Skip to content

Microsoft Entra ID directory inventory

Microsoft Entra ID supplies user, group, and directory context so Venturi can attribute AI usage to workforce owners and teams.

Onboarding scope

This guide covers the read-only azure_ad connector in the Venturi platform connector package: directory inventory and sign-in context. It grants no directory write access.

Required access

Grant a dedicated app registration these Microsoft Graph application permissions (app roles that act without a signed-in user). They are vendor permissions, entered exactly as written:

Microsoft Graph application permission Purpose
User.Read.All Read users, lifecycle status, and profile attributes.
Group.Read.All Read groups and membership context.
Directory.Read.All Validate tenant directory access and directory metadata.
AuditLog.Read.All Read sign-in logs (/auditLogs/signIns) used as authentication context.

Do not grant ReadWrite permissions or delegated permissions. Reading sign-in logs through Microsoft Graph also requires a Microsoft Entra ID P1 or P2 license on the tenant. See Microsoft’s Graph permissions reference, List signIns permissions, and activity-log prerequisites.

Setup

  1. Create a dedicated app registration in the tenant.
  2. Add the four application permissions above and have a Privileged Role Administrator or Global Administrator grant admin consent.
  3. Record the directory (tenant) ID and application (client) ID. Authenticate the app with a federated identity credential that trusts the issuer and subject shown in guided setup, or with a certificate. Use a client secret only as a fallback, and store the certificate or secret as an encrypted credential reference in Settings / Admin / Credentials. A federated identity credential stores no secret.
  4. Configure VENTURI_AZURE_AD_TENANT_ID; set VENTURI_AZURE_AD_GRAPH_BASE and VENTURI_AZURE_AD_PAGE_SIZE only when your environment requires overrides.
  5. In Venturi, go to Integrations / Microsoft Entra ID and run Test connection.

Each sync reads the directory inventory (users, groups, and memberships) in full and reads sign-in events created since the newest sign-in the previous sync recorded, so no time lookback applies. Microsoft Graph returns only sign-ins inside the tenant’s Microsoft Entra ID log retention period. See sync windows and failure behavior.

Verification

  • Test connection passes the read-only boundary check: user, group, directory, and sign-in reads succeed, and the app holds no ReadWrite permission.
  • User and group counts match the tenant scope you granted.
  • Deactivated users remain available for historical attribution rather than being removed from past records.
  • The connector inventory marks Microsoft Entra ID as read-only.
  • Coverage & unknowns no longer lists directory inventory as a would-close source for connected teams.

Rotation and offboarding

Rotate the certificate or client secret through your normal privileged-access process before it expires, then update the credential reference in Settings / Admin / Credentials. Federated identity credentials have no secret to rotate; review the issuer and subject when guided setup generates new values. If you remove the connector, new workforce joins, moves, and leaves stop updating until the connector is restored.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: Microsoft Entra ID directory inventory
Page: https://docs.venturi.systems/connectors/azure-ad/