Yes | The Directory (tenant) ID from the app's Overview page. |
Credentials
The only Method is Client Secret. Enter a Credential label (for example Production), then fill in:
| Field | Required | Notes |
|---|---|---|
| Azure Client ID | Yes | The Application (client) ID from the app's Overview page. Secret — not shown again after you save it. |
| Azure Client Secret | Yes | The secret Value, not the Secret ID. Secret — not shown again after you save it. |
Query it
Once connected, Azure AD can serve these languages in a query tab, and Scout can use it when you ask in Auto:
| Language | Use it for |
|---|---|
| SQLite | SQL over the 31 tables listed below, alongside every other connected source. |
Example: SQLite
Azure AD identity providers basic info — List all identity providers registered within Azure Active Directory, assisting in managing access and authentication within the organization.
select
name,
id
from
azuread_identity_provider;
Azure AD ships with 112 query templates. Find them in Library › Queries — see Query templates.
What syncs automatically
Azure AD comes with a content pack. These queries run on a schedule on each new connection so the entities they find appear in the Activity Feed without you asking. You can turn syncing off from the connection's Synchronisation Settings card.
| Query | Finds |
|---|---|
| Sync users and last sign-in | user |
| Sync groups | group |
| Sync devices | device |
| Sync group memberships | group, user |
| Sync service principals | application |
| Sync directory role assignments | authorization, user |
Tables
Azure AD adds 31 tables. Browse their columns from Schema in the query bar's ⋯ menu.
All 31 tables
| Table | Contains |
|---|---|
azuread_access_review_schedule_definition | Represents an access review schedule definition in Azure AD, which defines the settings and scope for recurring access reviews. |
azuread_admin_consent_request_policy | Represents the policy for enabling or disabling the Azure AD admin consent workflow. |
azuread_application | Represents an Azure Active Directory (Azure AD) application. |
azuread_application_app_role_assigned_to | Represents an application role granted for a specific application. Includes the users and groups assigned app roles for this application. |
azuread_authentication_method_policy | Represents the authentication methods policy for the Microsoft Entra tenant. |
azuread_authorization_policy | Represents a policy that can control Azure Active Directory authorization settings. |
azuread_conditional_access_named_location | Represents an Azure Active Directory (Azure AD) Conditional Access Named Location. |
azuread_conditional_access_policy | Represents an Azure Active Directory (Azure AD) Conditional Access Policy. |
azuread_cross_tenant_access_policy | Represents an Azure Active Directory (Azure AD) Cross-Tenant Access Policy. |
azuread_device | Represents an Azure AD device. |
azuread_device_registration_policy | Represents the Azure Active Directory (Azure AD) device registration policy that manages initial provisioning controls using quota restrictions, additional authentication and authorization checks. |
azuread_directory_audit_report | Represents the list of audit logs generated by Azure Active Directory. |
azuread_directory_role | Represents an Azure Active Directory (Azure AD) directory role. |
azuread_directory_role_assignment | Represents the role assignments for Azure AD resources. |
azuread_directory_role_definition | Represents the role definitions for Azure AD directory resources. |
azuread_directory_role_eligibility_schedule_instance | Represents the schedule instances for role eligibility operations on Azure AD resources. |
azuread_directory_role_template | Represents a directory role template in Azure Active Directory (Azure AD). A directory role template specifies the property values of a directory role. |
azuread_directory_setting | Represents the configurations that can be used to customize the tenant-wide and object-specific restrictions and allowed behavior |
azuread_domain | Represents an Azure Active Directory (Azure AD) domain. |
azuread_external_identity_policy | Represents the tenant-wide external identity policy that controls whether external users can leave a Microsoft Entra tenant via self-service controls. |
azuread_group | Represents an Azure AD group. |
azuread_group_app_role_assignment | Represents an application role assigned to a group. |
azuread_identity_provider | Represents an Azure Active Directory (Azure AD) identity provider. |
azuread_security_defaults_policy | Represents the Azure Active Directory security defaults policy |
azuread_service_principal | Represents an Azure Active Directory (Azure AD) service principal. |
azuread_service_principal_app_role_assigned_to | Represents an application role granted for a specific application. Includes the users and groups assigned app roles for this enterprise application. |
azuread_service_principal_app_role_assignment | Represents an application role assigned to a service principal. |
azuread_sign_in_report | Represents an Azure Active Directory (Azure AD) sign-in report. |
azuread_user | Represents an Azure AD user account. |
azuread_user_app_role_assignment | Represents an application role assigned to a user. Also includes application role assignments granted to groups that the user is a direct member of. |
azuread_user_registration_details_report | Represents an Azure Active Directory (Azure AD) user-registration-details report. |
Next steps
- Connections — health, credentials and settings after you connect
- Query languages — syntax, parameters and time ranges
- Chatting with Scout — ask questions without writing a query
- All integrations — the rest of the catalog