Microsoft Entra ID Support

In addition to Active Directory, Tenable Identity Exposure supports Microsoft Entra ID (formerly Azure AD or AAD) to expand the scope of identities in an organization. This capability leverages new Indicators of Exposure that focus on risks specific to Microsoft Entra ID.

To integrate Microsoft Entra ID with Tenable Identity Exposure, follow closely this on-boarding process:

1. Have the Prerequisites

2. Check the Permissions

3. Configure Microsoft Entra ID settings

4. Activate Microsoft Entra ID support

5. Enable tenant scans

Prerequisites

You must have a Tenable Vulnerability Management account to use the Microsoft Entra ID support feature. This account allows you to configure Tenable scans for your Microsoft Entra ID and collect the results of these scans.

Permissions

The support of Microsoft Entra ID requires the collecting of data from Microsoft Entra ID such as users, groups, applications, service principals, roles, permissions, policies, logs, etc. It collects this data using Microsoft Graph API and service principal credentials following Microsoft recommendations.

• You must sign in to Microsoft Entra ID as a user with permissions to grant tenant-wide administrator consent on Microsoft Graph, which must have the Global Administrator or Privileged Role Administrator role (or any custom role with appropriate permissions), according to Microsoft.

• To access the configuration and data visualization for Microsoft Entra ID, your Tenable Identity Exposure user role must have the appropriate permissions. For more information, see Set Permissions for a Role.

Configure Microsoft Entra ID settings

Use the following procedures (adapted from the Microsoft Quickstart: Register an application with the Microsoft identity platform documentation) to configure all required settings in Microsoft Entra ID.

1. Create an application:

   1. In the Azure Admin portal, open the App registrations page.

   2. Click + New registration.

   3. Give the application a name (Example: "Tenable Identity Collector"). For the other options, you can leave the default values as they are.

   4. Click Register.

   5. On the Overview page for this newly created app, make a note of the "Application (client) ID" and the "Directory (tenant) ID".

2. Add credentials to the application:

   1. In the Azure Admin portal, open the App registrations page.

   2. Click on the application you created.

   3. In the left-hand menu, click Certificates & secrets.

   4. Click + New client secret.

   5. In the Description box, give a practical name to this secret and an Expiry value compliant with your policies. Remember to renew this secret near its expiry date.

   6. Save the secret value in a secure location because Azure only shows this once, and you must recreate it if you lose it.

3. Assign permissions to the application:

   1. In the Azure Admin portal, open the App registrations page.

   2. Click on the application you created.

   3. In the left-hand menu, click API permissions.

   4. Remove the existing User.Read permission:
      
   

   5. Click + Add a permission:

   

   6. Select Microsoft Graph:

   

   7. Select Application permissions (not "Delegated permissions").

   

   8. Use the list or the search bar to find and select all the following permissions:

   • AuditLog.Read.All

   • Directory.Read.All

   • IdentityProvider.Read.All

   • Policy.Read.All

   • Reports.Read.All

   • RoleManagement.Read.All

   • UserAuthenticationMethod.Read.All

   9. Click Add permissions.

   10. Click Grant admin consent for <tenant name> and click Yes to confirm:

   

4. After you configure all the required settings in Microsoft Entra ID:

   1. In Tenable Vulnerability Management, create a new credential of type "Microsoft Azure".

   2. Select the "Key" authentication method and enter the values that you retrieved in the previous procedure: Tenant ID, Application ID, and Client Secret.

Activate Microsoft Entra ID support

Enable tenant scans