# Security, Authentication, and Compliance ## Multi-Factor Authentication (MFA) Management Microsoft Entra Multi-Factor Authentication (MFA) adds additional security over only using a password when a user signs in. The user can be prompted for additional forms of authentication, such as to respond to a push notification, enter a code from a software or hardware token, or respond to an SMS or phone call. The Microsoft Entra ID SaaS connector supports the MFA Attribute Management, which can help you manage MFA related information required for authentication, such as mobile numbers, alternate mobile numbers, office phone numbers, email addresses, and the Microsoft authenticator app. The following operations are supported for Multi-Factor Authentication Management: - Aggregate MFA related information for the user (applicable for all authentication methods). - For the Phone and Email authentication methods you can add, update, and remove MFA related information. - For other authentication methods (for example, Microsoft Authenticator or Fido2) you can remove MFA related information. ### Administrator Permissions | Purpose | Permission Type | Permissions | | --- | --- | --- | | Aggregate MFA Related Information for the User | Application | UserAuthenticationMethod.Read.All | | Add, Update, and Remove MFA Related Information for the User | Application | UserAuthenticationMethod.ReadWrite.All | ### Supported Schema Attributes To aggregate MFA related information for the user during account aggregation, ensure that the MFA attributes are present in the account schema. For more information, refer to [Multi-Factor Authentication (MFA) Attributes](). > [!NOTE] > > When retrieving MFA information, the API is called concurrently per user, which may trigger "429 Too Many Requests" errors. To prevent this, add the following entry to your source XML to restrict multi-threading: > > `` ## OAuth 2.0 Authentication The Microsoft Entra ID SaaS connector supports OAuth2.0 authentication with the following grant types: - Client Credentials - Refresh Token/Auth Code - JWT Certificate Credentials ### Client Credentials The default grant type is client credentials-based authentication. This grant type requires the following: - Obtain your Client ID and Client Secret from Microsoft Entra by registering the application. - Assign the required Microsoft Graph API permission to the application. For more information, refer to Microsoft Graph API. - The following permissions do not allow the connector to manage users with administrative roles. To manage users with administrative roles, the application created on Microsoft Entra must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell. - Assign the required permissions to the application: | Permission | Type | Purpose | | --- | --- | --- | | Directory.ReadWrite.All | Application | Read, Update, Delete Group, and Add Membership
Read, Update, Change Password, and Delete User | | User.Invite.All | Application | Invite B2B Users | ### Refresh Token/Auth Code or JWT Certificate Credentials - **Refresh Token/Auth Code**: Refresh Token/Auth Code grant type is a client credentials-based authentication protocol. In addition to client credentials, it uses a Refresh Token to perform authentication. - **JWT Certificate Credentials**: JWT Certificate Credentials supports Authentication based on JWT assertion prepared from Certificate and private key. For the Refresh Token/Auth Code or JWT Certificate Credentials grant type client credentials-based authentication, the following are the required configurations: - Obtain your Client ID and Client Secret from Microsoft Entra by registering the application. - Assign the required Microsoft Graph API permission to application. For more information, refer to Microsoft Graph API. - The following permissions do not allow the connector to manage users with administrative roles. To manage users with administrative roles, the application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell. | Permission | Type | Purpose | | --- | --- | --- | | Directory.ReadWrite.All | Delegated | Read, Update, Delete Group, and Add Membership
Read User and Update User | | User.Invite.All | Delegated | Invite B2B Users | | Directory.AccessAsUser.All | Delegated | Change Password, and Delete User | > **Note** > > Assign granular level application permission for each operation if you do not want to assign full directory level permission. - (*For Refresh Token/Auth Code only*) Generate a Refresh Token. For more information, refer to Generating Refresh Token. - (*For JWT Certificate Credentials only*) The Certificate (self-signed or CA signed) must be uploaded. It must be of type X.509 Certificate and the Private Key must be encrypted with RSA and registered at the Microsoft Entra portal. Perform the following steps to register the certificate with the Microsoft identity platform: For the full procedure, including the OpenSSL commands, refer to [Creating OAuth 2.0 JWT Certificate Credentials](). 1. Log in to Microsoft Entra Portal. 2. In the Entra app registrations for client application, select the client application. 3. Select **Certificates & secrets**. 4. Select the **Upload certificate** and select the certificate file that is to be uploaded. 5. Select **Add**. 6. Obtain values for the following configurations: - **Private Key**: Obtain the private key text file. - **Private Key Password** - **Certificate**: Obtain the text file of the same certificate which was uploaded on the Microsoft Entra portal. ## Continuous Access Evaluation Continuous access evaluation enables the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal). When this feature is enabled on this connector, any long running operations, such as account aggregation, fail if a Continuous Access Evaluation (CAE) event (for example, a service principal disable or delete event) is triggered for the configured service principal during that operation. To configure this feature: 1. Go to **Connection Settings**. 2. Select the **Use Continuous Access Evaluation** checkbox. 3. Select **Save**. ## Risky User Alert Feature With the security reports in Microsoft Entra, you can gauge the probability of compromised user accounts in your environment. A user flagged for risk is an indicator for a user account that might have been compromised. The risky user represents the probability that a given identity or account is compromised. These risks are calculated offline using Microsoft's internal and external threat intelligence sources including security researchers, law enforcement professionals, security teams at Microsoft, and other trusted sources. This feature supports the following operations: - Account Aggregation - Get Object > [!NOTE] > > By default, this feature is not enabled for new connectors. If your Microsoft Entra instance requires support of the Risky User Alert feature, you must enable the feature by adding attributes to the account schema. ### Prerequisite The tenant must have a Microsoft Entra P2 license. ### Administrator Permissions To fetch risky user details using MS Graph APIs, the following API permissions must be assigned: | OAuth2.0 Authentication | Type | Permission | Purpose | | --- | --- | --- | --- | | Client Credentials | Application | IdentityRiskEvent.Read.All
IdentityRiskyUser.Read.All | Aggregate or Get Risky user related information | | Refresh Token / AuthCode
JWT Certificate Credentials | Delegated | IdentityRiskEvent.Read.All
IdentityRiskyUser.Read.All | Aggregate or Get Risky user related information | ### Supported Schema Attributes To manage the risky user alert feature, ensure that the following attributes are present in the account schema > [!NOTE] > > The Account schema cannot be extended for other risk related attributes. #### Risky User Alert Supported Attributes | Attribute Name | Description | | --- | --- | | riskLevel | Level of the detected risky user. | | riskState | State of the user's risk. | | riskDetail | Details of the detected risk. | | riskLastUpdatedDateTime | The date and time that the risky user was last updated. | ## Activity Insights Activity Insights supports activity from Microsoft Entra ID SaaS and its associated accounts. This allows you to gather account information and activity data from Microsoft Entra ID. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). ### Prerequisites You must have an Microsoft Entra P1/P2 license to use this feature. ### Required Permissions To apply specific permissions correctly, you must select the appropriate grant types. - For Application Permissions Select the Client Credentials and JWT Certificate Credentials grant types. - For Delegated Permissions Select the Refresh Token grant type. > **Note** > > These scopes must be granted as delegated and require administrator consent. Refer to the following table for a complete list of the required permissions that must be assigned to the administrator.
Permission Type Purpose
User.Read.All Application/ Delegated /users
Allows the app to read all users' full profiles in Microsoft Entra ID, including display name, email, UPN, and assigned licenses
LicenseAssignment.Read.All (or Organization.Read.All / Directory.Read.All) /subscribedSkus
Allows the app to read all license assignment information including subscribed SKUs and service plan details
AuditLog.Read.All /auditLogs/signIns
Allows the app to read all audit log data, including sign-in logs for interactive, non-interactive, service principal, and managed identity sign-ins
Application.Read.All /servicePrincipals
Allows the app to read all application registrations and service principals, including their role assignments and group memberships
### Configure Activity Insights To configure Activity Insights, refer to [Activity Insights Settings](). ## Custom Security Attributes Custom security attributes in Microsoft Entra ID are business-specific attributes (key-value pairs) that you can define and assign to Microsoft Entra objects. These attributes can be used to store information, categorize objects, or enforce fine-grained access control over specific Azure resources. For more information, refer to [Custom security attributes in Microsoft Entra](). In addition to the schema attributes listed in Schema Attributes section, the connector supports managing the custom security attributes that are defined in Azure. Creation of local user (B2C) also supports custom attributes. ### Supported Operations - Aggregation of assigned custom security attributes for MS Entra ID users. - Aggregation of assigned custom security attributes for Service Principals. - Aggregation of assigned custom security attributes for User-Assigned Managed Identities. - Aggregation of assigned custom security attributes for System-Assigned Managed Identities. - Assign, update, remove, and delete custom security attributes for MS Entra ID users. - Assign, update, remove, and delete custom security attributes for MS Entra Service Principals and Managed Identities. > [!NOTE] > > The connector only aggregate (read-only) Custom Security Attribute values for service principals or managed identities. Provisioning is supported only for MS Entra ID users and MS Entra Service Principals. ### Required Permissions Assign below permissions to the Microsoft Entra ID source to manage custom security attributes: | Purpose | Permissions | | --- | --- | | To aggregate assigned custom security attributes | Attribute Assignment Reader | | To assign, update, delete, and remove custom security attributes | Attribute Assignment Administrator | ### Adding Custom Security Attributes To aggregate custom security attributes, you must update the Account Schema with the custom attribute names. Ensure the custom security attribute name matches the Attribute set and Attribute name defined on the Microsoft Entra ID system. Refer to the following table to define the attributes in the Account Schema: | Attribute Type | Example | Custom Attribute Format | | --- | --- | --- | | Single-valued and Multivalued | \- | `customSecurityAttributes__` | | Multiple Attribute Sets | Attribute 1:
Attribute set = Engineering
Attribute = Project
Attribute data type = Collection of Strings
Attribute value = \["Baker","Cascade"\] | `customSecurityAttributes_Engineering_Project (Data Type – String, isMulti - True)` | | Multiple Attribute Sets | Attribute 2:
Attribute set = Engineering
Attribute = ProjectDate
Attribute data type = String
Attribute value = "2022-10-01" | `customSecurityAttributes_Engineering_ProjectDate (Data Type – String)` | | Multiple Attribute Sets | Attribute 3:
Attribute set = Marketing
Attribute = EmployeeId
Attribute data type = String
Attribute value = "QN26904" | `customSecurityAttributes_Marketing_EmployeeId (Data Type – String)` | ### Managing Custom Security Attributes To manage the assignments (such as assigning, updating, and removing custom security attributes for MS Entra ID Users) in addition to adding attributes in Account Schema, you need to also add the attributes in a similar format to Create Account section within the SailPoint user interface. The following table lists the appropriate options to manage identities. To manage identities, go to **Feature Management \> Managed Identities Settings**. From there, enable the appropriate option. | Identity Type | Setting to Enable | | --- | --- | | User-Assigned Managed Identities | Manage User-Assigned Managed Identities as Accounts | | System-Assigned Managed Identities | Manage System-Assigned Managed Identities as Accounts | | Microsoft Entra Service Principals | Manage Microsoft Entra Service Principals as Accounts | > [!NOTE] > > Ensure to select the **Aggregate Custom Security Attributes** checkbox to aggregate custom attributes for these identities, when required.