Skip to main content

Microsoft Entra ID proof types and permissions

Note

Hyperproof connects to many third-party systems that frequently change, including the system interface. Contact your System Administrator or the third-party provider for assistance meeting the requirements to integrate with Hyperproof and collect the proof you need.

Note

Microsoft has renamed Azure AD to Microsoft Entra ID.

Prerequisite: A Premium Entra ID subscription (P1 or P2) is required for this Hypersync to work.

When you create a Hypersync between Hyperproof and Microsoft Entra ID , you can automatically collect proof based on:

  • Lists of Users

    • Last Password Change Update

  • Lists of Groups

  • Group Memberships

  • Password Protection

  • Assigned Licenses

Additional documentation

Note

You only need to connect Hyperproof to the app once, and then you can create as many Hypersyncs as you need. Additionally, you can create multiple Hypersyncs for a single control or label.

Permissions

The Microsoft Entra ID Hypersync uses the Microsoft Graph API to retrieve information about users and groups in a Microsoft Entra ID instance. Users of the Hypersync authorize access to their Microsoft Entra ID instance using the OAuth interactive authorization code flow as described in this article.

  • The Hypersync uses the Directory.AccessAsUser.All scope, which grants the Hypersync access to all the directory information accessible by the authorizing user.

  • It also uses the AuditLog.Read.All scope, which grants the Hypersync read access to all audit log data accessible by the authorizing user.

  • Use the main Microsoft.Resources reader attribute to add the required reader permissions to the service account.

The Microsoft Entra ID Hypersync currently only retrieves user and group information from Microsoft Entra ID. One of the APIs used by the Microsoft Entra ID Hypersync can be found in this article.

Granting tenant-wide access

In this section: