Azure Entra Id

Azure Entra Id is the new generation connector that replaces the soon to be deprecated Azure Admin. Where Azure Admin only watched certificates, secrets and directory synchronisation, Entra Id gives you a complete read only view of your tenant: identities and licenses, security posture, groups, applications, devices, MFA coverage, privileged access and service health. Everything is collected through the Microsoft Graph v1.0 API.

The connector degrades gracefully: when a permission is missing it does not fail silently, it returns an explicit message naming the exact permission to grant.

Permissions. Grant, to the application declared in your Graph API v2 Vault (create it first — see how to add a vault), the Graph application permissions matching the item types you use.

Base permissions (enough for Certs & Secrets, AD Sync and Application Sync): Application.Read.All, Directory.Read.All, Organization.Read.All, Synchronization.Read.All.

Item type	Additional Graph permission
Users & Licenses	User.Read.All — plus AuditLog.Read.All for inactivity and last sign in
Security Posture	User.Read.All, Directory.Read.All — plus Policy.Read.All (Conditional Access) and IdentityRiskyUser.Read.All + Entra ID P2 (risky users)
Groups	Group.Read.All
Devices	Device.Read.All
Health	ServiceHealth.Read.All
MFA Coverage	UserAuthenticationMethod.Read.All
App Permissions Audit	Directory.Read.All
Privileged Access	RoleManagement.Read.Directory + Entra ID P2

Options

• Name: a simple label to find the instance easily in SenHub.
• Description: for your own usage only.
• Vault: the Graph API v2 Vault holding your credentials (create it first).
• Group: optional — assign this instance to a group to organise it within SenHub.
• Tenant Name: your Microsoft Entra tenant, usually your primary domain (for example contoso.onmicrosoft.com).
• Item Type: what to pull metrics for. Each type reveals its own extra fields:
  • Certs & Secrets — monitors the certificate and client secret lifecycle of your applications. The core use case: catch an expiring credential before it breaks an authentication.
    • Application scope: App registrations (your own apps, default), Enterprise apps (service principals, including the SAML signing certificates of your SSO / gallery apps), or Registrations + Enterprise.
    • Authentication mode: Overview (a status summary, sample below), Certificates (one channel per certificate), Client secrets (one channel per secret), or Application Certs & Secrets (both).
    • Filter (per credential modes): None, Include or Exclude, together with a Filter expression listing application names or ids, comma separated, partial match without wildcard.
    • Channel naming (per credential modes): App name + key ID (stable, avoids collisions) or Credential name (the friendly name).
  • AD Sync — status and time elapsed since the last synchronisation between your on premises Active Directory and Entra ID.
  • Application Sync Job — provisioning status and counters of the synchronisation with a third party application.
    • Service Principal Id: the SP id of the application to track.
  • Users & Licenses — total, enabled and disabled accounts, guests, users inactive for 30 or 90 days, accounts that never signed in, assigned licenses and estimated wasted cost.
    • License cost: average monthly cost of a license, used to estimate wasted spend (default 15).
  • Security Posture — directory roles and global admin count, Conditional Access policies (enabled, report only, disabled) and risky users by level, each tier degrading gracefully with the permissions granted.
  • Groups — total, Microsoft 365, Teams enabled, security, dynamic, empty and guest bearing groups.
  • Applications — credentials audit of your app registrations: credentials expiring within 7, 30 or 90 days, single and multi tenant apps, apps without any credential.
  • Devices — inventory by operating system: compliant, managed, Entra joined and stale devices.
  • License Details — per SKU breakdown: purchased, assigned, available seats, utilization rate and estimated unused cost.
    • License cost: average monthly cost of a license, used to estimate the unused cost (default 15).
  • Health — Microsoft Entra service health: overall status and number of active incidents and advisories.
  • MFA Coverage — MFA rate, passwordless usage, SSPR coverage, admins without MFA and SMS only accounts.
  • App Permissions Audit — OAuth2 permission grants: admin and user consented grants, and apps holding high risk permissions (directory write, mail access).
  • Privileged Access — Privileged Identity Management: eligible versus permanent role assignments and permanently assigned global admins (requires Entra ID P2).

Sample return, Certs & Secrets in Overview mode:

{
  "metrics": [
    { "channel": "ValidSecret", "value": 2205, "unit": "#" },
    { "channel": "ExpiredSecret", "value": 270, "unit": "#" },
    { "channel": "ValidCert", "value": 26, "unit": "#" },
    { "channel": "ExpiredCert", "value": 1, "unit": "#" }
  ],
  "message": "Metrics successfully retrieved.",
  "status": "OK",
  "date": 1725981405127
}

Sample return, Application Sync Job:

{
  "metrics": [
    { "channel": "synchronizationStatusCode", "value": 1, "unit": "#" },
    { "channel": "lastSuccessfulExecutionStatus", "value": 1, "unit": "#" },
    { "channel": "countImported", "value": 3, "unit": "#" },
    { "channel": "countExported", "value": 0, "unit": "#" },
    { "channel": "countEscrowed", "value": 0, "unit": "#" },
    { "channel": "duration", "value": 2, "unit": "s" },
    { "channel": "finishedsince", "value": 6, "unit": "m" }
  ],
  "message": "Metrics successfully retrieved.",
  "status": "OK",
  "date": 1725981120351
}