Security, Authentication, and Compliance

Multi-Factor Authentication (MFA) Management

Microsoft Entra Multi-Factor Authentication (MFA) adds additional security over only using a password when a user signs in. The user can be prompted for additional forms of authentication, such as to respond to a push notification, enter a code from a software or hardware token, or respond to an SMS or phone call.

The Microsoft Entra ID connector supports the MFA Attribute Management, which can help you manage MFA related information required for authentication, such as mobile numbers, alternate mobile numbers, office phone numbers, email addresses, and the Microsoft authenticator app.

The following operations are supported for Multi-Factor Authentication Management:

• Aggregate MFA related information for the user (applicable for all authentication methods).
• For the Phone and Email authentication methods you can add, update, and remove MFA related information.
• For other authentication methods (for example, Microsoft Authenticator or Fido2) you can remove MFA related information.

Administrator Permissions

Supported Schema Attributes

To aggregate MFA related information for the user during account aggregation, ensure that the MFA attributes are present in the account schema. For more information, refer to Multi-Factor Authentication (MFA) Attributes.

OAuth 2.0 Authentication

The Microsoft Entra ID connector supports OAuth2.0 authentication with the following grant types:

• Client Credentials
• SAML Bearer Assertion
• Refresh Token/Auth Code
• JWT Certificate Credentials

Client Credentials

The default grant type is client credentials-based authentication. This grant type requires the following:

• Obtain your Client ID and Client Secret from Microsoft Entra ID by registering the application.

• Assign the required Microsoft Graph API permission to the application. For more information, refer to Microsoft Graph API.

• The following permissions do not allow the connector to manage users with administrative roles. To manage users with administrative roles, the application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell.

• Assign the required permissions to the application:

  Permission	Type	Purpose
  Directory.ReadWrite.All	Application	Read, Update, Delete Group, and Add Membership Read, Update, Change Password, and Delete User
  User.Invite.All	Application	Invite B2B Users

SAML Bearer Assertion

The SAML Bearer Assertion grant type authentication involves password-based user authentication with ADFS environment. SAML assertion issued by ADFS after authentication is used to obtain the access token from Microsoft Entra ID.

The SAML Bearer Assertion authentication requires the following additional configurations to be performed:

• Microsoft Entra Connect configured with Microsoft Entra ID along with ADFS.

• Obtain your Client ID and Client Secret from Microsoft Entra ID by registering the application.

• Assign required permissions to the application: PermissionTypePurposeDirectory.ReadWrite.AllDelegatedRead, Update, Delete Group, and Add MembershipRead User and Update UserUser.Invite.AllDelegatedInvite B2B UsersDirectory.AccessAsUser.AllDelegatedChange Password and Delete User

  Note

  Assign granular level application permission for each operation if you do not want to assign full directory level permission. For more information, refer to Required Permissions.

• The authentication user must be synchronized in Microsoft Entra ID.

• To manage users with administrative roles, an application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell.

  Note

  To manage users with administrative roles, assign user with Global Administrator role.

• The ADFS endpoint required to authenticate user must be enabled.

• The ADFS service communication certificate must be installed on the SailPoint machine.

• The ADFS machine time zone must be in sync with Azure time zone, that is, UTC.

Refresh Token/Auth Code or JWT Certificate Credentials

• Refresh Token/Auth Code: Refresh Token/Auth Code grant type is a client credentials-based authentication protocol. In addition to client credentials, it uses a Refresh Token to perform authentication.
• JWT Certificate Credentials: JWT Certificate Credentials supports Authentication based on JWT assertion prepared from Certificate and private key.

For the Refresh Token/Auth Code or JWT Certificate Credentials grant type client credentials-based authentication, the following are the required configurations:

• Obtain your Client ID and Client Secret from Microsoft Entra by registering the application.

• Assign the required Microsoft Graph API permission to application. For more information, refer to Microsoft Graph API.

• The following permissions do not allow the connector to manage users with administrative roles. To manage users with administrative roles, the application created on Azure must have the User Administrator or Global Administrator role and the Privileged Authentication Administrator role assigned using Windows Azure Active Directory Module for Windows PowerShell.

