Skip to content

Integrating the Browser Extension with Microsoft Entra ID

The Agentic Fabric platform is deployed in Microsoft Entra ID as a multi-tenant application. Agentic Fabric uses Microsoft Entra ID API to authenticate end users and administrators logging into the Agentic Fabric platform and to gather information on applications integrated with Microsoft Entra ID and their permissions.

Once integrated with Microsoft Entra ID, Agentic Fabric can:

  • Allow the browser extension and Shadow AI Remediation administrators to authenticate against the IdP.

  • Read the list of SaaS applications that have been installed in your organization, and parse SSO logs to continuously detect SSO'ed accounts.

  • Support listing user accounts, user groups, application, and related user activity in Agentic Fabric.

  • Review the IdP configuration, such as MFA settings and last password rotation dates.

You will first create an application integration in Microsoft Entra ID to configure authentication, and then create a Privileged Role Administrator.

To establish trust with Microsoft Entra ID, an Azure Active Directory Administrator with the Privileged role administrator role is required.

To configure authentication:

  1. Go to Agentic Fabric > Onboarding > Deploy Sensor > Browser Extension.

  2. If you are an Azure Active Directory Administrator with an admin privileged role:

    • Within the Configure Identity Provider card, hover over the BROWSER SENSOR OAUTH URL and select Open link icon .

    • Select the checkbox to accept the permissions requested by Agentic Fabric. For a full list of requested permissions, refer to Requested Permissions.

    • A confirmation page is displayed confirming trust has been successfully established.

  3. If you are not an Azure Active Directory Administrator with an admin privileged role:

    • Select Copy link icon .

    • Ask your Microsoft Entra ID administrator with an admin privileged role to click on the copied link and establish trust.

  4. Once trust is established, select Connect.

  5. Select Test Connection to test the connection.

Requested Permissions

The following table shows the permissions required by Agentic Fabric applications from Microsoft Entra ID.

Microsoft Permission Name Description
Directory.Read.All Read directory data
User.Read.All Read all users' full profiles
Application.Read.All Read all applications
AuditLog.Read.All Read all audit logs
Policy.Read.All Read all organizational policies (e.g., Conditional Access, authentication, token policies)
UserAuthenticationMethod.Read.All Read all users' registered authentication methods (e.g., phone, FIDO2, Authenticator app)
email openid profile User.Read Log in (OpenID Connect 2.0) and read user's profile

Creating a Privileged Role Administrator in Azure Active Directory

  1. Log in to Azure Portal at https://portal.azure.com/.

  2. Under Azure Services, select Azure Active Directory.

  3. Select Users and select the user that will be used for the Agentic Fabric authorization.

  4. From the left panel, select Assigned roles.

  5. Select Add assignment and select the checkbox besides Privileged role administrator.

The role is now assigned to the user. To verify, check that the Resource Name is set to Directory and the Assignment Path is set to Direct.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.