Microsoft Entra ID
Configure Microsoft Entra ID (formerly Azure AD) integration with RAD Security for enterprise identity management.
This guide walks you through integrating Microsoft Entra ID (formerly Azure Active Directory) with RAD Security for enterprise identity and access management, allowing you to sync users, groups, and organizational data from Microsoft Entra ID.
The setup process involves:
- Creating an Entra ID application and service principal
- Generating a client secret
- Assigning Microsoft Graph API permissions
- Configuring the integration in RAD Security
Prerequisites
Before you begin, ensure you have:
- Admin access to Microsoft Entra ID
- An Entra ID tenant
- P1 or P2 premium subscription for your Entra ID tenant
- Access to RAD Security workspace with integration permissions
Premium Subscription Required: Your Entra ID tenant must have a P1 or P2 premium subscription to support advanced query capabilities. Without this, filtering functionality may not work correctly.
Note: Azure AD B2C tenants do not support advanced query capabilities and may have limited functionality.
Step 1: Create Application and Service Principal
Follow Microsoft Documentation
Follow the Microsoft guide to create a Microsoft Entra application and service principal.
Configure Application Settings
When creating the application:
- Choose a descriptive name (e.g., "RAD Security Integration")
- For Redirect URI type, select Single-page application (SPA)
- Leave the redirect URI field blank (users don't need to sign in directly)
Since this is a service-to-service integration, no user sign-in is required, so we can leave the redirect URI empty.
Note Application Credentials
Once the application is created, navigate to the Overview tab and copy the following values to a secure location:
- Application (client) ID
- Directory (tenant) ID
You'll need these values later for configuring the integration in RAD Security.
Step 2: Create Client Secret
Navigate to Certificates & Secrets
In your Entra ID application, go to Manage > Certificates & secrets
Create New Client Secret
Follow the Microsoft guide to add a new client secret.
- Click New client secret
- Add a description (e.g., "RAD Security Integration Key")
- Select an expiration period
- Click Add
Copy Secret Value
Immediately copy the secret value to a secure location alongside your Client ID and Tenant ID.
This is your only chance to view the secret! Once you navigate away from this page, you cannot retrieve the secret value again. If you lose it, you'll need to create a new secret.
Step 3: Assign Application Permissions
Navigate to API Permissions
In your Entra ID application, go to Manage > API permissions
Add Microsoft Graph Permissions
Follow the Microsoft guide to assign app roles to the application.
Add the following Application permissions from the Microsoft Graph API section:
Required Permissions
Grant Admin Consent
Grant Consent
After adding all permissions, click Grant admin consent for [Your Organization]
Admin consent is required! The permissions will not be active until an administrator grants consent for the organization.
Verify Consent Status
Verify that all permissions show a green checkmark in the Status column indicating consent has been granted.
Step 4: Configure in RAD Security
Navigate to your RAD Security workspace and configure the Microsoft Entra ID integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Tenant ID | The Directory (tenant) ID from Step 1 | 00000000-0000-0000-0000-000000000000 |
| Client ID | The Application (client) ID from Step 1 | 11111111-1111-1111-1111-111111111111 |
| Client Secret | The client secret value from Step 2 | your-secret-value-here |
| Base URL | Microsoft Graph API root URL (for special deployments only) | https://graph.microsoft.com/ |
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources > Integrations > IAM in RAD Security
- Locate your Microsoft Entra ID integration
- Check the connection status shows as Connected
- Verify users and groups are syncing correctly
Your Microsoft Entra ID integration is now configured! RAD Security can now sync users, groups, and organizational data from your Entra ID tenant.
What Data is Synced
Once configured, RAD Security will sync the following data from Microsoft Entra ID:
Use Cases
SSO & Authentication Enable single sign-on for RAD Security users through Microsoft Entra ID.
User Provisioning Automatically sync users and groups from Entra ID to RAD Security.
RBAC Integration Map Entra ID groups to RAD Security roles for streamlined access control.
Audit & Compliance Track identity-related events and maintain audit trails for compliance.
Troubleshooting
Security Best Practices
Rotate Secrets Regularly Set short expiration periods for client secrets and rotate them before expiry. Create the new secret before deleting the old one.
Least Privilege Access Only grant the permissions required for your use case. Remove any unused permissions.
Monitor Application Activity Regularly review sign-in logs and audit logs for the service principal to detect anomalous activity.
Secure Secret Storage Store client secrets in a secure password manager or secrets vault. Never commit them to version control.
Track Expiration Dates Set calendar reminders for secret expiration dates to avoid service disruptions.
Use Managed Identity Where possible, consider using Azure Managed Identities instead of client secrets for enhanced security.