Microsoft Entra ID Integration

This article describes how to add a Microsoft Entra ID connection so you can integrate Entra ID with ControlUp. Read IdP integration overview to learn how you can use IdP integrations with ControlUp.

ControlUp supports two methods for authorizing Entra ID connections:

• OAuth
• Application Registration

Prerequisite permission

To set up an Entra ID connection, your ControlUp account must have the Manage Integrations permission.

Method 1 - OAuth

1. In ControlUp, go to Settings > Integrations > Identity Providers and click the Microsoft Entra ID logo to start adding a new Entra ID integration.
   

2. Under Authorization method, select OAuth 2.0.

3. Select the Purpose for the connection. This determines how ControlUp uses the connection and the required permissions in Entra ID.

4. Enter a Name of your choice. Note that can't see the connection's configuration after you create it, so you should choose an informative name, especially if you have multiple Entra ID tenants.

5. In the Instance Name field, enter your Entra ID tenant name. Read Microsoft's documentation to learn how to get your tenant name.

6. In the Admin Email field, enter the email address of the Entra ID user you want to use to perform the OAuth authentication.

7. Click Add connection.

8. Click Authorize and sign in using the admin email account you entered in step 6. You must accept the requested permissions.

9. Click Test connection to test and finalize the connection. This is a mandatory step.

Method 2 - Application registration

Step 1 - Register an application in Entra ID

1. In Entra ID, go to App registrations > New registration.
2. In the Register an application form, enter the following details:
   1. Enter a Name for the application.
   2. Select the Supported account types.
3. Click Register.
4. Take note of the following values because you'll need to add them into ControlUp's settings.
   • Application (client) ID
   • Object ID
   • Directory (tenant) ID
     

Step 2 - Add permissions to the application

1. In Entra ID, go to API permissions > Add a permission.

2. Select Microsoft Graph.

3. Select Application permissions.

4. Add the required permissions based on which ControlUp module uses the connection:

   • For Authentication and authorization, add the following permissions:
     • User.Read.All
     • Group.Read.All
     • Application.ReadWrite.All (required only for automatic SAML setup)
     • Policy.ReadWrite.ApplicationConfiguration (required only for automatic SAML setup)
   • For Secure DX, add the following permissions:
     • User.Read.All
     • AuditLog.Read.All

5. After adding the permissions, click Grant admin consent for Default Directory.

Step 3 - Create a client secret

1. In Entra ID, go to Certificates & secrets > New client secret.
2. Enter a name and expiration date for the client secret. If the client secret expires and is not replaced with a new one, then ControlUp can't use the connection.
3. Take note of the client secret Value because you'll need to add it to ControlUp's settings. You must copy the value and save it somewhere safe now because you won't be able to view it again.
   

Step 4 - Set up the connection in ControlUp

1. In ControlUp, go to Settings > Integrations > Identity Providers and click the Microsoft Entra ID logo to start adding a new Entra ID connection.
   

2. Under Authorization method, select Application Registration.

3. Select the Purpose for the connection. This determines how ControlUp uses the connection and the required permissions in Entra ID.

4. Enter a Name of your choice. Note that can't see the connection's configuration after you create it, so you should choose an informative name, especially if you have multiple Entra ID tenants.

5. Add the following values you got from Step 1 - Register an application in Entra ID:

   • Application (client) ID
   • Object ID
   • Directory (tenant) ID

6. Add the client secret value you got from Step 3 - Create a client secret.

7. Click Add connection.

8. Locate the connection you added in the list and click Test Connection to test and finalize the connection. This is a mandatory step.