# SailPoint Microsoft Entra SSO Discovery Connector Documentation > Microsoft Entra SSO Discovery Connector Documentation # Documentation # Additional Settings Schedule discovering applications connected to the Microsoft Entra SSO instance on these configuration pages. You can modify and manage scheduling aggregation directly within the interface. ## Discovery Settings 1. In the **Additional Settings** section, select **Discovery Settings**. 2. To aggregate enterprise applications that are connected to your discovery source, select **Start Discovering**. The aggregation begins immediately and occurs once. 3. Select **Enable Schedule** to schedule recurring aggregations. > **Screenshot** > > [![Discovery Settings]()]() 4. Select the **Frequency** from the dropdown, and enter the time of day. - **Daily** - Aggregation occurs once per day at the time selected. 1. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. - **Weekly** - Aggregation occurs once per week on the day and time selected. 1. Select a **Day** of the week, Sunday - Saturday, from the dropdown. 2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. - **Monthly** - Aggregation occurs once per month on the date and time selected. 1. Select a **Date** of the month, 1 - 28, from the dropdown. 2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. > **Note** > > The time zone (GMT offset) for the entitlement aggregation schedule is determined by the time zone set for the connected virtual appliance cluster. 5. Select **Save**. ## Latest Application Discovery Information about the most recent application discovery is displayed under **Latest Application Discovery**. ## Discovery Activity To view the list of all enterprise application aggregations on this source, select **Discovery Activity**. When applications are being aggregated, an entry is added to the Discovery Activity section. This includes information like the admin who started the aggregation (for manual aggregations), the date and time the aggregation occurred, the number of objects scanned, and its current status. Aggregations are ordered by most recent aggregation task. You can also sort by status to quickly find success, warning, error, and terminated tasks. > [!NOTE] > > **Screenshot** > > [![Discovery Activity]()]() # Connecting SailPoint and Microsoft Entra SSO To connect SailPoint and Microsoft Entra SSO, perform the following tasks: ## Adding Discovery Connector in SailPoint Discovery connectors have categories that encompass a group of discovery sources to find enterprise applications. You can automatically discover enterprise applications using discovery sources, which search for applications your organization has on-boarded or can on-board. For more information, refer to [Discovering Enterprise Applications](). 1. Go to **Admin \> Connections \> Discovery Connectors**. 2. Select **Create Connector**. 3. Select **Connector Category**. 4. Select **Continue**. 5. Search for a source type and select **Configure**. 6. Review the directions and select **Start Connector Setup**. 7. Review the pre-populated source name, source owner, and description. To update, select **Edit**. > **Note** > > Source name must be unique. 8. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 9. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** page. 10. Select **Finish**. A test connection is performed in the background. 11. If the test connection is successful, your source is created, and you are prompted to run a discovery. - If you want to discover applications now, select **Discover**. - **Additional Settings \> Discovery Settings** - The latest application discovery history is shown. - **Additional Settings \> Discovery Activity** - Discovered applications are listed. - If you want to discover applications later, select **Cancel**. As no discovery has taken place, in the source details: - **Additional Settings \> Discovery Settings** - The latest application discovery history is blank. - **Additional Settings \> Discovery Activity** - No discovered applications are listed. You are navigated to the **Sources** page, where the source created is listed. ## Base Configuration Provide the base configuration parameters. Information you entered in the Connector Setup dialog is automatically entered into the fields in the Base Configuration page. You can edit this information, if necessary. > [!NOTE] > > Ensure that the name and description of each connector is unique. 1. Enter a descriptive **Connector Name** for the connection. 2. Enter the **Description** that provides details necessary to distinguish it from similar connection sources. 3. In **Connector Owner**, enter the name of the owner responsible for administrating, operating and managing the source system. 4. Select **Save**. ## Connection Settings Provide the information required to connect to the Microsoft Entra SSO instance with OAuth 2.0 authentication: > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Select the **Grant Type** as Client Credentials. 2. In the **Client ID** field, enter the Microsoft Entra SSO API Client ID for OAuth2 authentication. 3. In the **Client Secret** field, enter the Microsoft Entra SSO API Client Secret. 4. In the **Domain Name** field, enter the name of the Microsoft Entra SSO domain to be managed. For example, `contoso.onmicrosoft.com`. > **Important** > > Ensure the domain name ends with `.onmicrosoft.com` or `.onmicrosoft.us`. Custom domain names are not supported. 5. