Reference · built on requestConnectorIdentity, IT & observability

Microsoft Entra ID

Users, groups, directory roles, sign-in logs, and audit logs from a Microsoft Entra tenant through Microsoft Graph.

Request accessPricing ↗

About

Microsoft Entra ID is Microsoft's cloud directory. Microsoft Graph exposes it at https://graph.microsoft.com/v1.0: users, groups, directory roles, applications, service principals, and the activity logs under /auditLogs. Delta query tracks changes to users and groups with @odata.deltaLink, and change notifications push user and group changes to a webhook, Azure Event Hubs, or Azure Event Grid.

Through Fibric, an operator reads sign-ins and directory audits, follows delta changes, and proposes an account disable, a group membership change, or a password reset. Nothing changes until you approve it, and the receipt keeps the before state.

This is a reference listing. It documents what Fibric would read from Microsoft Entra ID and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Users through /users and /users/{id}, with manager, memberOf, and directReports, and change tracking through /users/delta
  • Groups, owners, and members through /groups, with delta tracking and change notifications on /groups and /groups/{id}/members
  • Directory audit records through GET /auditLogs/directoryAudits: changes to users, groups, applications, and licenses
  • Sign-in records through GET /auditLogs/signIns: interactive, non-interactive, service principal, and managed identity sign-ins, with risk and Conditional Access detail
  • directoryRole, application, servicePrincipal, device, and oAuth2PermissionGrant collections through their delta functions
  • Change notifications for user and group resources, delivered by webhook, Azure Event Hubs, or Azure Event Grid

Proposed actions

  • Target capability: propose setting accountEnabled to false on a user through PATCH /users/{id}
  • Target capability: propose adding or removing a group member or owner
  • Target capability: propose a password reset for a user, which Microsoft Graph pairs with invalidating refresh tokens
  • Target capability: propose a change notification subscription on /users or /groups through the subscription resource

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Disable a leaver's account the same hour

    When the leaver record arrives, the operator reads the user's groups and directory roles, then proposes accountEnabled false and a password reset that invalidates refresh tokens. You approve; the receipt keeps the before state.

    With Offboarding Sweep

  • Catch sign-ins that do not fit

    Sign-in records carry riskLevelDuringSignIn, location, and conditionalAccessStatus. The operator raises clusters of failed or risky sign-ins per user with the record ids as evidence.

    With Access Anomaly

  • List accounts with no sign-in

    The operator joins /users with /auditLogs/signIns over the retention window and drafts a disable list for the accounts that never appear.

    With Stale Accounts

  • Review who holds which role

    directoryRole and group delta responses feed one review page per owner. Each removal is a proposal with the object ids and the audit record that will result.

    With Access Review

Requirements

  • A Microsoft Entra tenant and an administrator to grant admin consent to the app's application permissions
  • AuditLog.Read.All for /auditLogs/signIns; delegated callers also need a role such as Reports Reader, Security Reader, or Global Reader
  • Microsoft Entra ID P1 or P2 to retain audit and sign-in logs for 30 days; Free keeps seven days
  • A public HTTPS notification URL if you use change notifications, renewed before the 41,760 minute maximum for directory resources
Authentication
An app registration in the Microsoft Entra admin center with a client secret, certificate, or federated credential, using app-only access with application permissions such as User.Read.All and AuditLog.Read.All that an administrator consents to.

Limits

  • Identity service throttling is per app and tenant pair, 3,500 to 8,000 resource units per 10 seconds by tenant size, with no Retry-After on 429
  • Writes are capped at 3,000 requests per 2 minutes and 30 seconds per app and tenant pair
  • Delta tokens for directory objects expire after seven days, and a 410 Gone means a full resync
  • Sign-in pages hold at most 1,000 objects, newest first; filter by createdDateTime range to avoid timeouts

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Microsoft Entra ID ↗

Questions and answers

Which logs does Microsoft Graph expose for Entra ID?
Directory audits at /auditLogs/directoryAudits and sign-ins at /auditLogs/signIns on v1.0. Provisioning logs and custom security attribute audits are on the beta endpoint. Reading sign-ins needs AuditLog.Read.All; Conditional Access detail also needs Policy.Read.All or a role that can read Conditional Access data.
How long does Entra keep audit and sign-in data?
Seven days on Microsoft Entra ID Free and 30 days on P1 and P2. The change is not retroactive: after an upgrade only data still inside the seven-day window is visible. Longer retention means routing logs to Azure Monitor or an Azure storage account.
Do I poll or subscribe for directory changes?
Both work. Delta query on /users/delta and /groups/delta returns changes since the last @odata.deltaLink and supports $deltatoken=latest to start from now. Change notifications push created, updated, and deleted events, but user and group subscriptions must be renewed within 41,760 minutes.
Ask about Microsoft Entra ID

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Microsoft Entra ID through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy