# Microsoft Entra ID

> Directory, sign-in and conditional access evidence. Prerequisites, setup steps and troubleshooting.

Source: https://docs.csquaregrc.com/connectors/azure-ad

## What it does

Microsoft Entra ID (Azure AD) supplies identity evidence: accounts, groups, conditional access and MFA registration.

## Prerequisites

- A cSquare GRC workspace where you are an **owner** or **admin**.
- Connection method: **OAuth sign-in**.
- An account at Microsoft Entra ID that can approve the requested access.

## Set up

Open **Settings > Integrations** in [the app](https://app.csquaregrc.com), find Microsoft Entra ID, then:

1. Register an application in Entra ID and note the tenant ID and client ID.
2. Grant the application read-only Microsoft Graph application permissions (Directory.Read.All, Policy.Read.All) and consent as an administrator.
3. Create a client secret and paste all three values here.

## Verify the connection

1. Back in **Settings > Integrations**, Microsoft Entra ID should show **Connected** with a recent sync time.
2. Open **Evidence** and filter by source **Microsoft Entra ID**. The first sync can take a few minutes.
3. Open a control that depends on Microsoft Entra ID and confirm the new evidence is linked.

## AI prompts

Paste these into Fibo in the app, or into any assistant connected through [MCP](/mcp/connect).

```text
I just connected Microsoft Entra ID to cSquare GRC. Check that it is syncing, list the evidence it has collected so far, and tell me which controls in my active programs now have evidence from Microsoft Entra ID.
```

```text
Which controls in my programs could be covered by Microsoft Entra ID evidence but still have no current evidence? Group them by framework and suggest what to collect.
```

## Troubleshooting

### Insufficient privileges to complete the operation

Admin consent was not granted for the Graph permissions. Grant it in the app registration, API permissions.

### Collection stops after a while

The client secret expired. Entra secrets have a maximum lifetime; issue a new one and update the credentials.

### Test connection fails immediately

Nine times out of ten the credential was pasted with a trailing space, or it was issued in a different tenant or region. Re-copy it and try again.

### The connector is quarantined

Collection paused after three consecutive failures. Fix the credential, then use Re-test and re-enable on the Active connections tab; it only resumes when the test passes.

### Connected, but no evidence appears

Check that at least one collection type is selected and that the account can see the resources. Read-only accounts scoped to a single project will only return that project.

### Still stuck?

```text
My Microsoft Entra ID connector in cSquare GRC is failing. Here is the error I see: <paste error>. Walk me through the likely causes and the exact fix, step by step.
```