  Permission	Type	Purpose
  Directory.ReadWrite.All	Delegated	Read, Update, Delete Group, and Add Membership Read User and Update User
  User.Invite.All	Delegated	Invite B2B Users
  Directory.AccessAsUser.All	Delegated	Change Password, and Delete User

  Note

  Assign granular level application permission for each operation if you do not want to assign full directory level permission.

• (For Refresh Token/Auth Code only) Generate a Refresh Token. For more information, refer to Generating Refresh Token.

• (For JWT Certificate Credentials only) The Certificate (self-signed or CA signed) must be uploaded. It must be of type X.509 Certificate and the Private Key must be encrypted with RSA and registered at the Microsoft Entra portal. Perform the following steps to register the certificate with the Microsoft identity platform:

  For the full procedure, including the OpenSSL commands, refer to Creating OAuth 2.0 JWT Certificate Credentials.

  1. Log in to Microsoft Entra Portal.

  2. In the Entra app registrations for client application, select the client application.

  3. Select Certificates & secrets.

  4. Select the Upload certificate and select the certificate file that is to be uploaded.

  5. Select Add.

  6. Obtain values for the following configurations:

     • Private Key: Obtain the private key text file.
     • Private Key Password
     • Certificate: Obtain the text file of the same certificate which was uploaded on the Microsoft Entra portal.

Continuous Access Evaluation

Continuous access evaluation enables the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).

When this feature is enabled on this connector, any long running operations, such as account aggregation, fail if a Continuous Access Evaluation (CAE) event (for example, a service principal disable or delete event) is triggered for the configured service principal during that operation.

To configure this feature:

1. Go to Connection Settings.
2. Select the Use Continuous Access Evaluation checkbox.
3. Select Save.

Risky User Alert Feature

With the security reports in Microsoft Entra, you can gauge the probability of compromised user accounts in your environment. A user flagged for risk is an indicator for a user account that might have been compromised. The risky user represents the probability that a given identity or account is compromised. These risks are calculated offline using Microsoft's internal and external threat intelligence sources including security researchers, law enforcement professionals, security teams at Microsoft, and other trusted sources.

This feature supports the following operations:

• Account Aggregation
• Get Object

Prerequisite

The tenant must have a Microsoft Entra P2 license.

Administrator Permissions

To fetch risky user details using MS Graph APIs, the following API permissions must be assigned:

Supported Schema Attributes

To manage the risky user alert feature, ensure that the Risky User Alert Supported Attributes are present in the account schema.

Custom Security Attributes

Custom security attributes in Microsoft Entra ID are business-specific attributes (key-value pairs) that you can define and assign to Microsoft Entra objects. These attributes can be used to store information, categorize objects, or enforce fine-grained access control over specific Azure resources.

In addition to the schema attributes listed in Schema Attributes section, the connector supports managing the custom security attributes that are defined in Azure. Creation of local user (B2C) also supports custom attributes.

Supported Operations

• Aggregation of assigned custom security attributes for MS Entra ID users.
• Assign, update, delete, and remove custom security attributes for MS Entra ID users.

Required Permissions

Assign below permissions to the Microsoft Entra ID source to manage custom security attributes:

Use the following format for single-valued and multivalued type string custom attributes:

customSecurityAttributes_<Attribute set name>_<Attribute name>

For instance, if you have multiple attribute sets with attributes defined as follows:

Attribute 1:

Attribute set = Engineering

Attribute = Project

Attribute data type = Collection of Strings

Attribute value = ["Baker","Cascade"]

Attribute 2:

Attribute set = Engineering

Attribute = ProjectDate

Attribute data type = String

Attribute value = "2022-10-01"

Attribute 3:

Attribute set = Marketing

Attribute = EmployeeId

Attribute data type = String

Attribute value = "QN26904"

Then, the Account Schema for the above attributes should define them in the following way:

For Attribute 1:

customSecurityAttributes_Engineering_Project (DataType – String, isMulti - True)

For Attribute 2:

customSecurityAttributes_Engineering_ProjectDate (Data Type – String)

For Attribute 3:

customSecurityAttributes_Marketing_EmployeeId (Data Type – String)

To manage the assignments (such as assigning, updating, and removing custom security attributes for MS Entra ID Users) in addition to adding attributes in Account Schema, you need to also add the attributes in a similar format to Create Account within the SailPoint user interface.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.