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Discovering Applications with Microsoft Entra SSO Microsoft Entra Single Sign-On (MS Entra SSO) is a part of Microsoft Entra ID (formerly Azure Active Directory). It allows users to access multiple applications with one set of credentials, improving security and user experience. The SailPoint MS Entra SSO discovery connector provides comprehensive application discovery within Microsoft Entra ID. It facilitates the aggregation of application details, application users, and user activity. It's important to note that these discovery connectors are specifically for identifying and collecting information about applications, users, and their activities, and are managed separately from Identity Governance and Administration (IGA) sources. They are not intended for governance purposes. ## Supported Features The SailPoint MS Entra SSO connector supports the following features: - [Discovering Applications]() - Test Connection ## Prerequisites Before proceeding with the integration, ensure the following prerequisites are met: - A registered client application in the Azure portal. This application should be registered as a Web application or Web API to utilize the Microsoft Graph API. This registered application will call the Graph API on behalf of the connector. During configuration, you will need the Client ID and Client Secret generated for this application. For more information, refer to [Register an Application on Azure Portal](<#register-an-application-on-azure-portal>). - Base URL or domain of the application that is integrated with MS Entra SSO for authentication. For more information, refer to [Microsoft Graph Dev Center | APIs and app development](). > **Note** > > If you are using Base URL as `https://login.microsoftonline.com`, refer to [Configuring Azure Government Endpoints](<#configuring-azure-government-endpoints>) for more information. ### Register an Application on Azure Portal To register an application on Azure portal, perform the following: 1. Select either of these Azure management portals to do the configuration: - Microsoft Azure - Microsoft Entra admin center 2. Select **Microsoft Entra** in the left pane. 3. Select **App registrations**. 4. Select **New registration**. 5. On the **Register an application** page, in the **Name** field, enter the name of the application that you want to set up. For example, `SailPointAzureADManagement`. 6. In the Supported account types, set up accounts based on users that are able to use that application or the API. 7. (Optional) Set up the URL in **Redirect URL**, to have the successful response after authentication. You can use the following format: `http://domainName/GraphWebapp` > **Note** > > The URL provided is for placeholder purposes only. It is not utilized by the MS Entra SSO discovery connector and does not affect system behavior. 8. Select **Register**. An application is created. On the Application page the Application (client) ID, and other details are displayed. Note down this Application ID. 9. On the left-hand panel, select **Certificates & secrets**. On the Certificates & secrets page, in the **Client secrets** section, select **New Client Secret**. 10. On the **Add a client secret** page, enter the **Description** to generate a secret, choose the validity duration in the **Expires** list. Select **Add**. Save the secret value you just created. ### Grant Permissions to the Client Application To grant permissions to the client application in the Microsoft Entra console: 1. Select **API permissions** in the Microsoft Entra console. 2. Select **Add a permission**. 3. On the **Request API permissions** page, you will see a list of supported APIs. Select **Microsoft Graph API**. 4. Select **Application permissions** under **What type of permissions does your application require?** 5. Under **Select permissions**, choose permissions mentioned in the following permission table. Select **Add permissions**. 6. In Grant consent, select **Grant admin consent** for your configuration and directory. On the pop-up dialog box, select **Yes**. ### Configuring Azure Government Endpoints To meet security and compliance needs of federal agencies, state and local governments, Microsoft provides a separate instance of the Azure service. A few example of such instances are Azure Government, and Azure China. As these instances are separated from general Azure services, endpoint (host address) for such instances might also be different. With endpoint configuration functionality, the Microsoft Entra SSO discovery connector can be configured to communicate with these instances. The following attributes must be configured in the source XML using the REST APIs: > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. **`msGraphResourceBase`** Base resource URL to be used for Microsoft Graph API rest calls. The following example points the base to the default Microsoft Graph resource base: ```text POST https://{orgName}.api.identitynow.com/cc/api/source/update/{source ID} ``` In the body of the POST, use the form-data as follows: - Key: `msGraphResourceBase` - Value: `https://graph.microsoft.us` **`msGraphTokenBase`** Base token URL to be used to get access token for Microsoft Graph API rest calls. The following example points the base to the default Microsoft Graph token base: ```text POST https://{orgName}.api.identitynow.com/cc/api/source/update/{source ID} ``` In the body of the POST, use the form-data as follows: - Key: `msGraphTokenBase` - Value: `https://login.microsoftonline.us` > [!NOTE] > > The actual values of endpoints can be found in Microsoft documentation for the specific instance. For connector operation, the values for the above attributes must be provided. ## Required Permissions The following table lists the required granular-level application permissions: | Permission | Type | Purpose | | --- | --- | --- | | `User.Read.All` | Application | Test Connection | | `Application.Read.All` | Application | Aggregation of applications | > [!NOTE] > > Use Azure portal to assign administrative roles. For more information, refer to [Assign Microsoft Entra Roles to Users](). # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings]().