# Prerequisites and Permissions

## Prerequisites

### Azure Management

> [!WARNING]
>
> To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts.

- Ensure that a client application has been registered on your Azure Management portal as a web application or web API, and you have access to the Client ID and Client Secret for this application.
- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Use certificate based authentication in Exchange Online as basic authentication is deprecated by Microsoft. For more information, refer to [Certificate Based Authentication](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/microsoft_365.html#exchange-online-management>) in Exchange Online Management.
- You must install IQService to use this feature. For more information, refer to [IQService](<https://documentation.sailpoint.com/connectors/iqservice/help/index.html>).

  > **Important**
  >
  > IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/iqservice/configuring_tls_and_client_authentication_for_iqservice.html#configuring-tls-and-client-authentication-for-iqservice>).
- For cloud management prerequisites and requirements, refer to [Group Management for Azure Cloud Objects](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management>).
- To use Graph API, a client application must be registered on the Azure management portal. This application is responsible for calling Web APIs on behalf of the connector. The application's client ID and client secret key are required while configuring the application.

  To register an application on Azure, perform the following:

  1. Use either of these Azure management portals to do the configuration: [https://portal.azure.com](<https://portal.azure.com>) Or [https://aad.portal.azure.com](<https://aad.portal.azure.com>)
  2. Select **Microsoft Entra ID** in the left pane.
  3. Select **App registrations**.
  4. Select **New registration**.
  5. On the **Register an application** page, in the **Name** field, enter the name of the application that you want to set up. For example, SailPointAzureADManagement.
  6. In the Supported account types, set up accounts based on users that are able to use that application or the API.
  7. (*Optional*) Set up the URL in Redirect URL, to have the successful response after authentication. You can use the following format: **http://*domainName*/GraphWebapp**

     > **Note**
     >
     > The Microsoft Entra ID connector does not use the URL mentioned above, the above example is just a placeholder and does not impact functionality.
  8. Select **Register**. An application is created. On the Application page the **Application (client) ID**, and other details are displayed. Note down this ID.
  9. On the left-hand panel, select **Certificates &amp; secrets**. On the Certificates &amp; secrets page, in the **Client secrets** section, select **New client secret**.
  10. On the **Add a client secret** page, enter the **Description** to generate a secret, choose the validity duration in the **Expires** list. Select **Add**. Note down the value of the secret that you have just created.

### Microsoft Entra

The required host values (`https://<host>/`) by the Microsoft Entra ID connector to interact with the managed system are as follows:

- [https://graph.microsoft.com](<https://graph.microsoft.com>)
- [https://management.azure.com](<https://management.azure.com>)
- [https://login.microsoftonline.com](<https://login.microsoftonline.com>)

  > **Note**
  >
  > If you are using this option, refer to the [Azure Government Endpoint Configuration](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-government-endpoint-configuration>) topic for configuration details.

### Creating OAuth 2.0 JWT Certificate Credentials

> [!NOTE]
>
> SailPoint recommends JWT certificate credentials for OAuth 2.0 authentication.

Use the following steps to create JWT certificate credentials for OAuth 2.0 authentication. For more information, refer to [OAuth 2.0 Authentication](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/security.html#oauth-20-authentication>).

#### Registering an Application and Assigning API Permissions

1. Register an application in Azure portal. For more information, refer to [register an application](<https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app>) in the Microsoft documentation.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.
2. After you register the app, copy the Application (client) ID, and then generate a client secret.
3. Assign API permissions to the application. For the permissions this connector requires, refer to [Required Permissions](<#required-permissions>). For more information about assigning permissions, refer to [API permissions](<https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis>) in the Microsoft documentation.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.

If you have already registered the application and assigned API permissions, continue with [Creating and Using the Certificate](<#creating-oauth-20-jwt-certificate-credentials>).

#### Creating and Using the Certificate

1. Run PowerShell as an administrator on a Windows computer, and then generate a self-signed certificate with the following command:

   `New-SelfSignedCertificate -DnsName "EntraID" -CertStoreLocation "cert:\LocalMachine\My"`
2. Go to **certlm.msc \> Personal \> Certificates**, right-click the certificate, and select **Export**. Complete the Certificate Export Wizard and export the certificate in PFX format.
3. Select **Include all certificates in the certification path if possible** and Enable certificate privacy.
4. Enter a password to protect the private key, and use AES-256-SHA256 encryption. You need this password when you use the PFX file.
5. Save the PFX file to a directory of your choice. Download [OpenSSL](<https://sourceforge.net/projects/openssl/>), or use Git Bash.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.

   Copy the PFX file into the directory where the command prompt or terminal is open as an administrator. Run the following commands one at a time, and press Enter after each command. The file names are examples. You can use other file names if you use the same names in each command.

   1. `openssl pkcs12 -in test1.pfx -nocerts -out sp.key`
   2. `openssl pkcs12 -in test1.pfx -clcerts -nokeys -out sp.crt`
   3. `openssl rsa -in sp.key -out rsasp.key -traditional`

      > **Note**
      >
      > The -traditional parameter is not always required. Whether you need it depends on the OpenSSL version.
6. Upload the `sp.crt` file to the Microsoft Entra app registration:

   1. Sign in to the Azure portal.
   2. In App registrations, select the client application.
   3. Select **Certificates &amp; secrets**.
   4. Select **Upload certificate**, select the certificate file, and then select **Add**.
7. On the Connection Settings page, enter the text of `rsasp.key` in Private Key and the text of `sp.crt` in Certificate. For more information, refer to [Connection Settings](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/connecting.html#connection-settings>).

   Private Key Password is the passphrase you entered when you created `sp.key`.

## Required Permissions

> [!IMPORTANT]
>
> If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,[Azure Cloud Object Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/azure_governance.html#azure-cloud-object-management>), such as, Management Groups, Subscriptions, Resource Groups and Role Assignment or [Service Principal Accounts Management](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/workload_identities.html#service-principal-account-management>)), you must have SailPoint CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.
>
> To display cloud resource data through SailPoint CIEM, you must also configure the SailPoint CIEM Azure source. For more information, refer to [Connecting Azure and CIEM](<https://documentation.sailpoint.com/saas/help/ciem/azure/connect_azure.html>).

> [!NOTE]
>
> This list of permissions includes the most commonly used features from the connector, however there may be custom permissions and roles required for certain specific features. Ensure to read the details for each feature in the [Supported Features](<https://documentation.sailpoint.com/connectors/microsoft/entra_id/va/help/supported_features/index.html#supported-features>) section.

If you don’t want to provide granular permissions on each API, provide the following permissions on the entire directory to the client application created in Azure, which will enable the connector to perform read and write operations on users and groups (excluding deleting users and groups) :

- Directory.Read.All (Read Directory Data)
- Directory.ReadWrite.All (Read and Write Directory Data)

> [!IMPORTANT]
>
> To grant read-only access, assign the built-in Reader role to the service principal or the application you created at the tenant root group level.

### Assigning the Built-in Reader Role to the Application

To grant the built-in reader role to the application, follow these steps in the Microsoft Entra ID portal:

1. Go to **Management groups**.
2. Select the **Tenant Root Group** and open its **Access control (IAM)** settings.
3. Select **Add**, then choose **Add role assignment** from the dropdown menu.
4. Select the **Reader**(built-in) role from the list.
5. Go to the **Members** tab and select **Select members**.
6. Search for the application you created earlier and select it.
7. Select the **Review and assign** to finalize the role assignment.

### Assigning Necessary Permissions to the Client Application

To grant the necessary permissions to the client application, follow these steps:

1. In the Microsoft Entra console, go to **API permissions** and select **Add a permission**.
2. On the **Request API permissions** page, select **Microsoft Graph API** from the list of APIs.
3. For the permission type, select **Application permissions**.
4. Under **Select permissions**, choose the permissions listed in the table below, and then select **Add permissions**.
5. Go to the **Grant consent** section and select **Grant admin consent** for your directory.
6. When the confirmation dialog appears, select **Yes**.

### Granular Level Application Permission

- To perform Set Password and Delete user operations, an application created on Azure must have the User Administrator role.
- To manage users with administrative roles or users who are members/owners of role-assignable groups, an application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role.
- Use the Azure portal to assign the previously mentioned administrative roles. For more information, refer to [Assign Microsoft Entra Roles to Users](<https://learn.microsoft.com/en-us/azure/active-directory/roles/manage-roles-portal>).

### Additional API Permissions for CIEM

The following API permissions are necessary for SailPoint CIEM to include potential Azure cloud resource access derived from eligible membership in PIM groups:

- PrivilegedAccess.Read.AzureADGroup
- PrivilegedAssignmentSchedule.Read.AzureADGroup
- PrivilegedEligibilitySchedule.Read.AzureADGroup

The following table lists the required permission types and their purposes:

<table class="span-table"> <tr> <td>Permission</td> <td>Type</td> <td>Purpose</td> </tr> <tr> <td>User.Invite.All</td> <td colspan="1" rowspan="12">Application</td> <td>Creating / Inviting B2B User</td> </tr> <tr> <td>User.Read.All</td> <td>Account Aggregation, Account Delta, Get Object, Roles and Groups Membership Aggregation</td> </tr> <tr> <td>User.ReadWrite.All</td> <td>Create User, Update User Properties (Non Entitlement), Add / Remove License Pack and Plan, Enable/ Disable User Account, Delete User</td> </tr> <tr> <td>Organization.Read.All</td> <td>Aggregate License Pack and Plan Details of tenant</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Add / Remove Directory Roles</td> </tr> <tr> <td>User.Read</td> <td>Pass-through Authentication</td> </tr> <tr> <td>Group.Read.All</td> <td>Group Aggregation</td> </tr> <tr> <td>Group.ReadWrite.All</td> <td>Create Group, Update Group, Delete Group</td> </tr> <tr> <td>Application.Read.All</td> <td>Service Principal Aggregation</td> </tr> <tr> <td>AppRoleAssignment.ReadWrite.All</td> <td>Add / Remove users from Service Principal</td> </tr> <tr> <td>RoleManagement.ReadWrite.Directory</td> <td>Role provisioning (if defined as Entitlement object)</td> </tr> <tr> <td>RoleManagement.Read.Directory</td> <td>Role Aggregation (if defined as Entitlement object)</td> </tr> </table>

The following permission applies to SAML Bearer Assertion, Refresh Token / AuthCode, and JWT Certificate Credentials grant types:

| Permission | Type | Purpose |
| --- | --- | --- |
| Directory.AccessAsUser.All | Delegated | Change Password, Delete User |

The following permissions apply to Access Packages management:

| Permission | Type | Purpose |
| --- | --- | --- |
| EntitlementManagement.ReadWrite.All | Application | Add / Remove Access Packages |
| EntitlementManagement.Read.All | Application | Access Package Aggregation |

The following permissions apply to Multi-Factor Authentication management:

| Permission | Type | Purpose |
| --- | --- | --- |
| UserAuthenticationMethod.Read.All | Application | MFA Related User Information Aggregation |
| UserAuthenticationMethod.ReadWrite.All | Application | Add / Update / Remove MFA Related User Information |

The following permissions apply to User management:

| Permission | Type | Purpose |
| --- | --- | --- |
| User.EnableDisableAccount.All | Application | Delete User |
| User-PasswordProfile.ReadWrite.All | Application | Set Password |