Skip to content

Automated PowerShell Onboarding

The Automated PowerShell Onboarding method enables a fast, secure, and fully automated setup of the SailPoint Entro Azure Integration. This script configures all required Azure components, roles, and permissions directly within your environment - no credentials are transmitted externally.

143KB
SailPoint Entro-Azure-Onboarding.ps1
powershell
Download Open

Overview

The onboarding script (Entro-Azure-Onboarding.ps1) automates the connection process by:

  • Creating a dedicated App Registration for SailPoint Entro and applying Microsoft Graph API permissions for discovery and monitoring (see detailed list below)

  • Generating the Client ID, Tenant ID, and Client Secret used in SailPoint Entro

  • Assigning the required SailPoint Entro Custom Role (EntroSecurityRole) across selected subscriptions and/or management groups

  • Assigning the built-in Key Vault Reader and Application Configuration Data Reader roles to the Entro App Registration across selected subscriptions and/or management groups

  • Creating a Log Analytics Workspace to store NHI, service account, and key vault activity logs for activity analysis

  • Configure Sign-in Logs to be sent to SailPoint Entro Log Analytics Workspace for service principals and service accounts

  • Configure Key Vault Access Policies for Entro App Registration to inventory selected Key Vaults

  • Configure Key Vault Diagnostic Logging to be sent to SailPoint Entro Log Analytics Workspace for selected Key Vaults

All operations occur locally through MS Graph and Azure APIs.

Management → Accounts & Integrations → Add New Account (top right) → Microsoft Ecosystem

Prerequisites

Ensure the following before running the script:

  • PowerShell 7.x or later

  • MS Graph and AzureAD modules installed

Install modules

Install-Module Microsoft.Graph -Scope CurrentUser
Install-Module Az.Accounts -Scope CurrentUser
Install-Module Az.Resources -Scope CurrentUser
Install-Module Az.OperationalInsights -Scope CurrentUser
Install-Module Az.Monitor -Scope CurrentUser
Install-Module Az.KeyVault -Scope CurrentUser

  • Azure Entra ID role: Global Administrator or Application Administrator

  • Network access to:

    • https://api.entro.security

    • https://graph.microsoft.com

    • https://management.azure.com

  • Permission to create App Registrations and custom roles

  • Access to at least one active Azure subscription

Running the Script

  1. Prepare PowerShell

    Open PowerShell as Administrator on local machine and navigate to the directory containing Entro-Azure-Onboarding.ps1.

    Or

    In the Azure Portal (portal.azure.com), open the Azure Cloud Shell. Once Cloud Shell has loaded, click Manage files then Upload in the Cloud Shell menu to upload the Entro-Azure-Onboarding.ps1 script to the Shell.

  2. Execute the Script

    Run:

    .\Entro-Azure-Onboarding.ps1

  3. Follow Menu Sequence

    During execution, you will:

    • Authenticate to MS Graph and Azure (interactive or device login)

    • Follow menu steps 1 - 7 to complete all necessary steps to fully onboard SailPoint Entro into Azure

Expected Output

On completion, the script displays:

  • Azure Client ID

  • Azure Tenant ID

  • Azure Client Secret

Copy these values - they are required in the SailPoint Entro onboarding form.

Connecting to SailPoint Entro

  1. Return to the SailPoint Entro Dashboard.

  2. Navigate to Management → Accounts & Integrations → Add New Account → Microsoft Ecosystem.

  3. Paste the following values:

    • Azure Client ID

    • Azure Tenant ID

    • Azure Client Secret

  4. Click Create Account.

    - Status: **Verified** upon successful validation.

Security & Compliance

  • Script actions are limited to read-only and configuration changes through Azure APIs.
  • No credentials or data are sent to SailPoint Entro during script execution.
  • Credentials are stored encrypted (AES-256) in SailPoint Entro's vault.