Microsoft Entra ID

What it covers

Identity governance: member MFA registration, stale guests, and sign-in log access.

Credential to create

Microsoft Entra app registration (app-only Graph access)

Register an app

Permissions to grant

• Organization.Read.All (health)
• AuditLog.Read.All (sign-in activity and auth-method registration report)
• User.Read.All (guest and member accounts)

Setup steps

1. Register an app in Microsoft Entra and add the application permissions listed above, then grant admin consent for your tenant.
2. Create a client secret on the app registration.
3. In Joopler, enter the Directory (tenant) ID and Application (client) ID, and paste the client secret. Joopler mints and refreshes the Graph token itself, so the connection keeps working.

Notes and gotchas

• The durable path is tenant id + client id + client secret. You can instead paste a one-off Graph token, but it expires in about an hour, so scheduled runs would stop.
• Admin consent URL: https://login.microsoftonline.com/{tenant}/adminconsent?client_id={clientId}