Microsoft

Connect Microsoft Entra identities and Azure resources to Superviso.

The Microsoft connector uses Microsoft Entra as the source for Identity Source and Identity & Access integrations, and Microsoft Azure as the source for Assets & Data resources.

Required values

Application (client) ID and Client Secret Value for the application registration
Tenant ID for the Microsoft Entra directory
Subscription ID for Azure resource collection
Optional group display-name prefixes for Identity Source and privilege collection

Required access

Grant the Microsoft Graph application permissions required for the options you enable, with tenant-wide admin consent:

Identities and groups / Identity Source: User.Read.All.
Group collection / Identity Source: GroupMember.Read.All.
Directory Roles collection: RoleManagement.Read.Directory.
Hidden group membership: Member.Read.Hidden only when you enable Read hidden group memberships.

For Assets & Data, grant Azure RBAC: Reader on the configured subscription. Review the form’s Required privileges and Optional privileges after choosing integrations and filters; they reflect that scope.

Use a dedicated application registration and rotate its client secret before expiration. If memberships cannot be read, existing memberships are preserved and reconciliation waits for a complete observation.

Before you start

Create the credentials listed above in the provider’s administration tools.

Configure in Superviso

Open Settings → Connectors and choose Add connector.
Select Microsoft from Provider.
Associate the intended asset, or use the new-asset option when appropriate. Enable only the supported synchronization options you need.
Enter Application (client) ID, Client Secret Value, and Microsoft Entra Tenant ID; provide Subscription ID for resource collection. Review group prefixes, Groups, Directory Roles, and optional hidden-membership access.
Recheck the required privileges, scope, and filters, then choose Create connector. Resolve any validation errors shown by the form.
Open the saved connector, choose Sync connector when available, and confirm the synchronization scope.
Open Logs, wait for execution to finish, and inspect the result and any errors. Open the relevant Identities, Privileges, or Resources page for the enabled integration to verify collected records.

For authoritative user synchronization, follow Identity Source before enabling that option. Keep the source inactive while validating the expected population; a manual synchronization still applies user and membership changes. SSO sign-in is configured separately.

Unsaved Microsoft connector setup with synchronization options and blank credential fields. — Select Microsoft and review its supported options before entering your own credentials. Select the image to view it full size.

Expected outcome

The connector is saved for Microsoft with the intended integration and collection scope. Synchronization logs show progress, results, and imported records.

If setup or synchronization fails

Check the exact account or organization identifier, required form values, credential validity, granted access, and selected filters. Inspect the failed log’s details before retrying. If only some records are missing, check their scope and provider permissions. For synchronization status and source-managed fields, see Connectors and synchronization logs.

Back to Providers