Connect a Microsoft Entra ID Tenant

Connect a Microsoft Entra (formerly Azure Active Directory) tenant to Tenable One AI Exposure to enable identity-related visibility and analysis. This connection provides insight into identities, permissions, and access relationships across your Microsoft cloud environment.

Connect Microsoft Entra ID to enable identity visibility, identity posture management, and entitlement management

The Microsoft Entra ID connection enables visibility into the following assets:

  • Users and groups
  • Applications and application registrations
  • Administrative roles
  • Role assignments and access relationships
Note: Connecting Microsoft Entra ID does not grant AI Exposure access to Azure subscriptions or resources. Azure subscriptions and organizations are connected separately. This section does not relate to integrating an identity provider for AI Exposure Console login via SSO. To configure SSO for Console access, see Single Sign-On. This connection is required for CIEM, but is recommended for all license types to maximize your security posture.

Connect a Microsoft Entra ID Tenant

Note: For the public cloud, the deployment script creates a service principal that allows Tenable's multi-tenant app to pull data from Graph API. The China cloud requires manual app registration to pull the data.
FedRAMP: If you use Tenable One AI Exposure in a FedRAMP environment, make sure to connect integrations only to FedRAMP authorized services and endpoints. You are responsible for confirming that each service you connect meets your FedRAMP requirements. Sending data to a service outside your authorization boundary can put your organization out of compliance with FedRAMP requirements.

To connect a Microsoft Entra ID tenant:

  1. In the AI Exposure Console, navigate to Settings > Integrations and click + Add Integration.
  2. Select Microsoft Entra ID.
  3. Enter a Name for the integration.
  4. Enter the Microsoft Entra ID Tenant ID.
  5. Select the Azure Cloud Environment:
    • Public — Use this for tenants hosted in the global Microsoft Entra ID cloud. The deployment script creates a service principal that allows Tenable's multi-tenant app to pull data from Graph API. If selected:

      1. Click Verify Tenant Access. You will be redirected to sign in to your Microsoft Entra ID tenant to verify access.

        Note: You must be either a member of the tenant organization.
      2. When finished, return to this wizard and complete the steps.
    • China — Use this for tenants hosted in the Azure China cloud environment. This requires manually registering an application. The deployment script creates a service principal that allows the app to pull data from Graph API. If selected:
      1. Create a dedicated app registration.
      2. Enter the Application (Client) ID.
      3. Enter the Client Secret.
  6. Under Deployment, copy the provided PowerShell script to Azure CLI or Azure Cloud Shell to create a service principal and grant the required Microsoft Graph permissions.
  7. Click Finish.

Manual App Registration (China Only)

Azure China operates in a separate cloud environment and requires a dedicated application registration to authenticate with AI Exposure using a client secret.

To register a dedicated application for China Cloud authentication:

  1. Log in to your Entra ID tenant.
  2. Navigate to App registrations and then click + New registration.
  3. Enter a Name for the application. For example, AI Exposure China.
  4. Leave all other settings as is, and then click Register.

  5. In the newly created app, navigate to API permissions and then click + Add a permission.

    Note: The User.Read permission, which is configured by default, is not needed. You can leave it as is, or delete it.
  6. Click Microsoft Graph and then Application permissions.
  7. Search for and select the following permissions and then click Add permissions.
    • AuditLog.Read.All
    • Directory.Read.All
    • Policy.Read.All
    • PrivilegedAssignmentSchedule.Read.AzureADGroup
    • PrivilegedEligibilitySchedule.Read.AzureADGroup
    • RoleManagementPolicy.Read.AzureADGroup
    • RoleManagement.Read.All

  8. Click Certificates & Secrets and then, under Client Secrets, click + New client secret.

    • Enter a Description for the secret.
    • Define when the secret Expires.
    • When finished, click Add.
    Note: Choose any expiration period that complies with your organizational policies. When the secret expires, create a new one, then edit and update the value in Tenable.
  9. Copy the secret Value. You will need to enter this value in the AI Exposure Console.
  10. Click Overview and copy the Application (client) ID value. You will need to enter this value in the AI Exposure Console.
  11. Click Settings at the top of the portal, and in Directories + subscriptions, find and copy the Directory ID of your tenant. You will need to enter this value in the AI Exposure Console.
  12. Go to the AI Exposure Console and complete the Connect a Microsoft Entra ID Tenant procedure.

Next Steps

After the Microsoft Entra ID tenant is connected:

  • Identity data begins to appear in AI Exposure, including users, groups, roles, and access relationships.
  • Identity-related risks and insights become available, including permissions analysis and Just-in-Time access visibility.

To gain visibility into Azure resources, configurations, and workloads, connect your Azure organization or subscriptions.